e8a5a88bd203aa44252cf48202424c97fc0434da49d383b08cf5ccc674777d94

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
Size 878KB
Sample260815-er6f9sen71
SHA256 e8a5a88bd203aa44252cf48202424c97fc0434da49d383b08cf5ccc674777d94
MD5 3aa8afe1b409e27ce1fbd358d75ffd35
SHA1 9f9778aa85a334b33474c4fe6bddbd711007a982
SHA512 2289cbe894b5802cda48039660782d6865d681cb654964ff13a818d04fa9997068e47f5cb7593acaa556b4a6ace7bc60c5b4beab6a499d352cf0921477061630
SSDEEP 24576:bgLbYcttrUy5Nq1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bgAcnUUyLNiXicJFFRGNzj3
TLSH
T1A215E05AB2A850F6E9BB913CC8468505F671B8154B61E7EF13A4076E3F337D0AE3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4576	elevation_service.exe
6072	elevation_service.exe
2368	maintenanceservice.exe
2852	OSE.EXE
3388	PerceptionSimulationService.exe
2124	perfhost.exe
4664	ReFsDedupSvc.exe
1688	SensorDataService.exe
5436	ssh-agent.exe
4988	AgentService.exe
3528	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1247d0b68f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b481b6306c2cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000053ebf1306c2cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000030250336c2cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8c656716c2cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
4576	elevation_service.exe
4576	elevation_service.exe
4576	elevation_service.exe
4576	elevation_service.exe
4576	elevation_service.exe
4576	elevation_service.exe
4576	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	4664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4664	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4664	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4664	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4664	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4664	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4988	AgentService.exe
Token: 33	3528	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3528	SearchIndexer.exe
Token: SeDebugPrivilege	2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2332	2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4576	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 3380	3528	SearchIndexer.exe	100
PID 3528 wrote to memory of 5040	3528	SearchIndexer.exe	101
PID 3528 wrote to memory of 1484	3528	SearchIndexer.exe	102
PID 3528 wrote to memory of 5564	3528	SearchIndexer.exe	103
PID 3528 wrote to memory of 4836	3528	SearchIndexer.exe	105
PID 3528 wrote to memory of 4856	3528	SearchIndexer.exe	106
PID 3528 wrote to memory of 432	3528	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_3aa8afe1b409e27ce1fbd358d75ffd35_cobalt-strike_icedid_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6072

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2368

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2852

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3388

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2124

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1688

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5436

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3380
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2860 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1484
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2888 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5564
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4836
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2860 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4856
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2888 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f508534ae01df2caa87df89af2812beee85d2c88e9126dba2edb0be9877c797c
MD5 f7f2c6f74fba9e4e24d4a3d15d7c464f
SHA1 7697d6974534addb81b199aaaf2dfe165e1c095a
SHA512 6cf1be7d98990a66b6fe518576653bf78e2a0eb3b417fce5f10080d152af20fb93675147ebe95599b9583f2dfb82def373758ccc27d428fa7fbe99773b888cab
SSDEEP 49152:Tb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn1LNiXicJFFRGNzj3:x3q6sjBO7wRGpj3
TLSH
T111D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 162d9ce2f8ecb10c8dac2922918ab46321832a638ec162e4588a6fc0dde02f03
MD5 e5c7257ca7dfadd0845dd824124aefe7
SHA1 d4e8dfb395d947a7c99aef692782ad321ce2c501
SHA512 8d9911f5ad16df366d72c1ada9a7a7aafd027a114a9ae0e315b5ca0dd13a2be7f4fe0b3ea9ec900f991a0761b7a7cf1e6c7c45f214248a571cf27e1944ec3d3b
SSDEEP 24576:nXYfDtczAa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ytcnLNiXicJFFRGNzj3
TLSH
T12B05012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 66a893118d6b279c51057efb77f5a0c9d8475715722b577e9ebfe315ddb7f10b
MD5 40320663cd5af81e0b2c0c4abbad7f39
SHA1 5f40f2b8161cd88714b489e044abc1f417483dc2
SHA512 cf801f42a5ea410d6ca6394c5c598363e3538a57f2fe31386ef28256cb4ddc54132117cd3b8a0c65fc9485937e2252206d7b287c07d3d891bf8dd439ac5713fc
SSDEEP 24576:X0Le5ji0hmxxrMd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XPji0Aj4LNiXicJFFRGNzj3
TLSH
T175359E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4210517509ad119ead1d65f13c18b3d67ec1c13fb396ea38cb7fa6c05bff02af
MD5 2db444b920e23c8f53d0bc03a89c17d2
SHA1 f5aefd5978e56341e97362ca4002a2fc3076e209
SHA512 1e85c8b34a15b7a8b2231d4803162bd44fc4c0086f67410df3ae503381552ff1298c8db73917a2db38c4de89ff1e40cbecf697e225891903e6356152d1a88979
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWn6q8wyuX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz://ezSC6vUzPveHjykLNiXicJFFRGNzj3
TLSH
T18E756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7f49fd813358523e0a0e1c2001a876878c9d8295779b5e026cb4caf1fc4e3680
MD5 4c5c02a3658d3bbf4f9842661e3f80ba
SHA1 7826b6339933c6aba21d141599ea38c22e4058d6
SHA512 bc8c1a7fb73f13daf50b3e8153ad8ece899c6a3f950dd9bdd9fc3d4369f343087461450f0172118ff9f0d7d3c5735188f7cac9011fc004733a85910f9ec1d958
SSDEEP 24576:uVbqPb88hv/l+Y+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uVO88hXl+PLNiXicJFFRGNzj3
TLSH
T169559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 cb99cf0d41e55e15efaa88d4c8aafce380041832ec456a586c114fad0b137a11
MD5 323687932c4423dea4861fd24ddfe122
SHA1 64bfbf09a51a332d29bc2585176fda3fe1eeb5e4
SHA512 5c9eade7c4bbb9a0fd49b0dd714badf27f3f8b9494dee5528b68a03b417c9d26e0a25e5d30c9614a6b9ede7b75d548928a639f409052ba079726d89ac5176c07
SSDEEP 12288:HLNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HLR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18EC423D3468854B1FBFD003A867A5828B5845E2C8A595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 5c0d5e50012e2ec70e38ea00016500f650a4d97c86de6997ed0a8524a963d184
MD5 018e6b484c704e468c539cfce72d552d
SHA1 7df41ef951818c680b2976698fc13fdaa714d1a0
SHA512 e656b1e0e990bafaddec6a70e934c987f9c37bab164b2b613da4a84bcc30b6d8a42a804692e69d329b1e179bba956fa1bd125b7dc6b0a31d75bb4c4546fd6d3c
SSDEEP 24576:RJIUG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RJIUGLNiXicJFFRGNzj3
TLSH
T1C505CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d8e8fa2ce075c41cd7a40c4a5c6e1291720a9221ae99459932f2c4acf28f289b
MD5 c152925058a6457be721977dcc11cfab
SHA1 9c5f6da32a5de3c711d7a6f8891375db929678e2
SHA512 136c4cd09ce87b2d1410ea18bb5844bb24d638a8928234fca358cce9f3da277ebdf25915a404738f7572f0e38d52a06926a437abad53895207349c5c0132d73c
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH4:UQvGAdlCEL8c/DRNw5CH7wRGpj3
TLSH
T19E266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 1ab431eb9411e99c9fa1870f18dacd7437ff1ef625a9c34d16d47b830cf5a1fb
MD5 6e22ec5850a41d19cb6fa8d6f1e229b7
SHA1 2fc5eb449e10597ae980e153720174639e08fdbb
SHA512 f1b8134847657bd5e9f31ee68b513d9ccf1d8682eb6c79d4a4f6622b277a7bb7ff00dbfb91fadcf9cae726cf5ad7097a1cba2e66e678830f6618fff205dec30c
SSDEEP 24576:q0ewsAjo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rljoLNiXicJFFRGNzj3
TLSH
T17315E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0c011a75261e24f83a10173828246c96e225942b51183bcad1ce5066416ac853
MD5 ef095c4b4ffc08f6444556ef01cc4bb3
SHA1 363c9768850eac73b1be2a787025704cd472ad26
SHA512 54e370ab3ba61fe1d768e2f207640de62fea24bc58eb56cda0ec8fb5a826d9e2d600473932403cf66488b69b77263255b634aaa0ab8070a3f33b500b3abee848
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH8F9:qUEtQevvqc2W1cpV2tI32A9
TLSH
T1CF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d7a385ecfd3ed20c210b93626a6aeff5846db42209d78f05885f2b0e46ece68c
MD5 01f0dd20a5ed58a8af144e9aab8d8629
SHA1 293144bd5ea38f1ec78907f3769c7bc4e136013c
SHA512 830c8b64c07284316c1872b0491f5b740fab195159a4c6ad6af5d1c3994fc3d8ec69844ee003c2cc35979efce22c6b686bf8bf4732846ba837d1431f612cee8f
SSDEEP 49152:SCbRquA/m2yL5zifFiV+XenmE3/zILNiXicJFFRGNzj3:3oqHVjnmj7wRGpj3
TLSH
T1FFD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5400e9b625beddb4a27397705c378801babcbb2da893c9d32c88bb85f09bb956
MD5 7c880cb74e9dc1f94a3fca2034650c12
SHA1 eab777ab1f62d0b3a78faee2b688c677d1bb31f6
SHA512 3e1860ee8a3b7b60e95170b17c468a2cd7bd00abb2df333bae0d8f6c7702e743cf63f4109e86e30b81e43d81349d3845384430e4309739d1e34c676b2569a032
SSDEEP 24576:5AhGL3IFoiwtA5l7S53D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5AMUFoiq5TLNiXicJFFRGNzj3
TLSH
T1AC359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 4853e365f54223b3630156aa3826ba4b00b62ce11490eabb379eb3579b815e69
MD5 5190468f54005edbb7e19edde6e5c38e
SHA1 383c6f288d5b1ebc37548e07beb0eacd2f6b499b
SHA512 81240f2d1cba8820f6aeac8c4915fe3b4d4b2ab22789089932fc8265c4a2d695d806a34a61972ff87d65a2d67dd29bed6072e09da65f2f345504155a9cad9b14
SSDEEP 24576:Owu4OWE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OwvOfLNiXicJFFRGNzj3
TLSH
T1B005F08632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 70518dd3e289ebd3a7d19c918d57891dec8f3299c5d3ceb58380d1adf307ea05
MD5 b5c4d26712cad58f001d9b0fd0b53015
SHA1 4f118707e6d0e9f04fcd35ab8ce28921d7e40836
SHA512 ef454a45cdc1991b7865eb3f2993498dec8e1526eafcbf1cc77df55a6497d66503cb4d935d46cb5798e263e140209c6e2a425776402576489f46783fa3e74112
SSDEEP 12288:ceZ1IyuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:FZul/TwSfVcYG3K/cJHlnFR+IGNe8j3w
TLSH
T1CBE4129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 295bdb260052cde21ef05e27297c364e85fbe140f262fc89d1329075a5d9c1bc
MD5 706baa2f6628fcfd8bddc65603478bbc
SHA1 3257c7feab09127eeb98a9562bf3b356b27ec291
SHA512 c48ec3f23a6bb3e0e25e9e69a4a37471a73d2645b9f13452f4ea3c9394144955ff053c43df9539100e3bf976347d1b5951a9da340d3bd3af06ba33d3f020b556
SSDEEP 98304:6QRQyi36YOcPbLvw2gAf+PN3C7wRGpj3:xQyiKa/X+PNWF9
TLSH
T1A8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f7c8945cc098d072e73f4d0f80c9d26d96cca3d9b528dc7b036fc6d5df94f890
MD5 5149fcb04743cda5d3a9e75d49d56b99
SHA1 7c2c0e53e915de941bcf0809c8e6d05aac5aa253
SHA512 e18770a97a216ff5d86741c3e388ee55b72f4d6b45de28ec5eff5e3baf0bcff0e260742bee396bf3d353b245437f1e24ff368c347c22401cb6a936c203d61e00
SSDEEP 98304:AQRQyi36YOcPbLvw2gAf+PN3C7wRGpj3:XQyiKa/X+PNWF9
TLSH
T191667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6c3e85989a5a9c139f3254257fbcd88a4da6992bd940f5e66825751c11a54e8a
MD5 f714b77431315f0c78d025d03f9d8777
SHA1 6f1370f081c0c2a8b5a0b46f5dae53870690ad9e
SHA512 1d4019bd3f0dc4f5a48fcc5d44d23ce88fbc673b685d154ffbbe24f32c9427c119f9f4926514b67828139ae5f4a6fe579e7b58a8dc7e4d4bdcd46be3d9b27a26
SSDEEP 49152:A68Qg55nhceWu7PNU3/4LNiXicJFFRGNzj3:6thLRc/47wRGpj3
TLSH
T199B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7d7fea0a4a52c2ce65edc923ff9b8b753ef05f5194803dcf1fac55bfc093ec98
MD5 b695c5889776508ce2a2503e4e7e372a
SHA1 183b5dffc7a8b8d68604f7bddbbe38b1f4d86fd7
SHA512 8aac57034ca3c51b8da0f94a06278134010c32961ddffd6be0471329c7a8141b2c94c7498d0d881f67b3ec3abc43b833a564596537cd0f5abf3e80897f29df42
SSDEEP 98304:zy5112gYy5azzVvt69nLKnhZR7wRGpj3:OLIHEWh/F9
TLSH
T184167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5a0616b4b7ff47a2e7e02b29ed1393e9d982eb6282aef7bb2f7a4a0f9ae23bb5
MD5 cedda62daea2c009bf443f69e4f2d38e
SHA1 dd9306bdbfc765639417d3084e95b397d10c122a
SHA512 9f769f101ea4c792d597c8818b18303eb5d25538df6e3e5bab919a38a033505ca34ee05fc83b3fc7123db8ca9b70da2c042e18ab96cb22563d5cc433819a39b8
SSDEEP 49152:fB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glqLNiXicJFFRGNzj3:hu6Jmdxd2dq7wRGpj3
TLSH
T157D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ba67b09ecd4e1284a6b4db66692f017fe907e8d386e53db4405b50387c7cdf5e
MD5 7fb2b0556e3176451338a313e8aea426
SHA1 6504f7e9d2ca126d779fb8941f71df5e39f77e43
SHA512 fd1c0d0f99bd254918d6516c1a7c0dfe534e46b5316f3ece212c64c40798f65316888956bc1a84417a30cb0ade5cf56821be151f515e2ec5b65e38c51b71e724
SSDEEP 49152:l1hpsNoJpF1A63U44CwH7R4xmLNiXicJFFRGNzj3:lmifPWRj7wRGpj3
TLSH
T129B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7f41a26a98a89375423877890c5c9630b3625eb7b54554e74544364734ae8597
MD5 b1bca1eff66f93698834d71d351378e5
SHA1 5d30ba7b3ccb7b3f20fe0346d85dd110600ce396
SHA512 43d1facdf3eff36b502aed78b585378f6679c1862662f8cacdbfd5fc77b1af0c48c4048d540f71b5895e9801d78e6a73c43f2f7473b53e47d0301d36980c8795
SSDEEP 49152:LSuZQIY0Be2KcRVtOnks6NMHqlLNiXicJFFRGNzj3:Z5dKii61l7wRGpj3
TLSH
T141C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4f8f844b582c139d5d251e446515d2c16843c13187f9398cc3982c348599ec3c
MD5 9c7b8919c86dfbf2fb87d0b6b2bf17e3
SHA1 07a53595fe0c54c3727b48cba462a14bf2f7de76
SHA512 bbc55bb6d4333398a8fa485ac9906f88df71b30d698036d8bee8a56b57ff5439bc07478d6d8cbfbf6596d20dd7cf90d26520d93d265724b23bf5e7466dd0c222
SSDEEP 49152:QhtSn8EApI0fig3giDn0AP5waLNiXicJFFRGNzj3:BX2imph/7wRGpj3
TLSH
T1B995BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 3a734ae0a627f462ca264bfac0ce6b4cd3463e383dab3f0d8da2d4272471afe0
MD5 f69cf1752ab047c288b2c9e67d6dff54
SHA1 42b73172f6df02e24ea5d6f86fc8df1c8737bde3
SHA512 31ee3f577ea5206c227f1c435cc63f29b835b0ac3626bc179ff686fafafb7c28793568ee49961c7c7fdc0307d2bf59a624a4ec48df59889a1ab48406df05c246
SSDEEP 12288:7ViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:75/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T111C423D354C955F1FABC003AC6755428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 207b141d90744178733e44d4824eaa6c5c77b6f9ad1a36e74461b12388461c4e
MD5 61c2fb042af942a797a9f327a20f4ad4
SHA1 a08452c224a47a69298f3ab947606ea5d42f5601
SHA512 49584f9fec1259c1482f6cb554b0c200cee626c6cd4e2a4cdab2f86efa5de5a408958da7496ee4300ead234bb5c12d5c6e64d849939877404435164ff2e228ee
SSDEEP 12288:AaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:A8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T108C423D3548955B1EABC003AC6755428F5881E2DEB5618E3E3483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 42514373be74383d37768419a38963eeb119b06d1a765ed3d4bccfef07adbd9a
MD5 47efc90f3cde99c02de832c2e4fadcf0
SHA1 b9089a47dfc8eb151b9d2b02bf21c531d92fad44
SHA512 d25e1a564159485406f31c58bdab768403c7ec621b4b068093b42d2b09f2e75bd511e3700db3bc81ef9fd06cb3d6ac73f1e7dee3ab5d801898b9406ac14c7597
SSDEEP 12288:yEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T189C423D2548955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 975d3f7304a8b00ae384f48ea0500c04c7d36cd7c3ce48997dc01826311536eb
MD5 c31930c80a04359dbf328b00281965e5
SHA1 df818d7b3738b1210e7916fa5d02d2c48450f4a2
SHA512 64bf3c7870ee0e42e2435f1feab8f5446a1800ed48b1976b3e328ca974393c04074f2b3d15f4dc4a393434c884a03217b62ff2532d51685e62cad63aee612356
SSDEEP 12288:bVXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:l/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T167D42392168901F1E9BD803DC6764424F2A47D6CD7325AEBD3003D1E5A74FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 ada8f53451ba424b74e2f6e02c951d0458f1e2e3860ed05724e42f3d47a35a10
MD5 c30fadd5424f93c20ba2f46ee833928d
SHA1 4896be6c2e24f133c3fee3f321a56a58c1eecd2c
SHA512 3958dd317c51e45186ff03b3b96538a489f4c383c9ae4bb383765c1566b76b0926b392a3cb8ef6b7faf6b132c4d9e3d5be0a5f0be13a458d7c2dad80638f7fe8
SSDEEP 12288:6viJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6b/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E5C423D3558955B1F6FC003AC6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 2e2b91f31a06138214a56130b9ba44b013dffc429b65b4f66029e2aa0eaff4d1
MD5 ca28424d59f915ff09feb020d1e75f66
SHA1 a5634ebb7cc7deb9c0dfb6a4319b4046e9b9b162
SHA512 8c2a0be44d17aa83c640e549ac80363b6f1ac145ae707edc9dcda5d057854a2da310c66e137e3727dae06b68eec9178a6a09242d8521256135fe93d2b6e5a485
SSDEEP 12288:nmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E8C423D2548955B1E6BC003AC6755428F5882E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 41f88f909f868aa5fa80f719ee9b9ace45af93e9c0e9c1835279ee9c258d3f07
MD5 6b33b66ef6408f0fa2f96c9fc3c741ac
SHA1 2ae4b956cb1168d7669dd2a24d165ee20e71bd94
SHA512 b052682a8e0fcbd6f1f6438f82fc63a7067614c4eb31f31b8747e746eda3080a264825f6ddcb3f3f3b37563c40781ce222a7a4f58b85208ca8e6b8b2ce8a7d20
SSDEEP 12288:+yiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T106C423D2548955B1EABC0039C6355428F5882E2DDB5658E3E3083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 3d4282831305819c4ac4d49703a517403382d6c99baa72dcf623ff577411ba84
MD5 034c840decc59db601b09c074def1d0b
SHA1 97c336074e03bee703b066a6cdb5f3f892e251e9
SHA512 822a5a1d0a9b2d97400f4fac2d9e7e573afd17d5cb932bfa13ff83dc5d794fa7bbf84ee671ba9f147b425ef7bd756307a51c91ab62fc558cdf73cb55172f1228
SSDEEP 24576:5ZMRzFVSOc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5ZMRzfALNiXicJFFRGNzj3
TLSH
T188050295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 8ddcd7a5db43edf0fb8c9eae0d95502ea86a0e2697fc9b8a1a16c795f5414999
MD5 94d248fae2c19efc2cafdf1d6ef60561
SHA1 18d3aac7ee30bbe17e80b0a9bafd75dad1873421
SHA512 546814173e1b6bcd97a9453fc0fb6c4307e5632ee0d0b08c23ab431b53995aa114a91df12474a4453a9cde80357724bf9acdb175d2b864a83b9961a634e144e1
SSDEEP 12288:aJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:aV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B8C423D3558955B1FABC003DC6764428F5881E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 521078b880a6b8826aea3789fe36ab300b4564ab45ffa593db83b1f5f69f7df0
MD5 fea4ce2ba09ad771f1f48925d42ecbb1
SHA1 2170d2a35ac0247313636f6962a80bb31b8ea788
SHA512 0ec3646d685b4082fd1c2259f43b9afdac98221d43fdbeffa0345a836fc47f67e9413cb8ef7cf1a945c478cc44dba3e1cfa36dc75add4ee5cc949b4d5743888c
SSDEEP 12288:bdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T179C423D3548955B1EABC0039C6754428F5886E2DEB5619E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 fa5e33892009b58de33ea426990b19185d61f794c61632b1721213c06f86ea18
MD5 fe9249a543e5d8c9c3cf7785004ac0e3
SHA1 a77971e6927f0878b43b8d76f9f1030e5ad698b2
SHA512 6a86e48fa4cd142ba4bd2de5d426e9dd816f099d49932800c76e915a4b4ac606d202ff5e7ee84f769b847d17dc7ca927ca0dad8a04cad9f6f7e99b6bf39bfec8
SSDEEP 12288:DyPz5L8uiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uzyY/TwSfVcYG3K/cJHlnFR+IGNe8j3w
TLSH
T14FF40147629530F9E17A8139C9621911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 069131ae93596b3c1e1f33e21a57d762d77961572e669952d28917d32c256114
MD5 3dca79d280bc9616b15a6e456e4f4444
SHA1 1f50052d4de666e787f4641de857cab9b7737af7
SHA512 f39b0260bf09001bfaf808b39de3b238e021d74c2e90a19e7b05be2b2f038710b4d4fcacf02c079a92ed93af5c1c74abc7a88bcc852ea2974607108c1daf456b
SSDEEP 12288:lJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T184C423D3548955B1EAFC003DC6764428F5885E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 73abbff16f7b56716e2e6756324a17d5fe65abba64cc90965013a0441fa785ab
MD5 bae2325f3569e73d633f498cf833dc13
SHA1 bd9df08a693cd2d509c90ea12323a91691fb0713
SHA512 5d659ae2c043a453197dfe1a69d15b53f5f2e38b3b8adce1405e08418d1a273162601d54b38494e139a71ad87a4ee32cf5d11219703039ea71f9fc1bf5f66996
SSDEEP 12288:aJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:aV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D0C423D3548955B1FABC003E86754428F5885E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 48d0e719732d49589f0a495628318024dc5d495f1e76186ed445057232b9bf59
MD5 544495c7a15c8695768be8d339fdb85c
SHA1 33458e3d7d4fdd657a4e85533039c83b39702489
SHA512 02397d45f24afb13fcd70a3370fbdb058fdf92a522d5da3c85a865627d012496df3143e822ca3fd07603a77a0265b9ab5f04857ed810e67879154d0741313946
SSDEEP 12288:QyPz5L8uiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hzyY/TwSfVcYG3K/cJHlnFR+IGNe8j3w
TLSH
T1AFF40147629530F9E17A8139C9621911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 8c3b3aadb3832e4bf74d67d44fdf7690dee4e57b01b07dcc07a384aaf3465431
MD5 ee3157497932b3d3a8cbdcf2ebcd8e99
SHA1 5bca02ef7a337c42c42f84d10920f8107b5c910d
SHA512 843a9703fb5b8fbf28588d51dbe991fa2580513d3331d1043d5735e5f99afe3af3bc0ba78065247752f7c3cce61f95c01ba8a4af9ed975630475e4c1d4b17001
SSDEEP 24576:7TDaLl3z0zDe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7TuLljXLNiXicJFFRGNzj3
TLSH
T15C0502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 4d9b2645d2352d443b92cc021d84973e9737670b962bb5e80479ec496d293a76
MD5 382b5e1cd9bc6c874512b5cabd5b51b8
SHA1 09f0aa9971c009d0c65ba93f9c8c3c7d7396ef14
SHA512 0a1aaf91b6e52ee7e127813e3167ed99f50e800b0d7d398196a568baab649f094d0233172563ab8f65d0ef5b8a6dad7092fab03c9da0cbfc7e828a532d50258a
SSDEEP 24576:t3vd9CHKy7GZi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Nvd9CHKyaALNiXicJFFRGNzj3
TLSH
T1D325CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 23b8d526a1eeec7a86b1aaf1eca5802702d6053afb0788f25a05f0a38b7522c7
MD5 4118a6b5762a5fb4c114840d16b9ae0e
SHA1 743e446d4b89b96fd5dcf1540072f778d9ec148a
SHA512 21d3099fc814cea012cab412504902b597e93520f57629c41026d572ccd51a7797958b5b98f57ecaf4f9f3b7960aebf1d07271858f064d6db4e28578262074da
SSDEEP 12288:lkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AAC423D2548955B1FAFC0039C6365428F5881E2DEB5658E3E3483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 ea9dea3eb0b3adca2102d9deebaffd586ada4112af93ef9e9c9fe897a81a3d04
MD5 6840716863f3b51e048ee3c558bc24e2
SHA1 0efc5c080747a41f436bfe09dbbea8028507e7b6
SHA512 76e349fc72849616a36708bb593e1e745feded97ad9884b4e48445a7e83b75c077de9ae42c7467c8dd27b38d205ff207e6bdc96b62a4c41be31a2ce45ec7be90
SSDEEP 12288:2OiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:24/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CCC423D2558955F1F6BC003A86764428F5882E2DDB5619E3E3483D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 1f8e37cb19e717fdd577077932928ec7eee497f28af952ff2e6a0443550bc142
MD5 1d6bee299df1257af4e756085fdd5462
SHA1 e0898471f0b04c4d572b10e9e4e40192b43cf5f0
SHA512 0fb7d98dd4f2cd7e4e8ab0df6c846691d7cdf529bf9ed08f234f4b5927d68591e63bd822563d7d2f1feb6cfdd13c6b85d03b92f3cfc4293738b87e26da20bd91
SSDEEP 12288:Q7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15AC423D3548955B1EAFC003DC6754428F5882E2DEB5658E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 6b4fb2ee9c50c019e57dbf9f4104158b807a2ee1f20b16552ce7521c9a73cedb
MD5 b2a6db25d41cda5fc85ce107cd0cf362
SHA1 ad33a5703ff5f170709ad731246adc7084eebd35
SHA512 0b5127fec13ef481ec7c2d17763287d65e4c79241c06aa998d42280cb7d69b01c91f741702a222f3668eb223e34c2683a083f4cd75173917f207f1bf69462857
SSDEEP 12288:dJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A3C423D3548955B1EAFC003EC6354428F5885E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 b3da76bd2d03cb2fe8e51c5bb66df491c4512888bfd6d052ae8ba0c26b0755d3
MD5 629a86099b3ff02716c7880a7c0f668d
SHA1 d70d46a7944f8e60ee66aec9359e1beeff584c34
SHA512 8b8d75ed5e5d715f5f1ffcec8aca3ac19c3826860496a01be5203275ab9ab2f71fe3aea67136ea4dd1d0cc68d0f5e82e1587779d519e72afd3027f05a94fc194
SSDEEP 12288:JkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ju/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B8C423D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 85f5f3821beae274ccff02bbefdc5d7d04fa764cbce009e428d4d335d2cbe8f5
MD5 64e187b62a43009a0dc4a6e81e71d838
SHA1 fbf814044c2d70ba4febcbdc02260f0d960f12da
SHA512 a2fca038fdf6b372d81cbc7f935662f739f0b2b3cade441c5f61997dd9a0344b5acec2c5eb3028ace5fa781dc6025f0eb2485a2beeba7996d16689bc9e0f8d61
SSDEEP 12288:bBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T177C423D2548955F1EABC003AC6764428F5881E2DE75659E3E3483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 d543296469f096f5d30af70db511f22e033cad4b2598358b2424a6422fcda292
MD5 7261c975c4e8b42d9135cd77468efcde
SHA1 c0524019ed666bbed138ceacfc8bb26b308b1413
SHA512 2235d5ce34f89804e8dc20f41596325954da698e70bcff7f980aa33514335495feb74d471fbd86bead484260c88443f0c3edc0d1e30192a2244bef4b186f6e94
SSDEEP 12288:xviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16DC423D2548955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 a9f4b27a395f298576c97e27bc28346eec3b2c268924d2795185db5479a2aeec
MD5 37e529b719943c5c367ddb881742a1b5
SHA1 af2afdfaaa2a7a371f0edd50c96124667cd5f09a
SHA512 1170c837dbdc961dae7312735ba62aec6380bbd9636ff9f395e507259a53404c945eb496eaadcb9e2d96005de6d7969d86cbb00c9fa8b1336ae6296043497420
SSDEEP 24576:xfwvUk9RX6wkyAIx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rMnYIxLNiXicJFFRGNzj3
TLSH
T16035DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b62a1a7f448d4c5e821418bff0d58bbe28827a28fbcb56289c8a2482a13f5831
MD5 bb99a9752ae6e83e3cb244c744770663
SHA1 1cf25ee7e730b00a89cbf88814e7588f6bfb8184
SHA512 5628e32a35af84cda2c1c8de5de2efc5d5e335f953c25f5993332d7c9cb10b3f24da6e5de0c4a0008605ac4f18ca1a3d21def7b062177078e1084a6d1c82cbde
SSDEEP 49152:3YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06LNiXicJFFRGN:yySzPi7wRGpj3
TLSH
T104066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e6b617d26da702ed72a7946360c1eb42f6b813dc1f4ac216283c7714fae73760
MD5 953fec0f05ef9ce9d4579060b2463878
SHA1 3c20bdf37581894ee96fc1cae233596382b57758
SHA512 f0159ce1a7ae57e3540acb5ee677b4f12f9ba1c1577f28c412753572ee39cb0c74fb04c1962f44791adf8368adbabd33216b2fdc8710477a421ddca77428dc8c
SSDEEP 24576:/47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/47JUQjTirIhCnDHUPfF/qLNiXicJFFS
TLSH
T1F665AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 e33f0b1ac6fc58002e76c834a169b77699697754bf11121b9cfdf0703b6c7328
MD5 d601b921e7442cf1c53014ca4f9f3f02
SHA1 7836a653989559e64fe9c3506ba78c30eceb0214
SHA512 787112df2b0235a2b1165e416b43275ebbe5304e1b62d2f2de06047ee1b239363d64dcffbd9ade263a324a569e0b54d0ae4d4df91f81320c57f7065e4da2809a
SSDEEP 12288:Hbsf5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:al/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17FE4F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 904KB
SHA256 4325fdc39aa5c1595a69f705eba8349f82197287278981b246e353305ff4096a
MD5 e072913e77455c2174bd598b8d718ff0
SHA1 5f3ebf29b8816265517877a0f95794aa278f5d10
SHA512 72575792735680b9018ebdfd096e63d2522b285d68843ddefb4f12116dac801c4cf5b65325fd3541fd65035615832ce2218647747454c6d74dbee5964c284d7a
SSDEEP 6144:MsBC2na6u1cozW3e9SmotMxqbLVU3fck/KO/IlrJui7XqaEOVD9P4f2kzMLzIXH4:l00pU3fHe3XcfOLzyHb4JUfspbLsmG
TLSH
T1891517107666C74FC6AD40325E32C5CCABB07D41EE45AB0372C9873FD576A58BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 1b3b75cca2761e60374ca844d0ea16fa46bcb472ec6ff0f4de94bd171a23aed3
MD5 79e71e86b48f941f09c2514321be8a3b
SHA1 1674f749ebbbf9654fc27014db9206f13864a8eb
SHA512 d302290632bff175841ae5eaa54189b41a75178b7ecadb9b3c8cd773608b2df98bc2c70e657384bb41b59cc4b20c3667d1f81fffd87c705dfde032da540c38ee
SSDEEP 12288:CS7dqihQvssrnVv5kPCletSrYbV3TJWxHlVjVitL8iQJvHKmR:CS7dqihQvssotpDI5ViaiQJvqmR
TLSH
T13965E7409537A3CFD1BA6071476A9B4CBBA4EC0677096F2373C8053AD86AB15B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 3edfc86516861d2b34eddbb07fe1fb9965eb254a51f0fc94d8d42e83ed328549
MD5 7c79a5ea046ba060946fd1616eedf068
SHA1 df8a9a8debb3d6f6ce27f1ee2ea5f5e4dfc14905
SHA512 de99aa7edf5c2f07b6625146356c1f72500c65953ec916ae1729e0667f17a927234b6e1e851b2858f59d9f3eca9745e3ae06247216b0f3b8cbfdee2d282b8db3
SSDEEP 12288:bz7xiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:79/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FED423A3468C59B1FAFD1039857A8434B5497E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 77dfd8f902d2a0c9a465d110ea3989308b925f3272ad55e9516bbf17c393834a
MD5 7da2dea8ac57b2f11fced858890732d8
SHA1 8283ee8bc1b86bab949f7a452b297eaa68d04373
SHA512 4ae2481ce09dc105221a9d5f7dc899e4102e763c9e29ce4d29cf40e7b6cffd89327635871f0c494cbf4729fc20d5d85e7335b832e1830db08435d92776086d60
SSDEEP 24576:lgb6bmBIi49WNNFpg1rSvFv7bYX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lgb4mBIBhGFMLNiXicJFFRGNzj3
TLSH
T17B65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 6858d74883f105e08619c049a9a5df952dbb56fd164533467f50aa05898d18ff
MD5 36b866638f73ec3e6f0193241e6247ee
SHA1 8ec14333d2a19158c735334511731aa318abd0be
SHA512 9da99e0d86a1f649b76e2443d3dcf81dc1790c811c02796f3a68444ba7e89d2936b42f8599f900bcfce1a9b58eeb36873cf11e3c9ef69e4e61b99c0d008c2381
SSDEEP 24576:3G88u8FpJqH1bzria7/mc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:27ZFPqVea7/PLNiXicJFFRGNzj3
TLSH
T1E435F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 68242dd5ba4291871f18fc862cd6cefec4439a7aca3eae45e44404f7f292aba8
MD5 29c769d001c7c082accc3f74d73fd107
SHA1 978b89c07091973c2abb976e9b58a56537d1d59b
SHA512 3100790da38d4680c3c2c25511be5e407e09d926a3750a43aca6af32c664ca8670e282520915358118cf40a468f8560e2d62bc478d6c23cd35a16ad60b1adc2b
SSDEEP 24576:kPUr+NQA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kJQALNiXicJFFRGNzj3
TLSH
T1FB05F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c0250f2c50a04a890a81f2c90f629a09b69e0427d21bbd4197a5a230e9bf0457
MD5 1f44494ce3f2a54d3edce8860ce91457
SHA1 a35938213c34f48b7752c4a44ca2b8ceaf816cb2
SHA512 b555a200f8cc1cae30ee5516f7fbcb077bb3f3b110a71c36d3f175f2e880946112703fa35182e2e88f43d3ea1f8702a48e717d436566ae94e4e0b695154a8642
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjQLNiXicJFFRGNzj3:uG05lO43bp7wRGpj3
TLSH
T1AED5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 65aad4cc69dbb47393ca58f96d33769468e5107b94dab68ec4d4d7fc01c6e541
MD5 d097070489ed014f9581f2dec5ebafbf
SHA1 96fac1f7649fbc5ba7e62839580b08901ed93099
SHA512 fa5b448c0c88a27e2f6c21023750de44e88b9fa77cbebaf0648c14d1ee4937aa9a095a5a7822d2115d2f0a5363003aa475f656d7a22a6fa04d9117d95e63953c
SSDEEP 24576:5fa5POZ3dpuWVM50JicR2hG0lasx2+47eidn6/TwSfVcYG3K/cJHlnFR+IGNe8jg:pa5POZ3BJt2pasx2+m4LNiXicJFFRGNf
TLSH
T15465BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4ef1f637a12f340f31dbf46aaddab03661d820225c3513006ae40e81c69b1c80
MD5 a8738ead72bc54f55a7fa44efa4c3b63
SHA1 faac22593a9a5d7cb278b1733654fd57c9a50994
SHA512 ea153c2469ef52da87f0dffa652f3e5aab1f770a0cf09690068735de4b03bc735fac32fc40f303b92d8038e87db48d76370a8405011f4adb0e01373c1c8a5fdf
SSDEEP 24576:jNcwHdjbyQ4nLC18lb/EOjowL7Fkk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jNc/zEOVHFvLNiXicJFFRGNzj3
TLSH
T13C858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2b820e7cc893c5cbd9f5c1e1b9d88a6e878e8392ad26c02f8051642f6dac7ad1
MD5 f18e11cb904ef3211023e6a7d6ce8098
SHA1 766be03adf173ebd1749237792f51864eeab21bc
SHA512 4c7fd974deec97b580fd9e7c31f22f4490bbd18e55d5b9e1f205d4cbcdb2cc40e3f021aac3eb79c19fb1643f20f4ece5140b93a9f804b9a63c3e02fffbdbe14b
SSDEEP 24576:4TkNvNnaFeYhJNtmZBm2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4TMwBtOm2LNiXicJFFRGNzj3
TLSH
T16955AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 7dc090373b2888d703942b6b008e70704a0599b04a202742db4f16a254f72b96
MD5 aa80a043bd6a5bcfe85a3e5a8455acef
SHA1 659c5c84b60048c4423d1692430a3d945f2716a6
SHA512 9c25e10a1c25b206ac1c99200f7e855fe0ef4ba8b61b22ccad6bf33c98e6050375e46670423a24da44a7ef6200ad85aba727def4543f22a8b1519873eb37a406
SSDEEP 24576:YD3FHshBIYQgAZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YDVHeBIAAZLNiXicJFFRGNzj3
TLSH
T19025E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1688-109-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1688-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1688-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1688-103-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1688-313-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1688-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2124-79-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2124-85-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/2124-80-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/2124-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2332-8-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2332-9-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/2332-0-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/2332-66-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2368-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2368-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2368-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2368-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2368-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2368-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2852-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2852-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2852-279-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2852-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3388-294-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3388-67-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3388-69-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3388-75-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3528-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3528-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3528-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3528-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4576-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4576-21-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4576-22-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4576-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4576-14-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4664-328-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4664-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4664-96-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4664-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4664-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4664-90-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4988-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4988-134-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4988-136-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4988-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4988-128-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5436-122-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5436-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5436-116-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5436-115-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5564-327-0x000002163B510000-0x000002163B58C000-memory.dmp

Download

memory/6072-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6072-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6072-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6072-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6072-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download