e3e2db7409601e6d26cd5a53f452c6ce32ea662d99279d7c3bf932674df9ad4f

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.2MB
Sample260812-p2v4dsgp41
SHA256 e3e2db7409601e6d26cd5a53f452c6ce32ea662d99279d7c3bf932674df9ad4f
MD5 d9414fbd0cd06be5dc31f5d0ecda19a7
SHA1 d0016710abf12e3a65a33ffdb39374ce06255bbc
SHA512 79942f58f4a0d1f58f41acc89fdd13b7e6007e5b04eb862889bc2915b4e5cd7540d70e07cbf8c234dbfd2f4a47dd0fe897d4f68e274baa03ef06ae068e58d268
SSDEEP 24576:twk/twQ+MI/xsU5CbrtjrKKFJELMY6U0aGCXTeSKsyd:Ck/tf+ZxsN5OKF676sGCXiXsy
TLSH
T1B245ADF46390F59FF1C186379FC98A225A32F85DC6CA815B16506B5A2E335F22736233
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2396	elevation_service.exe
5100	elevation_service.exe
2072	maintenanceservice.exe
6072	OSE.EXE
5176	PerceptionSimulationService.exe
2992	perfhost.exe
600	ReFsDedupSvc.exe
2388	SensorDataService.exe
1836	ssh-agent.exe
2096	AgentService.exe
864	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1c957ed7e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f33fc66f592add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036f7f626592add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ced1f25592add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081a64c6f592add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001e67f6f592add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027527c25592add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025e7b425592add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e874ff26592add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e9947a6f592add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081f0a029592add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d6b1529592add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2396	elevation_service.exe
2396	elevation_service.exe
2396	elevation_service.exe
2396	elevation_service.exe
2396	elevation_service.exe
2396	elevation_service.exe
2396	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3148	2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	2096	AgentService.exe
Token: SeBackupPrivilege	600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	600	ReFsDedupSvc.exe
Token: 33	864	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	864	SearchIndexer.exe
Token: SeDebugPrivilege	2396	elevation_service.exe
Token: SeDebugPrivilege	5100	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 5588	864	SearchIndexer.exe	101
PID 864 wrote to memory of 1888	864	SearchIndexer.exe	102
PID 864 wrote to memory of 4864	864	SearchIndexer.exe	103
PID 864 wrote to memory of 4480	864	SearchIndexer.exe	104
PID 864 wrote to memory of 1392	864	SearchIndexer.exe	106
PID 864 wrote to memory of 3400	864	SearchIndexer.exe	107
PID 864 wrote to memory of 3104	864	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_d9414fbd0cd06be5dc31f5d0ecda19a7_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3148

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2072

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6072

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5176

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2992

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:600

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2388

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1836

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5588
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1888
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 994108bd2c85a9e2e6045117140d302e6fce448af1412b27bc65da588efdc691
MD5 da85467b37d9ce5c64a14f4d000dc707
SHA1 28548e35a24ea15138d17a16a3866c91e2dbb797
SHA512 d22de048fac8d327343af6a02f5995c0a1154f1db68a3f4c0324b9c17d873cbf4c0f48d22c2820002633686122fdca4fbf5ca2a6f44b602ae503341b40ee5ae7
SSDEEP 49152:Wb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnK5OKF676sGCXiXsy:I3q6HjBHOK07JGCXicy
TLSH
T179D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 c5693f6f4812ea13483a7ed71784ee8084d67399ca4905b473bf65e63640b936
MD5 f55e7873fc3f8e97e8f527c7784d4a7e
SHA1 ca49fcb342c27f47138b611786cb156337d3a29b
SHA512 7812d955202d2b899349a7bf6667dc2cbbfca7c14c340d9732048a2a003b276cafcf9a57a55c9036da48a1312250309d50954e9b953a46aa77c28517aac8b69b
SSDEEP 24576:NXYfDtczAhbrtjrKKFJELMY6U0aGCXTeSKsyd:YtcM5OKF676sGCXiXsy
TLSH
T10A65013867E408F9EC678239C9A28501EA327C5547A4E7DB03E499391F337D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 17308f673c15e65ac40163ad0df486b81d7790eb1a2851824e4efe4a69438268
MD5 acb6f70f2707c5c1244a8d0b42ee606b
SHA1 dc1b7f8bfef9aea48bb9851751d80abff21d1070
SHA512 82503167dbafbc3b15daf25714d9104d91401cbfd3f1dc56d71996a0c0a9c190fb5984f7d27ef413ecf096e40e1b1f782a5a7f119455c275c4eda0d2c1640c0f
SSDEEP 24576:G0Le5ji0hmxirM6brtjrKKFJELMY6U0aGCXTeSKsyd:GPji0AcH5OKF676sGCXiXsy
TLSH
T1E9859E25F6748335D073C0B9C5D2A68AED7130865B308ACB4296D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0485eaef031ab0013ac01e1bcfc901a83ffa9ea4084591005a02d9c016876d51
MD5 bd719374251e2d889b11f46fc74a6a26
SHA1 8b05f274d05a2547d69fdcc03bac8a0d7158e47e
SHA512 d9085edb9ceb238f5e6622c9c243b4c72e12f8b2df92bda8e1e369bb68901a2128dda9ca336e2b6f1e68168adcf2bc12610ae2c16ad56e371db5864f802cd4a7
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWE6q8wyusbrtjrKKFJELMY6U0aGCXTeSKsyd:U/ezSC6vUzPvxHjyr5OKF676sGCXiXsy
TLSH
T169755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d156d7dbe2805d4354a4f0d9cc9a0f405482c9a01318567f94c0cd47b6950aff
MD5 b1d19d6c70144d054e54757eebf272de
SHA1 aba06674fc02e9bbb6f06b6b060afa0718c7ba4f
SHA512 ac39f6db9c9ee5d4e8c3a29edf5e46923f5ac1de50eab9200a61204995b25022eb0b44566410a3275cf0d94aa51a8d0bb0e289440a4140169b8ee0b276d3b56c
SSDEEP 24576:2VbqPb88hv/l+61brtjrKKFJELMY6U0aGCXTeSKsyd:2VO88hXl+m5OKF676sGCXiXsy
TLSH
T1AF559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB1246D72C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 69bd688c98340ba8dd689bd881ae925aaa77780757dfaba97f0f6398229f2f9d
MD5 45283b925449494adcd060fbd6f04a5d
SHA1 7d5c2be632b51d8d8d82cf25c305a77d40adea06
SHA512 6205ff56ce0285d913f86726a5fc0abc13b6b159d47b717f51217532357be87b1d2e44a662c820d1bc2081528b4e496af94820a9903714bbf54a1576e02443f6
SSDEEP 12288:aRs7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:aRObrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1DE4523704F7D2449E1FA2132A6B35EC5F8083E185CDCC878E865762D247EBEAD0685ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 cc0ef0d2ee59c496ad766947fdacc7e92b343693eeeb8d8bdf03cac1cc524170
MD5 7efff5e2beec003af6ea2fafad3c5466
SHA1 4cc148edba2950a4a0e47ae0798e4efd0ba2fe14
SHA512 9c73c88e3707a0ca07bbcd1ef4039a0f47cd205dd688e390913e3868125b817d26c0fe0b5a97b227c3d182cefc083701ff1f5b4968a6fe10236acec01cd45a16
SSDEEP 24576:PJIUtbrtjrKKFJELMY6U0aGCXTeSKsyd:PJIUl5OKF676sGCXiXsy
TLSH
T1E865DF3BAE28FCD2C27E89795B918740E76278304F61A3CBD174830E9E236E55D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ebdd5a0f0c5f8f67e8b88c7ea68a36e27408ce2b4a13ff72e663e29807d1f244
MD5 f8b1814ebd3c12e2235352513d88c475
SHA1 b4e5b87227c1437b948e223c12c1cacd8de284a9
SHA512 c1bde84e8cafcf0133cae53fceb23a8e50cc111bb0cde091bb690a82c6d4146c854d99f0320aa03b994d9fbd9b501b26fe6146c15d8281c1733197d917e9c06b
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THd:DQvGAdlCEL8c/yRNw5C4OK07JGCXicy
TLSH
T152266C656BF880F5E0A7E134897AC6B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 97ea019c0f5b8231b815794877139f8707e3cb1e688e512b0ba30a4c1340f9fd
MD5 f8b0482ff6386d40db2a4178116903e1
SHA1 a98b7c2cc42a27d017c1b5556ee4f001f79df7ab
SHA512 b3f21ac2bc6f330a264a7923a208ba1f2b3a9c635fa944b279862b9720202c0f0e2c16cbbae0cc04076a0c0fa4bdd8a20b7f9101761b70c4ff7fb6bd20ccc537
SSDEEP 24576:XdewsAjfbrtjrKKFJELMY6U0aGCXTeSKsyd:tljX5OKF676sGCXiXsy
TLSH
T1FB75E031FE75E436C2BF0DB21B36C716582C79204FA519C3E3A89E9D59342D22376A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 afa4fc4bc9984e8284482acb5e68c22d83259b2205b12d6fa7291b377aa71dc6
MD5 e4e084050d0a5936aedcd2edf79df20d
SHA1 dc90ec05e5b978ff3effa96a1d4418aeeb66aa6c
SHA512 0b2eae839c34da8678756f6f18c8425e57e45515ac6ea359d37871b8dd8aa2666c57b65a6f9043b6927942b330c451d944599f44e1280d4f3058b78441dac355
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHL07MU:KUEtQevvqc2W1cpV2EI32L0
TLSH
T16F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4f32a36987479eadd3649f50277b52f0f2a20c5575436c1299d34ceeec180e70
MD5 a8c5f5d825ba1b85dfea733e08515338
SHA1 2baf1b1c3e98aa9be61688de96cd055451ea7023
SHA512 f4b610bbe0deaae275fe7ef7fc012f6cd773c2137720734d131b141128eeccb55380494bbc14ebf7f80e9acde85ab94955d80997399fecb0bbf40e4321ae607a
SSDEEP 49152:GCbRquA/m2yL5zTfFiV+XenmE3/z35OKF676sGCXiXsy:roquVjnm0OK07JGCXicy
TLSH
T164D58D1976B881E4D1F6C37886A2C647F37178154B34A7EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 09dcee48a71b4e52138a090a2c288d29152109f255462c5c040548be29b6aadd
MD5 023b5a032a28b8eb85a1b014cfe8562f
SHA1 9c5987443a7ac4a5b42240df9172f91b394ded24
SHA512 4ca2efa666e7d4161a76b7235b72c6b8ef9cc8b8dcec5b2f71fca965460f823bc9283f142151a0f4aaea24a8acd9be31a039d60fe7e09790cd6ee525ddbf0597
SSDEEP 24576:uAhGLJIFoiwtA5l7S53YbrtjrKKFJELMY6U0aGCXTeSKsyd:uAMyFoiq5Q5OKF676sGCXiXsy
TLSH
T1EB359D80EBF955D4F5B3AA7899B68570EA76BCA95E30C20F2160D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 6273f4e1f156ae3cb5e309cfa11a4834cea1181cb432ddb894c26e796c2e73d0
MD5 31a8a7e105a0fda39b6ea823811320aa
SHA1 fd3cda3cb3a2c1ad2034376d07d69a1c8f357539
SHA512 d77d8946e2e54f2a709b7beac4295151ab2ab3993021e1cf6e355d6ee3b4548351d77ac79372c7b1b148904e25d520f95bd64d8c8c63ccfab0307d336f39f6be
SSDEEP 24576:mwuoOWbbrtjrKKFJELMY6U0aGCXTeSKsyd:mwDOk5OKF676sGCXiXsy
TLSH
T1F065F14536A81CF9E5A78239C657C536F7B2BC012A65CB2F1760C61B2F37361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 22a312b9438f3d15c0df787373b38554c9b8d969cbaf13c904a3ea9ac501312c
MD5 17b655dc3b6bc45237c2bf2d7a7eb294
SHA1 6629f350538f45421a36fd6a9fea03e197ad9d45
SHA512 cf3d8966ec86f2869f2f6074974344e1b5169e6b1987da74b162dd500251cbfba430f2e1ffc56cfa1460006e2afa407a873cd287c238a25d3db09a1dd27af23f
SSDEEP 12288:6BZ1Iyr7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:0ZuybrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1D85512A527A830F9E0E75239C9F24A85E7213C1627B983CF1524522E2F37BD65C39772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 17c5851786d7444049e9571fb636ef96d87ebff040332380e0ac8941ec555bf2
MD5 0bff1bac5881fa0fa17298ff0fc81742
SHA1 5fab2c1c6bad5781a14d4614ae974dab4d3e6f8d
SHA512 9acc456eb6b9e23fb2f978c46f9df9381cc26772ef4d6e828631cff5a23b1eea1f027fc416905609123a79f68e5e4d438e34508cd0bc9729677a39af7010bac3
SSDEEP 98304:NQRQyi36YOcPQLvw2gAf+PN37OK07JGCXicy:kQyiKayX+PNp07MU
TLSH
T169667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9281116396d75beebaefbdbeea81a38748e85f80f862d0a1d5c1d21a6bd5a1b8
MD5 e595d3a108f72fb9d8a296c6c3578fc2
SHA1 2c241423acaa1a014e5a5e7eac33ec91a9d0f26c
SHA512 50dced508908ddf672a66cbbb43ba7ab530e4b680ef7489d640df0e73fd2abcd8cde64597b289e7773dc42c05f5772dcdf1a096480dc728c39a00a843a8a5e07
SSDEEP 98304:GQRQyi36YOcPQLvw2gAf+PN37OK07JGCXicy:tQyiKayX+PNp07MU
TLSH
T171667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4159fbe80fcea8e81d6c13f102b12dac8dc539b15f52d05b2f257eaf407fc37e
MD5 f5693b5338dc1867005e6e924efda14d
SHA1 d275a40618a7947d3fa80d44239131f518fe12c1
SHA512 9e8917f9c9eddba4f8fdf99e7a39c41633280220f3f7536e9c06222cc01aa311fe471b7d54a52a0c0f1f021610edb8d79514729012392bce209656c5774eb8f6
SSDEEP 49152:968Qg55nhheWu7PNU3/H5OKF676sGCXiXsy:7thWRc/ZOK07JGCXicy
TLSH
T153B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3ddd0f63c7883d403789e432f3e17236c1ff101a410a5bce8e6c83964d3c46c7
MD5 d6b76237450dde0360195a342f439659
SHA1 5b09afcf3f23bd2bb16425d9310940cd90bace97
SHA512 add7159f27f549dcd9c3d8b942d48678aabed38f0737e2a6533af9a95577dc2598b6adbc23f8a94f191b149ce446ae85145dd1c0a64b30f7c3bd5bdf997e665b
SSDEEP 98304:ly5112gYy5azzVvL69nLKnhZaOK07JGCXicy:ILIHmWhg07MU
TLSH
T10D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1fdbf4ccba539d8feb3a6e439378eeccb898a38df7f72e9f7755ee44b23ef63e
MD5 ffad26bbad4003744a3620259c9612a6
SHA1 7cfa33afc354f8bfda876c0c42f8392585b48ce4
SHA512 bdf377a63c93fa8b128bed1752a1e9998fa66542db999469de129b2d99b59b410296b8869c3a4c0b2932afc5443d49ad2b4845866db7551a363f1d8087d2242a
SSDEEP 49152:NB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glx5OKF676sGCXiXsy:Tu6JmVxd2dzOK07JGCXicy
TLSH
T119D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f4647a407b52bde317df3e5dccd46909c27fee928023d56949d1ee490cf08696
MD5 8402752fbe52021cc6c4fc77868b5d88
SHA1 5506759f7dab26b7ef238a92c65276e2e1b10e9d
SHA512 dc301b6df2076e1d7cc3af79012c3bd97ab64050be9d9e32ea6e153b84d0e79c99a4044641f33d901f3c0b70648d8f750027de6cd131fbaa15b34634bdb515b0
SSDEEP 49152:Z1hpsNoJpF1A6UU44CwH7R4xF5OKF676sGCXiXsy:ZmifPbR0OK07JGCXicy
TLSH
T11FB5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 203ae827dbd32589325e5c25da6cb5abcc5baf84c3ccfe374c7b1e4f38d9f17e
MD5 57ddbb4e690805356a22f99e5a602d2f
SHA1 a6b0e3931808db656e3fc10c3d58b615b3fae361
SHA512 420cd5c0951d23f4a866723868f3d1390b3e086e768ff9dfd34757f6cb8f4776a27852481b6d19a32f7edea3c14f6edefc9c7a748e8dfe2cef7941b83e4a8320
SSDEEP 49152:5SuZQIY0Be2KRRVtOnks6NMHqa5OKF676sGCXiXsy:X5dKTi61+OK07JGCXicy
TLSH
T113C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b725f1fd025292ba7660e4eceaec263387846ca53d4157204922190273d3c9a5
MD5 a727cf1bac92d93dd1ca8814d1b727b2
SHA1 483c4b2d91ff96f50c4b725db40bb8d94d03e3b9
SHA512 2b64d9b1452eb25fea433a5898813c25def4b2b34281114949d3a0dc0c9160f5326e6afaa8218854dfa480e50c8cd8b39ad7618eda79b48d40d2e54da3c94ec9
SSDEEP 49152:WhtSn8EApI0figngiDn0AP5wB5OKF676sGCXiXsy:3X2iyphgOK07JGCXicy
TLSH
T15B95BE13F2D900E8D06ED174C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 95ddf60764e9fd26085448f922b97770d06377c9af03ef53424abfe125fd6203
MD5 f13f73b9ac04d8e6386f3cc30006aed1
SHA1 dbade0874e920a6dc5f1ac660e53488db2bdc9fc
SHA512 02bab20a977dcdbd0640b70e4a84e153d9571a91ee4466ff066ef50abfb93af84b5689ea1ca488dbb55ec45177cac14514c29050a545f91d200d0d5dc6747705
SSDEEP 12288:pk7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:pGbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1794523705E7E254AE0A96232D6630FC4F80C3E09ACDDC4B8B969712D257FBEE50585EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e29e28c9d97bd95b302ae0f990c4fe010e97a97cf4251054e4f33b25714f0558
MD5 fc58b2139e9171e964a352bcafd308b3
SHA1 eb9567153225a51994b3c46a6a3a166ac1e66d4a
SHA512 3d8d488eb6b73c05ab6af2af9b1ea79e5fee392cf7bcd95115c20ef64d667a387f0678e0442a85b66aad8436021bc4b847c71fc7794c037f255af02534168fb4
SSDEEP 12288:Yv7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:YjbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T15E4523705E7E254AE0A96132D7630BC4F80C3E09ACDDC4B8B969712D257FBEE50189EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5e29178e91d92d14bd981459da188d678206631164bc909ec668102b990c3708
MD5 8ce2ab725d7b165deb39e7ead53c312d
SHA1 af36ea26b143bce188c3c7349c058badf2483f27
SHA512 c838ae47ee4087a7925ce84072fc61e34f1d289c2f898406561f761e7efd353497fea8f3b9f8de8e4260d479768fd366ab2dd31cb416e77d96aa1607bd4e5bff
SSDEEP 12288:zF7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:zlbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1A74523705E7E254AE0A96132D6630BC4F80C3E09ACDDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 862adfb2a11fbbba39a4fed115065268e57e21020d67bb361c7f62fadab8397e
MD5 d644f5bdc4fe0f34892d33f9e988eaf5
SHA1 af07b03033125b9f25bcda653c987b06083c3736
SHA512 e9766d348f1edfb04d39cef825b4a545dc823d77bcec5b1ed721c8fbcc3ebe785779109540af4acb1056f33a041c5e55616014dfc5cd8400510a07a991ca685e
SSDEEP 12288:6Va7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:jbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1134523701B7E10C9D0F6A232C6734AC4F5583D18A8F9D6FFA910252D1D7B7E96438AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b89a51c579c56aaf0661ab5b743c4e2510b23126cb2a664605ed9ecc2c9de433
MD5 aa3945a2c8f80be446fa03df6bcd9549
SHA1 37e41a5e8dd9a3bdf5447971e551c778b2f4bb05
SHA512 7909c6a2b3de30b6d352fc2886e8ba3f6f15cd369c6d296a57235aeb38408c077efd2da83c1d307b2a43033bf43aadc229192cc139e3da7f07b552671e86f9df
SSDEEP 12288:iC7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:iAbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1FA4523705E7E254AE0A96132D6630BC4F80C3E09ACDDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 87e1ba9a0b3d238135ad089b5ddde30ac0cdc2c22a26fa05f23f1118d37e87cd
MD5 e72ff15180fa5d1e596020f47f817781
SHA1 8aae48df738f958fb95e5c4db71bfe0994de16c2
SHA512 57048e7cfa3a61a14c1e8f0b19033a4b2b947219dd9f2ca6cb7b755c789dfde9d16713a3a9ddfb01a0d43bcbe1758213cc529f7eade3fc6c9d967c758b1841d8
SSDEEP 12288:xT7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:x3brtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1B34523705E7E254AE0A96132D7630BC4F80C3E09ACDDC4B8B969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2cddf34ee2c89325fc44d8135713af9087f57591d543a642ef4836a62fb2b3b9
MD5 37b1016ee9d624fc23d06afbeb00b254
SHA1 cd66afd445dd3bd145524380299f9261bd3a1715
SHA512 bf3e94af8b81c41add4263f9b153e67b45d252524928c91be55c7d0b20db7600d23bcfeb3d996bfe1d434901aa25408eda493e9669a35d2438effd72b2afa74a
SSDEEP 12288:VX7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:VLbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T15E4523705E7E254AE0A9613297634BC4F80C3E09A8DDC4B8F969712D357FBEE50189EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 476c7e0a6e756443ca2a498b5571ebff73c1fb78c04bce061397f01a4e945606
MD5 36ffc2cfeedc902a8e2b63e485d2d110
SHA1 005a059668bcd78ef688282052b8befd8ca0ea96
SHA512 49a4a989aff5a1197bf4e3a9519c0c2a65038d877372b9e21cc05ac96d4c0763866b3e54476d331f46fe03d1d2691a2a963f1635445cae018929bc68de20cfd5
SSDEEP 24576:aZMSzFVSODbrtjrKKFJELMY6U0aGCXTeSKsyd:aZMSzfv5OKF676sGCXiXsy
TLSH
T1666502A473A418F8ECA7813EC9668D45E5B17C190AB0C65F17B4362B1F373A11C3DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f6c89ba25461bab95b2d1d88cf1411ceb38085832daea6990e80efbc7aa949b6
MD5 ff34b120b89bba08ba473aa2119f6cc7
SHA1 8bbc7e0ae21dae53b60a496e2dec0c67e8c37f45
SHA512 87c84ac9076afb3a55fa476b9d12bc5cddbc0e77a1ed2aad1fc283832032fd2a9419c8a1b989d704a4055c67193897ad1571c2d0d65515c931ab968c69cf4b91
SSDEEP 12288:+w7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:+CbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1544523705E7E254AE0A92132D7634BC4F80C3E09A8DDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e2494777340b3167698e87c51d27fed9998b97b449380cc123d03fe364d677cf
MD5 dca3559a1790170d89a1c86949cc6a43
SHA1 002190c9a82ab8be2925d506e76f8d974df61b1a
SHA512 7ac66b47536c92106f8643e528be1a4d2f50af873b656aeb1e14bb41d62bbb1583f1295e596a8c1f67f20dc2479fa92f67da5fbff47bafa265c1ce8e5a3ddba7
SSDEEP 12288:dc7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:debrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1B94523705E7E254AE0A9213297634BC8F80C3E09A8DDC4B8F969712D357FBEE50585EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f400efc4a51c569b7c0c87d838ed9bcaed5676093e097eac3782e29059001140
MD5 0168b1f1b756b90efa6a38575cf1140b
SHA1 5e997dcd7efb334871cfbdbf5cf4a899c29ac81e
SHA512 c331683da01c836e0d23c3f40e9875e48325485e57c8ea019bebe01ad25e158c395f3555eed80cc2aeaf5b6f393996b1381118432f83daf72952a5fc13341b00
SSDEEP 12288:PyPz5L8r7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:izyvbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T18955021327A530F9D0769235C9A20A41F7757C364BA4CAAF57A4033A2E377E19D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f7ed298130de03f892b92a28b2998808ca0524d7bcf76befca8e80501c37b78b
MD5 8ca454787435246401dee399bf44c761
SHA1 fd182c6910eff359ad18e1ded049d150fbe7bcb2
SHA512 5585fb17efe55d5925a76b074b857daebfe95e2350c70d300dbf4d14eb47d5e53d753c1a3f3b43425c3222ddb1ac19338fe1c28ca7046e32711c27b0ae9cce3b
SSDEEP 12288:Kw7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:KCbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1B14523705E7E254AE0A92132D7634BC4F80C3E09A8DDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 cc1be6955a3ff1618b2bf443e9e3dbe84e633b21ad1506eeae91550f3f415eec
MD5 c09c2e4e2a70a8aabd18b1c0ed6b3229
SHA1 fcbf20d484ae70c4f9a4fd16b2e8dd2715a299fa
SHA512 b1daa4ae5ba8b44a94d1caa835cc46266a0560b7ef6ee22abb9487036537cf70fbc3568fe46ccb5234c578fc657e7a35962fdb6d6bb96eb10a03976cd138b95f
SSDEEP 12288:hw7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:hCbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T12E4523705E7E254AE0A9213296634BC4F80C3E09A8DDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 68d3d57395f1cbcca593169a2e32d82a78bcf1939b9447ef07b069bdc7f96aa8
MD5 6dfc42c8934e019f4d81148d1ae1e12a
SHA1 0b3374bb7f82d9ea9c187c51b477d98eff52551e
SHA512 9b83177fd1a5bd4b07a0ff5f98030ef1f4a5b915e1e0f6b42fb6435baf4cab12b78c0baad8f96ac764165c29b0d89deaecb1a5307d3d7be435f9f3c8272e18b4
SSDEEP 12288:NyPz5L8r7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:kzyvbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T13555021327A530F9D0769235C9A20A41F7757C360BA4CAAF57A4133A2E377E19D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 efe4beb7bbe890649f9de60d8a4dd9f57cd846b76ad32958ee0d859fde2df97b
MD5 649572c82aa032bb476af3f2f068b67a
SHA1 13238f018f26a07dd06fa66deffa6afd4a7e568d
SHA512 2e74554d36bf6804e753b7550fb432b843c06c4deb7f93280c279c56ff06a0026a89c8f5734e12e9c6a8149f86edcbe103c3bd2dfc3164c093d010b9fca80954
SSDEEP 24576:LTHaLl3z0zDVbrtjrKKFJELMY6U0aGCXTeSKsyd:LT6Lljc5OKF676sGCXiXsy
TLSH
T1556502A4B36018F8ECA7813EC9664946D5B17C1A0AB4C65F17B4362B1F373A11C3DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 da20f732ebd330e60f1258dc779bde08fd3c2a12aed06930bfca2a8eda322fb2
MD5 f2f83edf8a43d123ca52421baed97fe4
SHA1 ef044a677e9c08f319341e0675ae486953c710e8
SHA512 b465878cc51ac152bc49489a11e64820790de1351fedff0a3cd67e80d9fc6988cec6f4f641fa4f06778bf26a9859fe2025c8e98cae6954353e1139285eeaccd2
SSDEEP 24576:n37d9CHKy7GZ5brtjrKKFJELMY6U0aGCXTeSKsyd:37d9CHKyav5OKF676sGCXiXsy
TLSH
T18B75CE90F3E814E8F0B79A35C9764511DA767C5A1B71DA8F03A8261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f2c78503d439959bac116b25280ff36a7034066896b19e4f7945cc648a7de675
MD5 6118f58d61e2b92c4dbff616eb468fd9
SHA1 216a435ceccff4ce875a7e8c79b25da4cdae126a
SHA512 1af3730e780af39c28825fbbd864d792bcd4c5f5bdc546d21faf86e9df308f88308b3a65d640fd4da4e17d8c3fd09fc9864d58a89777e8a8c6a9f64c9c0aa2df
SSDEEP 12288:/l7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:/FbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1C74523705E7E254AE0A96132D6630BC4F80C3E09ACDDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 87828c9caa3e1e3a508862146a3405449e7ca6d842068eb8a16124d71a28bf41
MD5 f25df6d5a75209cb676257ba98cbd8e5
SHA1 8f7cb1c0805abdab3e03d02c50a80d1715bf7e2f
SHA512 3141487f83d901eeb346df8e156216be48507c5ce8eaf0cfd2e7bd1360ace08741c7f0bc0af8c15acc041e8c590ff1d4a2f916f7c6ad777a6e98457a48a302ec
SSDEEP 12288:lL7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:lPbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1F14523701E7E244AE0A9613296634FC4F80C3E09ACEDC5B8F969712D257FBEE50185EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0f232651393421fb88a7bfa69f9a5d127912147e34ab9837b5dd4bb3efab2257
MD5 3a18479b4c3128a6ef9c139c5287238f
SHA1 91063c325a30cca6e3d829dd69b2b8d596e2d76d
SHA512 8234ae3d0ee1577d6b9f6017fbfbd635e65059d2024f9e16421cb7f29cd0bf9efdd75a45ce7da76ad501216c16314c6d01ea3b702e91c086c9ee0e8d345225c6
SSDEEP 12288:vm7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:v0brtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T12D4523705E7E254AE0A96132D7630BC4F80C3E09A8DDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f6e9676db8344f9e1d659a60f5d4e98da4631aeacd5f0ce386a8281edb8ff418
MD5 b51518dedb5cd57b7dd3ea9905c31fb1
SHA1 3eeceaeda8c01c212ef02df23af76fad11b0bd74
SHA512 24a701d6e3414c742fc88061059d6dd165b158711edacdcb094fd949d5b09366418f517d2e6a3bb57f771fc353fc22ed70e33ec8c86fb014741d970123643087
SSDEEP 12288:Ow7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:OCbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T14A4523705E7E254AE0A9213296634FC4F80C3E09A8DDC5B8F969712D257FBEE50285EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 d933c19281d8c32969daf08a3e5aec542b085f80bd7c4d7692827a6b3de9f5b5
MD5 53624c47fd6d0e96bba09baa5b886cf2
SHA1 44b46d81bfb34593023aca84570673125a3e5632
SHA512 1bfc27adff8ce93169505d89551bb280738a54f2dbf4d6b0abc0abb6eba264a533ac1c572813118fabfd32c9054fe151d6e9ee3d5c0ecc04d750aba48cbd3d5d
SSDEEP 12288:Zl7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:ZFbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1F54523705E7E254AE0A96132D6630BC4F80C3E09ACDDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a05894f7dc02706e0d37e15a3b682ee49682ee7219812e9c804a804b8637caea
MD5 619a589fc69224c87be3dbe4626f812f
SHA1 acf75273344b6f5d5e82a8934b7bed56ddbe2b94
SHA512 7c69cbf0ea3646fd4a5ac58f933839549dfe73dee88fa18b94da9017f9a2de0c1a430b1411ce665e1089c491be576c0f0d779cbde4b3a46a076721786e3bff8d
SSDEEP 12288:aY7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:aqbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1B14523705E7E254AE0A96132D7630FC4E80C3E09A8DDC5B8F969712D257FBEE50185EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 204cf2654af2e8792cd8897dcace6420c4f406801f728817534bfd93adcf6782
MD5 a9ef0daa0d1166c695e80788d3f989d2
SHA1 a717ead3244acf43b45ddbba099775d9d952f84f
SHA512 0e2894d0cceaf085a4061fc10782f369e85bfedb116ba84cee677fc409e1fa379b6569bc57d0d415633d3b2cfb6f4e8d3fc5796797607c2fa468396d9a5b1980
SSDEEP 12288:YC7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:YAbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1624523705E7E254AE0A96132D6630BC4F80C3E09ACDDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 3534e51f0081369a55c459a499de16e019297a6a4fa22cc6d530ee394357d912
MD5 308fe36685eef1f778d360aa67717bcd
SHA1 67c6ce88175e2b1ff3d3a5772d3a9d198a77a39f
SHA512 13c42fd42fb070bc3d2ae467688dccf7d6d90b98682e5823360ca7e204ef3c049cbfe34e663d6f6bdb13a08792ddc6e2d5819bfcaffb6cd9b4509ac07aafd5b4
SSDEEP 12288:Jd7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:J9brtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1494523705E7E254AE0A96132D7630FC4E80C3E09A8DDC5B8F969712D257FBEE50188EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 8706ec69932f1669c0632f94f5a8fc09cd4b1eab7a3165f4cafaeffe5a533f8c
MD5 0d4a07c21b34ae647e8287f9de941276
SHA1 b7d966d059b4c8abc0e78c16ff442e07a17df5d7
SHA512 19cf7f068fc9547fb23d42f56354ec26f2fb411f7402a24b3d24d5cb6ac7b92d90c2e95dd7b57ef234e145f4ef64bb36417af4aab6f1f694da0bc7b5fc285f8b
SSDEEP 12288:qC7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:qAbrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1404523705E7E254AE0A96132D6630BC4F80C3E09ACDDC4B8F969712D257FBEE50685EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 15a02bb48d5d99fc4475ee50ed9d60fd2685eab718921ae558604e47619c3c79
MD5 ca2063be64cacf0cde2149950725dfcc
SHA1 cfde6a8fce5cbab4544722f0db1734c4910fb201
SHA512 75626b4db04748a829e4094900279733e4e6259ec50edf1b6cc45e8ed4d396e304ed39628f28fdb47f8963b726505625ed52c8dcb2876fc98aa9d6063ab58ae6
SSDEEP 24576:bfwvok9RX6wkyAIubrtjrKKFJELMY6U0aGCXTeSKsyd:9MnYIe5OKF676sGCXiXsy
TLSH
T17985DF29EBDC04E5E0B7923C89B3460AF6B178691B71C6CF129A536D0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2db5bf90a24ad77c8e39e68c2a2027d28ea15e1452b96c381460c9928e029aba
MD5 63fe2fada32a9d0590831f517e9a38cb
SHA1 836242bc7bedec762dba3e1a472653d9e19a46fa
SHA512 d7794501a8b079f1791d1c1c0dbd8f921a9151f31d7f918283c7248f86960e7d1e59dd90d227b87d1d1db7102b5a9597bd2cd1b0943e6cac1a8f2bbad8a81fe0
SSDEEP 49152:aYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0h5OKF676sGCXO:0ySzPbOK07JGCXicy
TLSH
T12B066C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0a8110241257be80c99a448f696f69217bd2ae3b79e2caa6bee0f792db9123c5
MD5 25c3485fa68819e98196187a306b9558
SHA1 4bf480acf2470412431d516688fb6b68ffe61979
SHA512 b5c3044fd7886b1032ccde3105d09e5ba032082acffe70f4f5e8c113069375ceb3de3fc018e1764180a3ab9fabf81103bbaef756e2b82eff9251b0361f37df73
SSDEEP 24576:047Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYTbrtjrKKFJELMY6U0aGCXTeSKsyd:047JUQj1irIhCnDHUPfF/x5OKF676sGr
TLSH
T15065AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 951a4b41321700043394a93fbe17469d483683e9faab5009e45ac1da5b80d683
MD5 f7ca40761c5c7db87717be42223ec375
SHA1 956f572ee981b453813e609e0e4aab85628f22e9
SHA512 47f8e1dc4f49c9bd726fda5dac1798556a41c86ca8cbf93a8bb50faacbece2137a585b6e6e8f95a61e6f1bcc1e97d1d24e3b9071293e2b87d858cc3ed122cf7a
SSDEEP 12288:6NsfA7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:zybrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T14E550129D2A812D8C0AE6235C7524A80F3273C2597E1D3CB66D0F53E1F3A6D49DE9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 384KB
SHA256 07537f03d806dba465a10dfa5ddd69efc8e5609b8f19260ee2f2613713339309
MD5 b658aff0bf92a969a1d31cbe551e6bd5
SHA1 990b3001a38f40d4f9bce53e176c6b22300698a5
SHA512 9fd6c90e528d986177e60f773d0900a5f1f19c6a33acb4886a46a95e81d904bc87cfa508c9736412d78cbae0bc96cae1d5e044ee939bdb69821661d7c25b5058
SSDEEP 3072:o/CYiE3GssE6CHWjbaSU9UFIpPfjHxmtMxsTjOCFH1tyU+x3frkBVake:onsBC2naz9U+pPfjHxmtMxsTvVU3frk
TLSH
T1F584E621B326E70AC2B645312F47D1CDEA70BA41FD0ACA1771CE173FC5BA6848BB5652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 569KB
SHA256 9e08da61eb1ae8fe8565301455f9abb1ffd5178cec63e2bd89313aa399d4e2bb
MD5 edb0c3ea8545f593c61454fa9a3eaee6
SHA1 9247a8c5704480b11bdf11e4fd69d8bb8c260bd6
SHA512 53eb9036fe6ab1514acc3688d2ea2c82291095a33fb2d7008cd15a3c861e7826477e361b92874c4520aca91acaa444740ca0a57c0ef29d01f7f3337e1ba5535f
SSDEEP 6144:jo71PZ4CXwQhZp4f+Ljh3IuaIgWn+Cq3wmgCm7k:jo71PZ4Cf0AIuaIgWn+Cq3womA
TLSH
T113C4D741A4E7E74FCDBDA4370776868CBBA44C06B7852B1573408A2C5837A7EF9E21D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.txt

Path C:\Users\Admin\AppData\Local\Temp\log.txt
Size 6KB
SHA256 58a83c57221b26387c0e293e3bcdfa2773f53574c41152433bfbc7589da7b1e4
MD5 196984b6f4faf7bec7007905184b6121
SHA1 add163fca2f062322009095c69f4455070e492f5
SHA512 8ffdc4915fe50a4fb469ebc64baf81f5d720c7d493ca14feef53ed047655111f6699befaea3ef906e8c9fa8e9e45937af88ba5304227012988ab59c7f35b08c0
SSDEEP 96:oJAHTyjCAAAA2222222222222kkkkkkkkk3333OOObbbbbbbbbbbbbb11P:jCF
TLSH
T195D1476F0E9F7FBA0F962579A35D1061150030E18F8B6D183A9E740C7694E78E2A3DCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6abd52b5a786dacbf99dbcf5de28594aa2f4a213ac1a5c55885e5c237458222f
MD5 27784fd57cc0816e988a820a8d0405ab
SHA1 527eb78065112a90ae058050eba7d07ff36b1182
SHA512 2d8057aa2ef6af37ffd44d7957ea370f4096a3cac993c8289162de5287344b50042de0fd69987fc56d6374360b3508ae3be4dafa515bd0a28c4f1bcca38f5441
SSDEEP 12288:l07o7brepajig/Duc44RBFB/LALMYn6U0a1lgR1bz4bLzZvReP6HqsBsd:uabrtjrKKFJELMY6U0aGCXTeSKsyd
TLSH
T1504523704B7D290AE0F9623196674A94F80C3E185FD8C4FBF815722D243AFD99C78A9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6e6d609bae1ae29413815a945bda3184e117d7bc848bf0f39cd9af6e0c427f80
MD5 c837ba93c4648a0b3a8f183fd0a400cb
SHA1 f320191273bcc8b80c68e0f8788bb1fc054b6a58
SHA512 e67aeeae3b74fdf8aae87d645da46673336254467a840e5f7fdf7750cf09236a7564a8f6c307e1cf5ce7d5264212faa9690e6f9b8e26fe25691a186b40649885
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYsbrtjrKKFJELMY6U0aGCXTeSKsyd:0gb4mBIBhGFT5OKF676sGCXiXsy
TLSH
T16B659E1E22EC02F5E0FAE2B8DDA64417D6B278161731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 40bdae833173ee926edbd1ef48a4214998dcab003f53350028c68ba7a9d9650d
MD5 66be04bbf7a0e25e86d1d7cf0591924d
SHA1 f784097898f75a026bac54145165a940bc9d41f1
SHA512 ac0583e722e33480f8e25c774eff2b1e3b2bb039a8e0696ee292006d0bbe3751e818cd8200a7a7ed31ae9819988e9b2d74185f3d3b534b12569fa341ce783409
SSDEEP 24576:uG88u8FpJqH1bzria7/mDbrtjrKKFJELMY6U0aGCXTeSKsyd:l7ZFPqVea7/05OKF676sGCXiXsy
TLSH
T12B85F16577E501F0D07BD1388A8246A3F6B1B8250364EFDF06A88B551F23BE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a85da0c3d8ba0379783c0e4e5d1a0972179568f385eabb0a693e19ebc1a3d89e
MD5 3570bd963c9b8dcdb14dcc8a2903492a
SHA1 6973a1fdfe241ead4c5a9e7391758a03763770b2
SHA512 d4d99f5b0c484e56c67331b0f40819e8b6f3c47af467f730b8688ab103f557f57f486f1d671d74cf8f0e5f38c0ffa79d5f1c6ae8459178cbddc34454df468dc8
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjf5OKF676sGCXiXsy:eG05lO43biOK07JGCXicy
TLSH
T1AAD5CF6A62EC11F9D0BBD17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5cc5800c66ae1cb756f49ee2002917d1e3783aeb880b87e6df5881630c85c940
MD5 a4d723d7d60863d515682eca4f61e67f
SHA1 49e94fc93023d0495d3b2b7cca805043ca003113
SHA512 ecb97575c048e4301ba86146c900b882b949c277da7f025a54a160fef3268a25ce3dbb2c68510e3570fcd505da79d8cfc688830996b845192bc843eb962ce852
SSDEEP 24576:Vfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnBbrtjrKKFJELMY6U0aGCXTeSKsyd:1a5POZ3+Jt2pasx2+mH5OKF676sGCXiD
TLSH
T10065BF5EA6FC01D5D1B9D17DC5834A1AF5B1342553329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 951a8ae3c91b7a9abab37b2c83ba4ff75fe7904cb912f5e0d3cf9067731f1016
MD5 445f9c551f403c45d8224a1d61776bcc
SHA1 2ffd777dd60dbe824efc3dfcf4d9a40179056f9d
SHA512 bf4435e4bf0583a55c5ffec384a573fe8526ad01ffbc6b083cde0d495f3062cd53582ef99bc6c1d81bcbc15161a7acd8e85c68bdefbc144ce1b790249a377e85
SSDEEP 24576:wNcwHdjbyQ4nLC18lb/EOjowL7Fk7brtjrKKFJELMY6U0aGCXTeSKsyd:wNc/zEOVHFU5OKF676sGCXiXsy
TLSH
T194857B2623E901E4E1BBE1BE89779546FA71786517348ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ca390767b6ebed3d3a2302b80d69843034a03fa9b185d9e099e7fb6e952727a2
MD5 c470f428fedec77a82a1c8803081a612
SHA1 2ff17284965c06331c10e0a7b94c477318067ac7
SHA512 206ddaf29ca4e3ce1872636ec9efa9f5edcd08cbb4f7cdc547a851ebd465059be33b0cac366732bd78ffdd27f61f8acf52d32f7d5cfc7b606eaa9c2dbf060815
SSDEEP 24576:+8kNvNnaFeYhJNtmZBm9brtjrKKFJELMY6U0aGCXTeSKsyd:+8MwBtOm15OKF676sGCXiXsy
TLSH
T15E55AF6EBAB806E4D1FEC675CD238512FA727861073293CB5290C13E0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 f0b7859e1a5ad6c6d6e3389fb781eb964ddac52f103b90b60674117ea2dac03d
MD5 0459831dd8da1d362adcaed6f2e1d9e8
SHA1 9a6987a55844c0286171dea449652249613f9058
SHA512 25d1dbbd83d345680f154e9edff4df30644238b3adc8263a8e534623d6e6bde57ece2d4c105519ce2753dcef5345550afef9f015201ebbc262e60410d27f2969
SSDEEP 24576:zPUr+NQHbrtjrKKFJELMY6U0aGCXTeSKsyd:zJQv5OKF676sGCXiXsy
TLSH
T13B65E12F26AD18E5E67AA13D85824709F77178621751D2DF02E0813E1F67EE8BC3DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 52dd99f6b589b4fd77521291d0e79894e01634f60085319711f98716d6f74d6e
MD5 c4af0b3f8fffd7995c46cad21a1808a8
SHA1 b7abee57ee73b4c88cfb1551934daec8853b390e
SHA512 98861dc95b13bc149883abdcdeebdba6cd32cb86072c0a8af243a585a85d760df868094fa9c2ca9d98486f3a07f83f225f695700c3b11d7f0db6e34a06bd3e32
SSDEEP 24576:ND3FHshBIYQgAmbrtjrKKFJELMY6U0aGCXTeSKsyd:NDVHeBIAAG5OKF676sGCXiXsy
TLSH
T18E75E13DEAAC04E4E47BD17CC6638A06E67138A9036255DB02D481BA1F6BEE47D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/600-423-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/600-425-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/600-132-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/600-126-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/600-409-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/600-170-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/864-183-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/864-190-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/864-184-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/864-410-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1836-404-0x0000000000770000-0x0000000000942000-memory.dmp

Download

memory/1836-411-0x0000000000770000-0x0000000000942000-memory.dmp

Download

memory/1836-442-0x0000000000770000-0x0000000000942000-memory.dmp

Download

memory/1836-155-0x0000000000F00000-0x0000000000F60000-memory.dmp

Download

memory/1836-414-0x0000000000770000-0x0000000000942000-memory.dmp

Download

memory/1836-149-0x0000000000F00000-0x0000000000F60000-memory.dmp

Download

memory/1836-172-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2072-100-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2072-95-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2072-89-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2072-101-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2072-88-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2096-160-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2096-167-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2096-177-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2096-175-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2096-173-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2388-137-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2388-171-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2388-143-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2388-406-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2388-408-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2396-233-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2396-71-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2396-65-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2396-64-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2992-169-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3148-182-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3148-350-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/3148-0-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3148-1-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/3148-7-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/3148-353-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5100-77-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5100-76-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5100-83-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5100-335-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5100-84-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5176-174-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5176-120-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5176-114-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/6072-103-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/6072-405-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6072-166-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6072-109-0x00000000008D0000-0x0000000000930000-memory.dmp

Download