f06210e9067fade582d968e83b44e5cbc0db5bdccc71d14a4b63cc6f9aa9f0a1

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.0MB
Sample260814-ed42aafa58
SHA256 f06210e9067fade582d968e83b44e5cbc0db5bdccc71d14a4b63cc6f9aa9f0a1
MD5 8e922db869510b13507b468b25db7280
SHA1 8f47ca04c18d4a3889d3938709c73163990c737a
SHA512 de493600073f5f1338b90f8acba863f836042a0db457993d373961ecff17eec0f2e2fed99a5dc48a122487d632d6c69e26e186760122cb9f240a3443834eb474
SSDEEP 49152:Hgh8jK3xEPK3Hkcm4L8A5iltfJJnB58MlSKl2HJpnsxJIUBt/jbwMu:HMYTKXkcmjfJiI/r/u
TLSH
T154E58E6D7AED00C6C175E1B8CC022791E2B2B825473145CB76A46E2D6F3FEE49E7D620
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5052	elevation_service.exe
756	elevation_service.exe
2360	maintenanceservice.exe
3220	OSE.EXE
1188	PerceptionSimulationService.exe
3080	perfhost.exe
1968	ReFsDedupSvc.exe
824	SensorDataService.exe
5924	ssh-agent.exe
1536	AgentService.exe
4172	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b8e21b0724febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1971f18a02bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000086a3a716a02bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c096e5aa02bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd79be16a02bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe
5052	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	1536	AgentService.exe
Token: 33	4172	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeBackupPrivilege	1968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1968	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1968	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1968	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1968	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1968	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1968	ReFsDedupSvc.exe
Token: SeDebugPrivilege	6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	6024	2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5052	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 2400	4172	SearchIndexer.exe	100
PID 4172 wrote to memory of 4336	4172	SearchIndexer.exe	101
PID 4172 wrote to memory of 5364	4172	SearchIndexer.exe	102
PID 4172 wrote to memory of 2156	4172	SearchIndexer.exe	103
PID 4172 wrote to memory of 4320	4172	SearchIndexer.exe	105
PID 4172 wrote to memory of 3020	4172	SearchIndexer.exe	106
PID 4172 wrote to memory of 5216	4172	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_8e922db869510b13507b468b25db7280_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6024

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:756

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2360

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3220

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1188

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3080

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:824

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5924

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2400
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4336
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3004 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2156
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3004 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2cf9a27dd9158f670d79998bb45e9b87d426212da8dc93bcd12d40ce98f13fa9
MD5 fb45850228917d4e5acd7efa4513e5b3
SHA1 cf4a00e33c29457a46e7f1f4762e2e4476086200
SHA512 d7fa311002331b3c7dd81cf2b2d0b1d047027fe6c5e2b73a0995ca046a4a5334c306f5930263a6a4e045e5ab94a31b12dbe339255aab28a8af81fbc74e39e3ab
SSDEEP 49152:Sb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnDsxJIUBt/jbwMu:03q60jBH/r/u
TLSH
T114D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 3047703dcd2b56253a0ed7c94e3863f6a7879f20da5ee5380527da9a79448425
MD5 505c83bacbd51e37517cf9d585ddea50
SHA1 fb7b717383d8e5d178afef76a95c841abf323fae
SHA512 dd9099add0533bec7adb70ac43cb829060e24ae98e07a18b11145578474cccab27ce74968cc43eee099622a139050c3c698346e224e166c99b2604594a4be668
SSDEEP 24576:sXYfDtczAssxN73IUB3d/Vt+4vwMYl4k6:LtcRsxJIUBt/jbwMu
TLSH
T13175012963E404F9FD67923CC8A2C511EA33B8544760E7CB03E499265F736D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 31c32613512c306237178b0b216b928ce34fca8839986b18b75d609cd632cd2d
MD5 bb89f7009a26186813e536df63b8bae5
SHA1 e4f9e1d203a92cc59e2aa22cf33506430285c18f
SHA512 9fe537f5fba83f0a5d49e00230ee6643c4c87e6fc026e7df3e736b47212fd0c052bc00179c60c46e5b4d04100f27faf483e832614dd38d8a642dd6adf0b5881a
SSDEEP 24576:m0Le5ji0hmxNrMrsxN73IUB3d/Vt+4vwMYl4k6:mPji0A7usxJIUBt/jbwMu
TLSH
T1E795AF26F6748371D073C0B9C5D2A69AED7130851B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6dc66feff426c54038cd9c21566c5c0700d7365e2da7ed65627842a4c8fd4e8d
MD5 3f891967bbccded21c5700e68738efe4
SHA1 eea16c89a6d01075eb545db29f85fc65d40e4c4d
SHA512 a9507545f6d23c305000419ddce9f3926a54865bbbe27c46aa943c74e13d30eca7ec3de93efcfc594d6984d0da9b351617035a70394b1694ba4f92def20eea5a
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWr6q8wyuBsxN73IUB3d/Vt+4vwMYl4k6:N/ezSC6vUzPviHjyysxJIUBt/jbwMu
TLSH
T186755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ece2a25161164875da824240c7e1aca1b0432791525ab3e4bd2f22025db528df
MD5 d38233c6c90ee704399dbb42cb432ed4
SHA1 dde4ebf3c113a23a5507226ea7be0676e8dc2d76
SHA512 022225c2d26c29f587a2c1b85871fc1dc0ba6c3320426a6d004f7f874342e15196a9cfecfe6cc5e164797ca2b3810268b058a101efde2e1ba1fb5d1a683ac88d
SSDEEP 24576:9VbqPb88hv/l+bIsxN73IUB3d/Vt+4vwMYl4k6:9VO88hXl+ksxJIUBt/jbwMu
TLSH
T19D559E66F5748331D073C0BAC5D3AA9AEE3234415B318ACB0246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 60f398b081150d1da7c4ff87753879a659c5b8437a0ec5cbaeb51453941f6297
MD5 16975d73bb022657f8d8ad25c86b6d9e
SHA1 f93d4a9e4f627f76a9c28dc95d346b0ab74b7ee7
SHA512 03652e4be653ce2a5b1a2ece3ac735bb72a39f8ef02217b21eb027770a37ff2b477441c70e3fd12429b4831967b708210b2e9e022d4e40e4ffa730ffc43d8191
SSDEEP 12288:1jnsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:1jnsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T15E552336066810C3F7D33935F1EBA531D51AED984EA007C68AD4761A98FCCB8F9196E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 2092ad25044d5cc88149abc7c202ee53ec0f056c7169b7be02d899fd1b8c5a53
MD5 d76e3dc690103440a65cfeecacf93fab
SHA1 01cfa84a998da9d9ebed1d622b74ce76fdae3f09
SHA512 4fcf8710c7fb54b1b04dba00e072ee4a82cbac5c07282016f3b8ee083515cb2a53f108b93b5a7520213a8f1f50ae70683aaa341b9d8ce933cb690582104e28e9
SSDEEP 12288:veBNUbTVO86UQsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:vJIUQsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T1EB75CF3BAE28FCD2C27A9D796A91C600D77278704F6193CBD164830EDE275E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 706cc81a080f8843afc1ca2490b4137950afc48ab853e8b8a67213f39e12bbc0
MD5 7591892ae9f0bd710bdb2be901c69600
SHA1 9f2e0866a8ef99c2423e061fb63dbb1e087069f1
SHA512 2e9ed22ecca2e966b7a91e82ac8ada312bb711483dde085ad06a0e0d949213bdec7e6a49288a1ee1cd8a5611e268ee90db01d9474a02f05e414fa1aa4e68e4e6
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THC:FQvGAdlCEL8c/RRNw5CW/r/u
TLSH
T168266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 44efe1beab363c629960b56ccfd6e159bd5644438cbd94e8673dcfc65ab1e84d
MD5 3041c2a8e4eaf1b6222f9af5cedbfe63
SHA1 70728a2636a128b1035c22180279aa4e5eae638e
SHA512 bb24825ebab9a4cd7f37d906d6fe9b268f2a222a53e22f60e57def75a4e37d93b6e8861fd03b44ee375d25adedb7c1df41de37088c9fca553cce0f625cff552f
SSDEEP 12288:vAwSfxL/2Dc3DDLLmt0LDQewsAjesxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmR:4SewsAjesxN73IUB3d/Vt+4vwMYl4k6
TLSH
T13275E031FA74D032D3BB0DB22B36C716542DB9204F611AC3E3E89E9E59741D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fa2ce6f26c10bcdb2c4673a0604de71b4d418d4ccb095f97f8cc5aaa91d5588a
MD5 2368d9dcdf130107a845dc67a5fd7ed6
SHA1 a7f3b80d4ad0796e490ce4a08a127266dbc87561
SHA512 5254b48e14e5e56c4838e76a18a976fa72d9f271f0d578b46fc5fb57fd063f356201ddd79146748526369b135cc4426a84077a0ef1c76a40a0994e3802a0e6ce
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH9:fUEtQevvqc2W1cpV2RI32
TLSH
T153474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 00220b3b97c54d934a0cfc3ff2fc3b72fa1714aa1b1f6beb11ae5fd0a9c2a4cb
MD5 c0c4569d7011424376ac8b8c73547122
SHA1 c142b40a91340022421b6150ff75a4e2a87dfc0f
SHA512 ce78c69ea7a97636dfceb25e13038d808fcf7bc10b7478bb81bbe9ab903d1309161f89a67df0d140049f6baa1a2401f492811fc423fdf9600441445d8d5b9a4f
SSDEEP 49152:jCbRquA/m2yL5zQfFiV+XenmE3/z+sxJIUBt/jbwMu:coqtVjnm6/r/u
TLSH
T1B3D58D1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 faf26b40a4b2d90477fb9432bb1d18a76045e7134cebca12ccc2c55568ea2246
MD5 78402778edaeb0082d0cf8e6408abf86
SHA1 d443a8d9cccc5d72b90242e417fe6bcc288919ec
SHA512 63788a9b7d0c6288648f4cf70c71014d53696f1485f4c95f8e95f411f13d8fd0d780001c26da11bb90a0653910924d0c6b131bf4e024691601b59d5ce61e1594
SSDEEP 24576:BAhGL2IFoiwtA5l7S53FsxN73IUB3d/Vt+4vwMYl4k6:BAM1Foiq5VsxJIUBt/jbwMu
TLSH
T1A7359D81E7F951D4F5B3AA78A9B69171EA76BCA95E30C20F2150D11F0E33E50AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 3a89f6ce510157bae5634ba44e17ec4b750857296db2121f63140aab3c7edd05
MD5 d710893bced987436524f010eaa0d44e
SHA1 eaa1859fc9524b5cbf49afa315fd51f1dbd5d032
SHA512 905f093ae8931e9ad1154dbc7373c9959b3559a4a1ec521e766ede876270fe1c9f6d822180eca6edcb11d87e2a3fc9f026a3ddab4c8b4a94b06bf81911c54730
SSDEEP 12288:xmw5HEjsChNSBFgl0WDm+ChsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF280:swuXOWSsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T1EE75F15626A80CF9F9A79639C597C132F7B2BC052A20C71F07A0C61B5F77261BD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 6874e69f125fcea65021e77f6312df6316b9089581a6c974c82f07004b6e0d9b
MD5 2a0c4eaf14cafd2380f9a3546e574e78
SHA1 c708c1b525559c9ed627ec1c43f792700e5c03db
SHA512 99a3059b6704d36ba2a4fcb91f343bae79326e0c8c0b21b94236b441f29cbad897fd4e5f69d4f4152813543dc8a5f337e3feeaf200d5ead81c8ae79c172a20cc
SSDEEP 12288:6/Z1IyOsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:eZuzsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T1CF65126A23E820F6F2A3613CE9F29611D772B8551B7003CF0660522A5FB7DD56D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 df2a011214cbe7f00d507356c34939a0939dabe28228f2eabfec4462a32b8d41
MD5 48d6ba45e8b1e5471e5fa4ce5dd2fdde
SHA1 0cee0e867e178954193ee339adf65c0a4d884227
SHA512 529317408896ff6cc2b1b88469ee249af91ecaf678ce8d30f0b77c1c07533472e6480a4b1d5cbe4f520b83a4b2df3de3c8a0cb122763a4d13f4277f0e4cedd0c
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U2:YQRQyi36YOcPhLvw2gAf+PN3j/r/u
TLSH
T153666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 61e954362931d86825d593feab2d2e64866bdfb4bccbc959e9a5d31c4b45feaa
MD5 5b49a97c234c41efff3eae3060168e31
SHA1 ce714a0f06d1a0c6872968a0e4eee664bc6d155a
SHA512 10c8acfa804bb12171898dda5baa9ba566bdaa51741d6872f52ae176fb29639673bdceac6188cfdab30e4886a08a181571e126edb5874b7a69d5842a29d12764
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U2:FQRQyi36YOcPhLvw2gAf+PN3j/r/u
TLSH
T195666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6afc575648154efd33ee85d2302203a5083823a8138e4d05ed0ab13532d8ec76
MD5 76ab36e300b5f4d58c3f96558369aaf7
SHA1 534a4a48a2a4814ac380ffec3d27876dfacf8ca2
SHA512 7bc91eadb29df95e88d8552a9871bac22ba6761bbed4b36cdc206ccde95f862f493c9a736f837daadc3b6061754c936c367b5351d11b37c7fd9bef277da5c1c8
SSDEEP 49152:L68Qg55nhceWu7PNU3/usxJIUBt/jbwMu:VthLRc/l/r/u
TLSH
T15DB55933B2F60099D44DE1769F4A873196D27C758FE0E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ebd6f1de696379eaf8fa229945229078c9b013f4643d35be95b21d8b2bea7829
MD5 130e9b53284581f5a9d0a89c4eccc76a
SHA1 0a4b7187804cba446a357b907434dfd21ce83076
SHA512 44b7d214431fe3c2cb7d23ffda520a13b6983f87d9008730e5171ccd10d945179ca54c3c0d50cb3d83397e42930e0b5afe8d302ca50d05853cd605970485e696
SSDEEP 49152:S3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99M:zy5112gYy5azzVva69nLKnhZs/r/u
TLSH
T15C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 805dc52dfc3dd09da4ab68733f5da07e776574e0a191e3735fd8c7903429dc21
MD5 5e55f1b39a564dd862a6a1f420057772
SHA1 396864a46977605fb487573e2b4941bbfd010496
SHA512 a8b58595af52e0d2d4001d149cfaaa5192a750704a3bd25ba78492b456897d2e745e03d667d506e6a860e6e9a958df45b8393a8ef3b2d7832a579fbca9e57853
SSDEEP 49152:wB+taZ3usBWOBr4tEG20bqx0z+n217aau1gl8sxJIUBt/jbwMu:qu6JmUxd2d7/r/u
TLSH
T17CD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 90cf2a2e5217147877d0276d039b131ea755355184c0f76307a5255cd0542536
MD5 d5731f32ad7f6f4936d7fa2adfbb4cf8
SHA1 c73278c421dd4b9157a1fff2c2d6993fc9345863
SHA512 2d232b2c3f39c6d27a07b89145b73c8b2219b89af1f37eb3f240129571e8526f099bdab9d8078b1923adb9505e12a7e11c677745a899cd1d734e73130821dead
SSDEEP 49152:P1hpsNoJpF1A6BU44CwH7R4xwsxJIUBt/jbwMu:PmifPkR6/r/u
TLSH
T183B5BE13F2D901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d736e857f2fbf417b5f483ced301cf320b9490224a7633a66b08385bdaf825ad
MD5 9d96db4cf9aa80eda12ce71a7a2aaecf
SHA1 0a5b52bf7657b6835d51f733c12673a256bfc7e4
SHA512 d6fad022edc71f296dd0c69b202d4e9df23bf1815835f9d0979b65d1617cf8db54529a21082a1563bfac1ed4a97816ff047e124bfdce0c722e38c3fb3a57c7ed
SSDEEP 49152:rSuZQIY0Be2KNRVtOnks6NMHqzsxJIUBt/jbwMu:55dKvi61I/r/u
TLSH
T1E3C5BF13F2E940E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fe8a020f7f961681566a737a1263a43fa7f98b3a196eaab7d6e8286c9d7e0cdf
MD5 4cdb9df9d77b527d7a3cc084785d779c
SHA1 9b9b89463aa2e94711a52ad7afc1129e3abcde0c
SHA512 f0881c0dfeafdf2059bfe0b51600e92df4e8397d143a93ee773fec54bc82c021286a387ee826d4e63198790ed094ea9a8aa187d8040b63ee53d0b12df27c158e
SSDEEP 49152:PhtSn8EApI0figXgiDn0AP5wssxJIUBt/jbwMu:eX2iyphe/r/u
TLSH
T16995BE13F2D900E8D05ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 11feae58afcc1c6f07a30f0197f73e7f79c7d3eb976930265be3b2a760673c98
MD5 87bfe2be3729d701a189b2c2caa01c60
SHA1 6892328c6ff4f2bb836a52c9a6a2b13e417cb4c2
SHA512 70029b7f41345a832e95ac0c81b1070c88c865e0bb81e027bdd131169a439c547d77c6ca85b57d7a4751f5a88d53e1cf3901bacbf261c368e1ff5d81e0df842e
SSDEEP 12288:oPsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:oPsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T19355233605A901C7F2837936F1E7A271D51AAE8C5FA003CB9B88711799FDCB8790D9E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 25b8777c2e9948c1eed2d7547d3e17ea3ef33b92e79c8162275a54d00f25cb6d
MD5 397cbca99ed2591068287bbefed98cf8
SHA1 3d51df30e96ac1afb1e908f3228e7304caebbf8a
SHA512 78a0cb29f6e8ce2c4e5ac8d8750ffa45d3566a23781157526f1e9e2e246a5cd6246bdd24d2a90699b019ee732cae55f395c14156407ada40690cd4ece2d0990a
SSDEEP 12288:XqsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:XqsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T11D55233605A901C3F2837936F1A7A271D51AAE9C5FA003CB9B88711799FDCB8790D9F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 bccf6ecd526f76e348f6bd7f1c4becd400ad39d977c2b22bf51473e7959ca995
MD5 4c8d69267f72c4ca6c68e0755f8e8354
SHA1 22b1a438c1f3324bdb369ba4b251e6280296b475
SHA512 470c10d7980a770455a0174bf1b5682d09d28dd1915fa389cb6379c009a07f49c4c92e92aadc9b86b1d77f35fc9679130b94871d1c84ce1d0f64df74f7b2d328
SSDEEP 12288:XYsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:XYsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T17055233605A901C7F2837936F1A7A271D51AAE8C5FA003CB9BC8711699FDCB8790D9F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d5432632c3a7e9c576c92f443f8de22f5f72e25daaaa9d2466e16c85c9d756b9
MD5 bd48394b666da6ec8e5920ef42e5b327
SHA1 7594d25f58361bcef587e6c170d02ac9a4fdc816
SHA512 e103ebce2ffcbbf00d19ef08af49244a88aeef04d64b82dd3db9bdfd6eec8900fbf6a19f80b948953b345bac4c6931e297273338eee05bf0ea0d5308ba95a3dd
SSDEEP 12288:vVlsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:XsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T10455232607AD00C2F593B635E5B79131D276FD989F7003DF8B80351A4DF9AA4B928FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 1966388db4bcddee5ec539a233aaa8f4917fcf6778e1f220be21b8f7c701c5b6
MD5 95faece1abed033dbe19570be8fbb69d
SHA1 93f349a4393f704bad61ff744f416ce0781fa8cf
SHA512 f13207b28b0079d81b1f9df5288a6e54ef1a0f628f1479fd9f6777c77da9056080af5c48e940807322ace5c94118df82d76d2dee14eb2c753c1c765ced339418
SSDEEP 12288:udsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:udsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T17F55233605A901C3F2837935F1A7A271D51AAE8C5FA003CB9BC8711699FDCB8790D9F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 8f23a3dde8d863f8ab6011d4d43dce14128317608816e42a5154472821aecf1e
MD5 4a164648ccd0f934e2fd524a3c010999
SHA1 719aa906856285bae0358407e8567e82114ed39d
SHA512 e0b82f119b0947541ab3b3f14f44c3b9b136deed6b90a04c1a6ec1359d47761dc56ea86931b87a1ed3aaf52a6348ffbbca996e035773c961ebb555f2fd6dc2c1
SSDEEP 12288:DGsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:DGsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T1EF55233605A901C3F2837936F1A7A271D51AAE9C5FA003CB9B88711799FDCB8790D9F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 b4cb72f000b7d4a81dec8cae94584614545ae5e086d2538e7e83c065107b979e
MD5 31a7b184cc9a8d0ae033991418cf2cef
SHA1 2dcbe4489c76160fbc77e632bbcb829bc2536021
SHA512 5e7e5f019abe46d5f941f9c21e5976bef9816019dcdf8e5cd8efe46bd472303af28a7cacb7df1daeac8ee894c2564e4685363963b203c4eecdbebe319e2de4ea
SSDEEP 12288:yisxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:yisxN73IUB3d/Vt+4vwMYl4k6
TLSH
T14155233605A901C3F2837935F1A7A671C51AAE9C9FA003CB9B88711799FDCB8790D9F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 897b27a8cc040c5bbee94d4e3919eac229dbde38228d2d76fdc13081abd3200e
MD5 97e2328db4a8a2e4fbf3f6f764252094
SHA1 ef1183adef1089439949a0a617a876812dac3c3f
SHA512 d9f6569d9259f811b458950cc4e4125a1c2303d6bf00e8bbbb9c9a157ffd044994fb4a4479f69446b734adb29a3bd7c25527d641915ce1fd77e34755887514ab
SSDEEP 24576:bZMMzFVSOKsxN73IUB3d/Vt+4vwMYl4k6:bZMMzf2sxJIUBt/jbwMu
TLSH
T1E2750265739008F5EC63913EC9668912D6B2BC590B70C75F03E436275F777A02C2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 90c10be094e3950fe29543ac835cb41dc36316f60ba7c2222c309aaef1c20617
MD5 2e43363f3a79a29d92f4b157c99ed3f4
SHA1 c2a37a997d69e5b5c772a9b8848d58701a58fcb4
SHA512 59992b9ef05209b282a5d15c7f4fc4adf19c9dd46eb74b2f9590cb6bce8dcc4ecfea55356fe096c906682fec722b6f8a11449a9145ebc5bfa51c1f56ab4a6654
SSDEEP 12288:pjsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:pjsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T18755233605AD01C7F2833935F1A7A671C51AAE9C6FA003CB8B88751699FDCB8790D9F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 0e505a01ccf4944c0e5f9d28c909c5a8177fce13cbfaa2b35b765fb955ebc9f5
MD5 2d0ce30db6503489537e085facba7e35
SHA1 79e2da365d17d0cc1d9ba102ff63a6c0e52fdad3
SHA512 898c595d74acbd915c509cf0f40909d557346aadba3942af9b23a8b3b1e867fa9b0f1ccd738788966bb17da40559ce5792f84ac32c8844ea2bc641bfe4a96e35
SSDEEP 12288:kXsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:kXsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T11D55233605A901C3F2837935F1A7A671C51AAE8C6FA003CB8B88751799FDCB8790D9F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 a6aa476db698bb49562913a801e59bb291a65928d5bfd1e1b872f4e613041892
MD5 265501597dce0ac7e54bf4d1eee3aefd
SHA1 c34257abe846ecaca24b737a640eff929641571d
SHA512 8dbfdcc34a6ae7fcca34dc2211c43e99695f509f8011443b98af21aecc9b741a9be6de24102244c7b9021bd6879aeb555d192c7cb7ff2f2f4fc6fc6e6da570c9
SSDEEP 12288:QyPz5L8OsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:hzyOsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T15F65121723A520F9E1639239D8A25A11F776B8350B204BDF47A417371EB76E0AD3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 8fa94c73a43ef5ca2d6f7fa61ef99a8bcf73e41ffe74bab09acc73dc73785eb1
MD5 92d5d311aa9ed5a38412b29bcf19a69b
SHA1 6642a0fd30183901aec3fa9ced4f5b98adbef182
SHA512 7720f1606755fd7db0930d75d4dd96f7ecc97277204fcda5fdec3c8ede5fff63a245588bbe9039a6b66cbf2083df5821f7b91c8e710c3bb138069bac206e5114
SSDEEP 12288:5jsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:5jsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T1C755233605A901C7F2833935F1A7A671C51AAE9C5FA003CB8B887516D9FDCB8790D9F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 7487f7ab7865c8059c6bd14f6dd6e62c3912fd2a8a4f17e4bb121f3c5276ab7e
MD5 64e5e33c9447cc82b619106a440444a6
SHA1 b0361b8737856058f16edb6da404ec1a6b664f05
SHA512 bce5be0d64c05dc42db2ab9c66701d2f9a27968540c25df9f9d4e5c886e1558123fc5d48dd395688cd13e042032ddc9c32af74c85ff8ea3f3dcb7475cbb732bb
SSDEEP 12288:wjsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:wjsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T10655233605A901C3F2833936F1A7A671C51AAE9C5FA003CB8B8871169DFDCB8790D9F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 7f17449cb348ccb04756597057bb558c840322eff2f0fed55486d4fdbe39f8f6
MD5 cbfe58fe8f77874d0ed99b9c4fb3423b
SHA1 cbc9c5003504bfa621d8f8cc5b5b3419a7db2162
SHA512 cbf3d6f3fe3a5b59397ecc4d21e6183237903dfb26bff5be5e00f5141b8d7d1a27c9315384e280494517ee16455467b5521003718aa4c66f07124611a355d1c4
SSDEEP 12288:ryPz5L8OsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:GzyOsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T14465121723A520F9E1639239D8A25A11F776B8350B204BDF47A417371EB76E0AD3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 dfb48bf3cdd2b3316e59c2078fb353606614aabebcb62d67fe26727c53d04949
MD5 98f19599de4d4427329a61c32c6ffd53
SHA1 88b653642b67c5ceb90566d2ae5fbf3bfa86a9ec
SHA512 10c2e2dc853c2f308f254d341de2f508e7a591273b608bcd2f39466aa05624ae1399ec5ea3431934412ca441284d861b811fd57ece7438ea9143619472bbf364
SSDEEP 24576:2T9aLl3z0zDosxN73IUB3d/Vt+4vwMYl4k6:2TQLljBsxJIUBt/jbwMu
TLSH
T1947502A5739018F9EC63913EC9668912D2B2BC590B70C75F03E436275F777A02C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 8d930ac4145cc881ad60ddd2820863c5d059e23c77dbf8e3511d709b4b57c467
MD5 618580932f893375d877471976308043
SHA1 dd153a4f3dab221833db77121a344ae13e3cce27
SHA512 401a1a9793dd538f8a71684108c0e09b36dc7b8e26c96ebc7c8f5837abc812adb7fc04f1e476072a0a6c3f92416e61cfc558a733a543b685205e850df35ce072
SSDEEP 24576:f3td9CHKy7GZ0sxN73IUB3d/Vt+4vwMYl4k6:vtd9CHKya2sxJIUBt/jbwMu
TLSH
T1F885CF90F3E810E9F1B79A35C9769511DA767C991B30CA8F03A4261A1F33AD19D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 28fae0137b4064349558272439988c392fecea9f3433790a7945b80a60d23c81
MD5 c36788a0cc74f7c273f2fbc335a1dffa
SHA1 6c401aa36dcb8135ebd3911397b6cba113955f89
SHA512 1be03bc99bd6cd64b0123adad4e80fe0c0a93496aa676b5385abff5d960a69df5fd4085079c04dbd79ab1e6728a92f4c50b9427a791a33bf2d9bbcd4410845b4
SSDEEP 12288:I4sxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:I4sxN73IUB3d/Vt+4vwMYl4k6
TLSH
T11B55233605AD01C7F2837935F1A7A271D51AAE9C5FA003CB8B88711699FDCB8790D9F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 f052a788d33556548c13b8e9b250978d506f54f650564d3bb578143f721a756d
MD5 001a26a23b84231a7b1cd7818b66bfda
SHA1 77e0fa9e590774c845167598c99067f0771ccebb
SHA512 d6fe24c4dce9177771ddead0b26aaff2f3273f8a8a8bdb0787bacb8413907ced115002bb88aaad5612f9dd4f22fa0e1b637090fee89b1103ccd6b8a7f26d4190
SSDEEP 12288:ZusxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:ZusxN73IUB3d/Vt+4vwMYl4k6
TLSH
T1D655233605A901C3F2837536F1E7A631D51AAE8C9F6003CB9BC8751699FDCB879099F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 2d51ef484f1d60a4acb8252da5ec8691145961202295252cdfdeec7e9d1419c9
MD5 9f2bc7a7a677b1348cc4a2a850ffb5e2
SHA1 a279bd96bbf66405fe341733c557ef4d0d37b635
SHA512 db1f2c0fcb03f174408fc9b599dffca45c3658a68b7818d2721851f41a3140502bb79204321fb05669eb9308ec18b057b94cba12dbc4a36b8219868db3d0bb48
SSDEEP 12288:V5sxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:V5sxN73IUB3d/Vt+4vwMYl4k6
TLSH
T12355233605A901C3F2837936F1A7A671C51AAE8C5FA003CB9B8875169DFDCB8790D9F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 b605841c6d00abca82b2e393a1207b148c3683ecc251cdc66f1a8d55d56f9275
MD5 5ea4e87723053d4821027ac901d45bd1
SHA1 71ffad58f0c1919d3b74eb2d1aac53c2cc6977a1
SHA512 d4862822551e7cddaa7adb43dd4f129d91fb8b7167963ad3722ed021f4c800c9e8b7a189fbcd131b0261b71c5fb0a7812a92e8cd2d2406e3b557e54e3422cae7
SSDEEP 12288:DjsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:DjsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T1F955233605A901C7F2833936F1A7A671C51AAE8C5FA003CB9BC8711699FDCB8790D9F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 1b1c81da3751983bc594d1505dc5dffbcb4b90efdc905e97ff68ec338d5bedfd
MD5 cbce0da1effd6e4d63a57801577be122
SHA1 ef506b3bec6e11bdcf0a8d8199e610f985c9c6ad
SHA512 36f05048dad5faea6eda9e2264712b537800f23d61ae889a6db3c3f398588ead5d11a435797c550adc6f7142756a4d3e404a9c3f6d223acc2cc91262e9dbb6f1
SSDEEP 12288:P4sxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:P4sxN73IUB3d/Vt+4vwMYl4k6
TLSH
T1FA55233605A901C3F2837936F1A7A271D51AAE9C5FA003CB8BC8711699FDCB8790D9F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 31935caede8319adae55599cf4eb44186f51d3e146bad1dcac937d1756077c5e
MD5 c6f4951d26c2f4f8ee6afc9c415d48a9
SHA1 88932d1cf69563ce33955e19682bbc8442f320a2
SHA512 8b5e34ca2d79103af41ccc982204a73268d07731d131acbaa5a6222df545c5dbd8ab6c686d213129089226cc71da62dc752b94da266dee6fa2f754802bc07587
SSDEEP 12288:k7sxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:k7sxN73IUB3d/Vt+4vwMYl4k6
TLSH
T15155233605A901C7F2837936F1E7A631C51AAE9C5FA003CB8B88751699FDCB8790D9F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 738b1a398cf9b7c4b798ad763a11900a1e65d886bb17f84f6eeaa91029758b33
MD5 9a7ef61ef6d0d1fdb96f72dff88a941a
SHA1 58ff1c1333cf67d9d28b41421ab687c91f990b99
SHA512 e02912416bf332f4c759e6449102802a1ba8842598c5d804f228f880163186010c87ee12ddc31ed577e2c4a89ac4f337425645537428b19ef6c9c0889eb15f1e
SSDEEP 12288:wdsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:wdsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T17A55233605A901C3F2837935F1A7A271D51AAE9C6FA003CB8BC8711699FDCB8791D9F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 adfb367ff29f5a5cc62df49fc0d9072a56ea6bd5e299a68894e8ec6d3c4ab2a6
MD5 7c766af631128f3f9ea94f83378f32bb
SHA1 127440bf35844aff6fb5040616aebe8bf6dbc590
SHA512 c0eb9cef5c6b3304dcd57cafed0911f8eedd693ac5465b23918645da3f29f75a59d1ba9b39053cf550be29cb915bcec272f70b83a194a0102941b047e18f6ef4
SSDEEP 24576:nfwvok9RX6wkyAIHsxN73IUB3d/Vt+4vwMYl4k6:BMnYIHsxJIUBt/jbwMu
TLSH
T18385D029EBDC04E5E1B7923C99B7460AF6B178591B31C2CF029A536E0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 92171394b7a357ef1f001ba582f03acec57731f485eae968382b042a877960c4
MD5 7e1f5bce8251955381de643d5ef6b7b7
SHA1 387eacbb40be362b46f6bc3e53cea9e435f852e8
SHA512 68b524c115895b9ccb7d2f3ee07603005476245012f42b3631baa36a81a0d2bbc6518fe02caf580042232a3a071cff575cba01e871e9a3f38defe5f61611ca11
SSDEEP 49152:qYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0MsxJIUBt/jbw/:WySzPD/r/u
TLSH
T164066C56A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 53bb31e5bbf073fc9c9d3b21a06e2e657ce47ded5b408bca3d36c1777ca3067d
MD5 5dc576edd6e0b30c04d3f22adb59e544
SHA1 2316158ae49cee6455eee0c0094d0ccb1478c4bf
SHA512 3e50bc52c22bd0ad4a81038000bebba498f137006e84565f0b8dd631336bb9d73bd38b01be5607fad4134820593a07a909a2eca5f8c5571b85236092af025ef5
SSDEEP 24576:047Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY6sxN73IUB3d/Vt+4vwMYl4k6:047JUQj4irIhCnDHUPfF/8sxJIUBt/jK
TLSH
T11365AE1EA3EC01D5E1BA927885158A1AEA71782D1F31CACF1270837D6F63ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 d06dbfa889d11a0b0be1e6be3c72218a5393a20625decb872cd3cb34ae011dd7
MD5 ba6a14ee96da7cd95aacc7212667d4a3
SHA1 04343f1e990948c22bfe8676336291624bf1883e
SHA512 87fe30e7827a2cef0be6a5c802a9e6e4b1609fd8f769af03a872bdb9fe2483691e4a51100b72e62a840ff20fa767cff6475e414dee9075b21c16be62612510ee
SSDEEP 12288:EGsfzsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:czsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T1C965F11AC29802D9E06E6139D7969611F3337C6487E083CB57C0F53E1FBA990ADE9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 2c0799eacb29a4de3910dabce6e9d256387d1335238a67b38226f1c58492271f
MD5 c2455fbdcaf094433ac004a52635b753
SHA1 14f2a173aee2866d52f830597dc088fc6652f8cf
SHA512 d92e4ecf0b1ddd1a757d4b84edbce8a3e6a1b25e382bd43ed9d3c710dbbb5e6cee2d1a7476ada4d00c2f9c10fbd85043e4016e34673d7e25ec7bb2184b61af3c
SSDEEP 12288:Y3ljpvhU3fUqon1SzskmN92gEbFtLvdpkHGZa5OMbtMRg12uUPpv/B1L:Y39pJUPUqxPvSGZa5tbtMRg13UPpv/3
TLSH
T173553941722AC78FC6A950325E36D6CCAB707D01EE046F0773C9873F9476669BAF6281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.1MB
SHA256 87df029ee6a698616228962f915cf6fd18c3fda026b2c1d91b84636fc8b38f6e
MD5 cb13fc760ea06ad7f9217b836d706b18
SHA1 cb62d737cee0c4e1391eabad965c093126228d51
SHA512 84fcb192ae7bd0c691daa7afa2e992acd8f99af1f40cd2d1c6ca7e35d5e0deb6d0b590db29df16b9628eefee222df555fb052dad50dfa6944eb9ac2defca397f
SSDEEP 12288:xIfAvTwRZM2QlGbmG9mEUXwPLto+0TRq6RQhN92JIVsDfnAg4ESjcrFw:xILn0GbmRzATylTRnVGsFw
TLSH
T1F8451841A5B7E75FC8BA90370331968DBB74AC06B7492F047340893C986B97EF5E6392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 fc3db540d0cf0ddcfc654ff600dd6dc02966a080964bda2d356cc3c792512c9c
MD5 e174806e891e7b31445b0f4f68ddafa8
SHA1 a65cd74ceadb6414d35974d1940668b4c4d35fcc
SHA512 4646c4136db479f54f5ea60155ee8c07618246d6438551a254fe888469f547a4c9c42a4629091be866b9eab7c01739442464859515e7c688cdbbda2eb877de77
SSDEEP 12288:iM7LsxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:fLsxN73IUB3d/Vt+4vwMYl4k6
TLSH
T1B555233247AC01C3F5A33934B1ABD131951EFE9C4F5042C79A84721699FDDE4BD39AA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f2f89b87596c0ff5d09aaf516750db9ee916abb81b4b11b7478b8f26f23b89dd
MD5 9c4d9d6b958c737aefbd2102bda224b5
SHA1 8880c34fe36438e4a13953029b1aaa9d47788168
SHA512 171a36278bc4e8811db8173a34662ba7c282e3cceba60e27ebaf423beb528d586da55cfd33293c64f155c3d8d37c8f2fb17df231414d15acaf7be911e1b9440f
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYBsxN73IUB3d/Vt+4vwMYl4k6:Ngb4mBIBhGF6sxJIUBt/jbwMu
TLSH
T124659E1E22EC02F5E1F6E2B8DDA64417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 d7f54dcc032840c07cfc90ce5743c03b4993c4ebc0d3f1dbc5e95d323469efc5
MD5 167ecf53f1d2d964ee159b3fafb41423
SHA1 b1c1b529b92e92a70bb9780c1fd09a378dad4a3d
SHA512 16e085ed00fbffb2b4c6291f5a036c0cc711e162aabb4a076ee2ca7343b23a4744800f5b3c990b11215a1e5db224324b95c5a24ab044f56c2d14217f33fadade
SSDEEP 24576:kG88u8FpJqH1Wzria7/mKsxN73IUB3d/Vt+4vwMYl4k6:X7ZFPqVha7/ZsxJIUBt/jbwMu
TLSH
T14695F16567E101F1E477E138C9864663F6B2B8250360EBDF07A88B551F33AE45B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c0d607d34660d5369bbb803444661a0430f98b9fc5a4eab1cdc2f54a519a6a1d
MD5 ad89053f8c842c0de390dd4dce96d52d
SHA1 81a57aa0a9ef79b17d7a90b9bedd55da03ee28d9
SHA512 511f34af0af11dfb4639ab1721c5a528b7927de7d91dc73ce38e50ecbb8bc21c853d81d3eaf0186652f1549b83b92bedbc5a71e0609c8f40861f7f8ca265135c
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjGsxJIUBt/jbwMu:MG05lO43bU/r/u
TLSH
T17FD5CF6A62EC11F9D1BBD17CDAC6460BEBB23815033456CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 12efc85d90f93c150d0dd527953971f7abe1aebe054c203eb734f32dfeec392a
MD5 b38fa6ccbe76e4dc0bd23c76e40d0a72
SHA1 c15380be4c8c86e1e1647a9bbe18dd8fc0820e1f
SHA512 57cbf69841fd619f32d51e190f686f14e1f60a3be08ffcbdc28b5ae959aad6a6e81937daff52b7a16dd2bb99e56be24fbbc3ffb2f12cbdeaa4e4823f3c17083a
SSDEEP 24576:qfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnMsxN73IUB3d/Vt+4vwMYl4k6:ia5POZ39Jt2pasx2+musxJIUBt/jbwMu
TLSH
T13965BF5EA6FC01D5E1B9D17DC583861AE5B1342553319BCB022182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1dda0e42ccba741ba57c66b9fedc45b2fb47b43647840c3e913a7a86a8bb4145
MD5 d8228ead016314184508fcc93ab8670e
SHA1 33f45d615d75cf3b9b29487c3f2d13135d5391b7
SHA512 7af31e9a3e5e9b47d9e1193eeae49582f71e678d386df85e3f27637a425e6d6a84c083f1315e903b5abe11157b7fc3d785e6f010f1e94e013adfcd0a8c454d8b
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkysxN73IUB3d/Vt+4vwMYl4k6:HNc/zEOVHF5sxJIUBt/jbwMu
TLSH
T1B9857B2623E901E4F1BBE1BE89779546FA717865173086CF0291851B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c69eeb594f06063306c2e0a0f4dd10427dfc4b1c4be23a10311c9498b1438163
MD5 54ee9ac3257052086a7a1681fa1b2fc2
SHA1 52598bda7642f56161b25ce678189b13e79ed11d
SHA512 54ec9d399748faa6c65eaefedf95d6ed8ba51d2fe3f9331ad8f154dbd327049e9b9f0b6b5f7d332606d5705fac12830ea84592564b4ef3f5298af259f38e56e1
SSDEEP 24576:dtkNvNnaFeYhJNtmZBmAsxN73IUB3d/Vt+4vwMYl4k6:dtMwBtOmAsxJIUBt/jbwMu
TLSH
T15B55AF2EAAF806E4E1FAC6B5DD238512E6727461073293CB5390C13F4E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b41181d77fbbc6a28b60bc9a3a51a33b68f959beff970ba7045cc501599fd565
MD5 50e067562c3bbc606b5a76359e13dff6
SHA1 a9b80c1d5cb1985eea771a0082fbbf752d890988
SHA512 3d42846a3a616a1d849ea81277174643b3fadf1c3ff671b4989db16720d2256c19e00e5e9bdec624a3d251628c9be9ce727df86953131c4c4a04266f2015235c
SSDEEP 12288:sHvUrBFrEjwaQ2sxN73USCm7JB3Fl5vNNSWtKo9wR2vweY1pmpMF28oK0Nk6:sPUr+NQ2sxN73IUB3d/Vt+4vwMYl4k6
TLSH
T13875E12F22AC18E5F677A13D95828719E772B866171192CF02D0813E4E77DE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 c8135ca250d74c6bc7ee5803a3b7f9c7ae838390829f73d9b670202b5e21eaac
MD5 e1f8f7c27ddf4a23a69dd7ff4643a0d3
SHA1 3af36405546bfc6482aa5ae152efc2e80eecf0e2
SHA512 560a5c6c07b62a41248d174ae3cbd407b2ba5815ea10bec108c63f149d257accdc2b5fb415d565bbfa5ab794d0a44e253330175cd0680f7fefeca8a45c2558d5
SSDEEP 24576:dD3FHshBIYQgAvsxN73IUB3d/Vt+4vwMYl4k6:dDVHeBIAAvsxJIUBt/jbwMu
TLSH
T13485E13EE6AC00E4E57BD17CD6638A06E77138A8032156CB02D491BA5F6BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/756-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/756-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/756-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/824-314-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/824-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/824-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/824-108-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/824-102-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/824-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1188-73-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1188-67-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1188-65-0x0000000140000000-0x0000000140236000-memory.dmp

Download

memory/1188-295-0x0000000140000000-0x0000000140236000-memory.dmp

Download

memory/1536-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1536-127-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1536-135-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1536-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1536-133-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1968-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1968-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1968-328-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1968-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1968-89-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1968-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2360-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2360-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2360-39-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/2360-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2360-52-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/3080-83-0x0000000000810000-0x0000000000877000-memory.dmp

Download

memory/3080-78-0x0000000000810000-0x0000000000877000-memory.dmp

Download

memory/3080-310-0x0000000000400000-0x0000000000602000-memory.dmp

Download

memory/3080-77-0x0000000000400000-0x0000000000602000-memory.dmp

Download

memory/3220-280-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/3220-55-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3220-61-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3220-54-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/4172-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4172-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4172-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4172-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5052-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5052-21-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5052-14-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5052-22-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5052-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5924-113-0x0000000140000000-0x00000001402A9000-memory.dmp

Download

memory/5924-115-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5924-313-0x0000000140000000-0x00000001402A9000-memory.dmp

Download

memory/5924-121-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6024-0-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/6024-87-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/6024-1-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/6024-7-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/6024-9-0x00000000008E0000-0x0000000000940000-memory.dmp

Download