06068ebd2216e8ee7bc3f91e392cb453086b5ea35c509af16d4dbb6e344df82e

Analysis

max time kernel
151s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 1.4MB
Sample260816-h924caseke
SHA256 06068ebd2216e8ee7bc3f91e392cb453086b5ea35c509af16d4dbb6e344df82e
MD5 78e1696f42f6863add4bc6fabe6fc928
SHA1 1d611231e17eb44e4a2a1549a3fc4b16e71440b2
SHA512 11d55879c5edacd8678a3d906d03f2c65ee46fdad52bb0e3bab4421bb69042d64fbbad0cec30e8eedaa6106a2d67c638271590e7ac1c22041cab8d666593d8f1
SSDEEP 24576:r5vG8T+2fIGI9pZcTy0rtKbqiGGC5SYCUTduSZpUR0GHrVQ1aW4mSOgv3isi:r5vG8TG9pyW0rKgxpAHrVQ1/fSNvi
TLSH
T12D65AD2DE6A801AAF06A9279EC554706E3B37F15137146CB33A0765A1F376E0CF3AE11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4708	elevation_service.exe
1444	elevation_service.exe
5156	maintenanceservice.exe
1724	OSE.EXE
4588	PerceptionSimulationService.exe
2448	perfhost.exe
4648	ReFsDedupSvc.exe
4556	SensorDataService.exe
3308	ssh-agent.exe
3176	AgentService.exe
1096	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\320347ce23e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000755db7b2502ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067e944b0502ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1c277ef502ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5c695ef502ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b558d6ae502ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4708	elevation_service.exe
4708	elevation_service.exe
4708	elevation_service.exe
4708	elevation_service.exe
4708	elevation_service.exe
4708	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	3176	AgentService.exe
Token: 33	1096	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1096	SearchIndexer.exe
Token: SeBackupPrivilege	4648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4648	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4648	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4648	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4648	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4648	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2768	2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4708	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 3708	1096	SearchIndexer.exe	100
PID 1096 wrote to memory of 3964	1096	SearchIndexer.exe	101
PID 1096 wrote to memory of 4376	1096	SearchIndexer.exe	102
PID 1096 wrote to memory of 4288	1096	SearchIndexer.exe	103
PID 1096 wrote to memory of 2396	1096	SearchIndexer.exe	105
PID 1096 wrote to memory of 5512	1096	SearchIndexer.exe	106
PID 1096 wrote to memory of 2932	1096	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_78e1696f42f6863add4bc6fabe6fc928_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1444

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5156

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1724

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4588

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2448

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4556

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3308

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3176

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3708
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3964
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4288
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2396
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5512
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f16199f2b24dbe19d4b13ac64164ffdba4bda2c5ee8b4a36afcfe4e70b7ca876
MD5 5898e0908283b29a5d1d8d61835cc50b
SHA1 6e6e3136bd175ebf0b77c5f86a693abafdaac9f1
SHA512 f6379a9038de2b1683711f41facf7702cb6884b127781449d3dffa821d93a78acfd6afbdba7ae45ffb319127d877c43c5a7550f54043ce1bc773a2c2334c5b72
SSDEEP 49152:yb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnKpAHrVQ1/fSNvi:U3q6HjBJpAhQ1CNvi
TLSH
T16ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 613f8ecfd56a8664b56aef67fdc630b999d1051159b3bd836fd3be24d39c0326
MD5 23e2c720ed24a654248fdc5cefd4c4d2
SHA1 6f26af8915807fa5b4249d49ac37a4338b48f516
SHA512 3125990e0443cc06981df471c6ea129296b09621024199a6f776fea2af53258dc505738d20dc647fe34e9483f16a8d6cf6639423598a31aed417bbb559ff00de
SSDEEP 24576:BXYfDtczATTduSZpUR0GHrVQ1aW4mSOgv3isi:EtcQpAHrVQ1/fSNvi
TLSH
T1DD85F12973E404F9EC67827DCCA28511E6327C9147A4E7DB03E4996A1F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 074bb8e11d96b3e393fd9862801c1ee98151437dad829f49658bffe6c0efa6fd
MD5 059458ec87ea7dfb2b85e85fe55c3f59
SHA1 f85ceeb51218d9223a0b8e6d9800248591374beb
SHA512 ccbfbc6415a5e90c2c073613dddef259a15980c900b3b9d71171d57f22366a8bc45fa87de6155d34a0896edcf8b5900650f178b5a4add6cca915b016a478ec57
SSDEEP 24576:Q0Le5ji0hmxirM2TduSZpUR0GHrVQ1aW4mSOgv3isi:QPji0AcPpAHrVQ1/fSNvi
TLSH
T1FC95AE56F6748371D073C0B9C5D2A69EE97130821B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f8a59540ff98c62bbf06b5e3e91b94eb355a035ec57e842dc9d672b1cba49dd7
MD5 7274c8e62b7b8fe72f8b63456e6c6bb5
SHA1 2ce54914cd54b9771dc6d740c7498b38e00a684e
SHA512 f42dcfb978f50dafca7e3fdb3d8489b00860c3bbc9492f858d846212c46be857ce26b3a5464388a5a8c9ede81e8b35823a2bd25a159f40b51536a844b22afe47
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWE6q8wyuwTduSZpUR0GHrVQ1aW4mSOgv3isi:C/ezSC6vUzPvxHjyLpAHrVQ1/fSNvi
TLSH
T1A8755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 52fb06313c02511c6f64e978c19ea6c61ca244dc49f6caa709f003bb500aa499
MD5 3689b86fa439bfdf3dd12af15831df14
SHA1 b24278c3b240e869bd5627062fb49efca80e4822
SHA512 cd8706370f115de28a894adadacb38c1cde18ca658623cc5b87c599837d836a84bf520f0be8794ecbbc260302a766b59f26ec6888fb29e50ce39d9fcbc851ba6
SSDEEP 24576:ZVbqPb88hv/l+6nTduSZpUR0GHrVQ1aW4mSOgv3isi:ZVO88hXl++pAHrVQ1/fSNvi
TLSH
T110559F66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 d0486510a8b53c0832d3a5083f9b75981867b05ea6dfe3cb7e506b0ccc52d49f
MD5 be5b95b4f87c82ae6ecdbec179425aeb
SHA1 009bebc4014481318304197a64b50f555cf1e114
SHA512 37f376dfc7c29bb20fa7904a2922602f6a44959f5dec9d201e4a11a3a52b3018d58beeb567f7cf0b3a1e98f5d8395ea49cab3af60cc024a9837d39033df3dd44
SSDEEP 12288:yRaTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcf:yRaTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1586523C727A920F1FECB07BA1DC998A491715EB02CF81993D6A4795F523E4D0CCAF125
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 4035ce3ca6e665be84c40aff6b124e9c339ba59f74b46d76a146a2ca6553db1e
MD5 5cc244d3e39074e62f9b59c5682d454a
SHA1 feba22dc4a87b785fe977568c770807a945ef0a4
SHA512 45bcc71b9b0502d650f581f827dca28a6e80d495f7ee83384e62c2c24333a6803a5bf3a546e1e9d618da1550e4e4faa33cf8b471e8c224f81521baae03d7f8b7
SSDEEP 24576:lJIUPTduSZpUR0GHrVQ1aW4mSOgv3isi:lJIUxpAHrVQ1/fSNvi
TLSH
T18085CF7BAE28FCE2C67E4DB95A918640D77278704F61A3CBD174820EDE235E04D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 134b31525ac9b69917253496c3538399680fd97c35834e4a484fffc08bd63bb9
MD5 021d70c5cb5d8e48f0af69b839ad430a
SHA1 8a3dd767d1af738211bb63cb8606a6fe52303ab9
SHA512 bbe17bd3400deaf9129643283f9d89a09c8f037e6c87ec4a652d56b95029f010f1610e42b1e247cae4a5996304c371b8fa8122130c380046d5712c41b92e1da6
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH7:EQvGAdlCEL8c/yRNw5CwpAhQ1CNvi
TLSH
T188267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 138fae6d31ac3b8ec7f0dc3e707591eea2da98fd41ec001f967b5fb93b30eba0
MD5 2887e909fd14f9fd38447b24f9117392
SHA1 901ddc4b39086f377d68ed3aac70e11dfa9ae0c9
SHA512 6ad4bec3354290d516610e97899c151c59f1ef18dfe2af12012a38c0cfac4303556d10d66b15c42012797c8e15a69c126027933b6ba23d2f13dfe708dbc96fff
SSDEEP 24576:7dewsAjhTduSZpUR0GHrVQ1aW4mSOgv3isi:pljfpAHrVQ1/fSNvi
TLSH
T15785E031FE74E032C6BB0DB61B26C716543C7A604FA119C3E3E89E9E59341D2277AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 eb17a13edb4cee8e4c4c3085c5c1201f19428b539e2788168a405d3b54f1c77f
MD5 a14b4365a577574932a49253b59a3096
SHA1 16b369a0054554d966035057e12a77b92a18158c
SHA512 577c4f3eace9878545865f4123c90f7ba8649ca756ab70d87ad14f92af8f9f569f0c0ba35a4f7551b443c62f0bd9657bd60dbc3731f5d974e3daaddf321874e9
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHlUi:dUEtQevvqc2W1cpV2EI32+
TLSH
T174474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ab84fc680a06a9836b8242b77f63631dc8f8fddbe0a4e067772060b375003d49
MD5 40c80bb960874418004df25c78f4cc7b
SHA1 269995cb2a8c50fe3c5c28b418f6b7b33058d41f
SHA512 d6bd35ba2c6ba13836469554960ecb46cf80a890191f9b07f48aa87f9ebd1da7efa03d968354e27165b0146fb66fc354d1e07db2130748800bb95ed0cc6907b4
SSDEEP 49152:FCbRquA/m2yL5zLfFiV+XenmE3/z/pAHrVQ1/fSNvi:Soq2VjnmcpAhQ1CNvi
TLSH
T151D58D0976B8C1E4D1F6C77886A2C647F37178154B34ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 56575674c0192532c830297f618ad8526d128a2f2011661d98ed520d94e78131
MD5 c73fc8f2a75b0243c9341f0a65018c78
SHA1 58cb7e396e12329139f8e68e96d5b46d0ab97aff
SHA512 150fddd0c1e2c32456a1d8ffa69bd75762e48b5c390f2a32ccb4387d1cd536b651450501c215cd0817826edb90bca237c821bb46996cc7714d4cd8400c27b6b2
SSDEEP 24576:QAhGLJIFoiwtA5l7S538TduSZpUR0GHrVQ1aW4mSOgv3isi:QAMyFoiq5spAHrVQ1/fSNvi
TLSH
T118359D81E7F955D4F5F3AAB899B68570EA76BCA65E30C20F2160D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 165d85a1b0bb9cb7aefc56c42d2c13ae044951752187575d50717411a4782c43
MD5 b26fe759e727f4158bd363243bcdeb3f
SHA1 b969ea685bf47121132090d95e6efc79545423d1
SHA512 7d0a61580340bd0de02ec45159499547f85f751f7ca5e6b797f80d7f4bfed3ee7f034c95bcda26d16d0351c00a01baba1434abbcc34e163401c5f743cdc42685
SSDEEP 24576:1wuoOWtTduSZpUR0GHrVQ1aW4mSOgv3isi:1wDOYpAHrVQ1/fSNvi
TLSH
T18585F18637E41CF9E9A742398987C135F3B2BC112A759B1F0760C65B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 052b9ae808f9546531ee2e798e7bf7d32c1380ebf7f2649ae6a99213f5481638
MD5 d85aadc11db403bc4e7049065ee90966
SHA1 abf1bf1761fc3365775753c5f9b6c97c5f96206b
SHA512 745ffdd4498a5232c42f1584b187bc4d6b717754b7f5e17fafad81d71250384c8299bddf9a631b15298f6fa6b88b4894bad83b5ffb171db902b8db2833fe6176
SSDEEP 12288:1BZ1IyRTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWc5:jZueTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1EF75128A33E830F1E997427D8DE54A44D3727CA22BB503CF5664526E2F37AD14D3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7b0e35e8cf5f1f45c2f25a8eff9f7af90527636693b220fb8aff40fea3dbf7a6
MD5 a79919907201ad8d8b7c5b4518b0b7b8
SHA1 241ffcd018c84c70173b99f98645eea6b7b1908e
SHA512 a48c14db4f37ba89ecc76368c030c527375d2b60d99aac4679b953505c6389e04e7db7fe7800e38031207f459867ba02e5d56fe64d4cf7d5597678e14e4e344a
SSDEEP 98304:rQRQyi36YOcPQLvw2gAf+PN3dpAhQ1CNvi:aQyiKayX+PNnUi
TLSH
T18F667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7c244527675b118ee03d019cb5e40fec2c76cf2904a6bd87f419a3a5750874c4
MD5 edc65b75def5130d46dd662cff274d3b
SHA1 426f5b619e196b78fb83926d2dbe893356731f3b
SHA512 f606a731898f012574e6ed3d0fa302f0dbaf4b17d674e7ab8468f6e4ae62874d261dd491171910f344aaa12263f3a3260a1535ebad1a348d978248d577ba51c3
SSDEEP 98304:wQRQyi36YOcPQLvw2gAf+PN3dpAhQ1CNvi:nQyiKayX+PNnUi
TLSH
T1C9667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7d588207f7822312709b7d3fa3ab8b9554aee62e448dd8596e29c6a3e85a4b92
MD5 c8533d6b96a152e861cdd6a591211932
SHA1 39046329574f7abffee8d7496eabe956f5bfca4a
SHA512 3a824268dad54e2d34a73c752eee3224497fef700f74baea077e0860ea885ca90899f797b05ff51ef3031896d507542177db98c2b4ea442305a6c2b94eb4e7d3
SSDEEP 49152:V68Qg55nhheWu7PNU3/PpAHrVQ1/fSNvi:jthWRc/PpAhQ1CNvi
TLSH
T1E5B55A33B2F600A9D44DD1769F4A873196E17C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 71b4be627c7be8e47ca38f218121f34c4a93b1a86be7c68dfbde93b33896185d
MD5 0bdf34dbb5055125fb91f418497b13df
SHA1 c2294ee618ff5d0d0bd151a8c8d3bcb62bab0052
SHA512 5c9a9d5661ebb97068fcce06c78aba8c2c7ae4aab3891a7769ac8cff0aed4328ef0a21117fdc94e09ec947fdfea89814f1810e5dade49339e585b31f5c8d05d1
SSDEEP 98304:Fy5112gYy5azzVvL69nLKnhZmpAhQ1CNvi:oLIHmWhaUi
TLSH
T15D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1a874df51189c3efec30b0c0dccd620d57aab6afcf8108a43a1ce23731555be9
MD5 b494a4c2837815b6b763edd763e46dfa
SHA1 2e33b50f620c4038f3c3dc5fe1ffe3144a191a2c
SHA512 4083b355aa27a89ff5704c432d1fb0c3d5a6937c4594d0ada8161c58232db728206ffdfabe7178c051c8ee1f610a987f9c9bc5ee11f4c0851bb80c1dfde7a663
SSDEEP 49152:9B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl1pAHrVQ1/fSNvi:ju6JmVxd2d1pAhQ1CNvi
TLSH
T164D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7a45e63bfeda2795746db7c79c9a3c5ca4aa6467fa659bb3b362dc905d50b1c4
MD5 890354067d9a51719720628e03a9cb37
SHA1 bbe2db8575a62f2ad50249ed177f1c1c7544e9ec
SHA512 c0c1852cc55ce66bdf247c4f38d3f399e34198ee480d5a3bd10f05b1dbbecc60314d5a8f2d6932a5d204ad62c6ae9badb9d2edc99720ef18ac49d8eea6b17bcb
SSDEEP 49152:b1hpsNoJpF1A6UU44CwH7R4xRpAHrVQ1/fSNvi:bmifPbRcpAhQ1CNvi
TLSH
T126B5BE13F2D901E8D05ED17887569232EA72BC460B34B6DF0A90B7961F7BAE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 14481ccd8da2fd72f6bd49081e366e851e3f20360bfc98b67d3711be6e20fbb2
MD5 c95c9c0f752a181189bdd8935fadc9e4
SHA1 b60ee177a009f65b043af9b5f0857439110e1e9a
SHA512 2039dcd0e1d70565280ac3bc610505123368fdbe96e44aaca507e54250a69f0ffa6607b75374036c363c0658300fa5911e0014a3b7ef7e9536fc81dea0fff114
SSDEEP 49152:kSuZQIY0Be2KRRVtOnks6NMHqapAHrVQ1/fSNvi:25dKTi61apAhQ1CNvi
TLSH
T191C5BF03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1a18349d77675aed88d22631ede6f43de4ec03878eaa124e51cca2bb7fa4ea13
MD5 c24ffe9561517f92863330533e01a8fd
SHA1 590aa2c7063995f287d4582942a3f6b387e977dd
SHA512 044a02aab8b0d21b224c2cd776437fa649a23a8979edb7a033903a891a3f94c278900fe442f6880fbd4bb4092b7b62beabdb6072e046d66ec6d6b32ad43108df
SSDEEP 49152:PhtSn8EApI0figngiDn0AP5wFpAHrVQ1/fSNvi:eX2iyph4pAhQ1CNvi
TLSH
T19B95BE13F2D900E8D05ED178C7468632E972BC150B39AAEF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 065def8d9226551c9b344a7c86feabc1a6f37112448433627232e6ffe3b7c260
MD5 e1b44dc9644f0e3a46491b559539ec05
SHA1 6dfa6804b44e0e8821846072e86f91ad30443aed
SHA512 bd23a2c8e709cd829cd7f76fa25300db8997287025a52f400aa097b08e578eccaa90ef6ea4e043eb63017b15bdf58dabdc79914f16b728f46a1c80fe9270ca54
SSDEEP 12288:ZCTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcT:ZCTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T12F6523CB27AA21F2FC8B07FA0DC945E4D1705EA27CF81597A698641F633B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 797526d5a3951f854f2f4a0010212ec99284ce01eb58f9bc3e5e28f80a5da1f9
MD5 83db7c9529c006877c5519a53a5b5724
SHA1 92b6bf5d477cb62ce1a105fc8665ce25165b6efe
SHA512 f7aed5eb90384831b08b457b9462fd4901367c6757b91bf3b9ee69eea0e149f2e5f508ee849167330edd565fdd1f09774d057f57c943e9d0fb38a67e5b26f4a8
SSDEEP 12288:zFTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWc/:zFTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1636523C727AA21F2FC8B07BA0DC985E4D1705EB27CF81597A698641F633B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 8782115003b11731d9da724db8decbf42ecd91ad5a1916c3190abd5b7fca975f
MD5 8aa04a2bc1e897f98b24b0ce06a9058c
SHA1 dfb95c03c07c1fe7ea37bfcc703abfa0317feea0
SHA512 aa25ff1af344e0e9080014e3e502ddc18e668fdb189b153bef5f479b84f0e64465644439e127457c28c820c7c7b7dbf14f3905251115e1481e116266df7f1a2c
SSDEEP 12288:H3TduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcL:H3TduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1526523CB27AA21F2FC8B07FA0D8945E4D1705EA27CF81597E698641F633B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 5c455e51bc4dcbe1673106dd8ff78a95bf4dc38a739ca1aeb19962e0f7d61ab4
MD5 1717e6476ea289b0470f4d6e4e6c61b6
SHA1 90b04bcbe7fcd245263ea5d7d8f6c8d2d2eea78f
SHA512 f87a7cc01434083598b3a37ec6aea269bb725021116c874faad85d558c15802a2813bd26440838c26ab05f5e5cb47a58b674d6451ce385342e0f219b0d4ef22f
SSDEEP 12288:1VcTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcq:sTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T10C65238737AA10F1FC8783B98D8584A4E2717DA17EB416DF9B54244F1B362D08C3FA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 ac1c40ed202c7e92e7ddce5fd8c7945b73226138a8bf1a48d5d2a0a5896897e3
MD5 dfa8771768db1f5d02f65457826a4c43
SHA1 aa2f43102bd8cefea6aeecc51b5e2968bb66bae7
SHA512 493daede3bf1ba6929d27db379afc88b90e12e308f06be1940ec56eb628dde5ce4c31cad5a094ed5cdf4fd2491e469e8ca2833a7684c9ead0babea7de025ca42
SSDEEP 12288:s0TduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWce:s0TduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1956523CB27AA21F2FC8B07FA0D8945E4D1705EA27CF81597E698641F633B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 3e45cb505d82568351c458838f0507a30ecc4b8d28060eca4fa76c004b2631ce
MD5 1eda6d26f5aab41b27bdd93dd34e3e41
SHA1 368d3e2223ef8657a8cb4bc674e1e7270e57c2fb
SHA512 104091479510214fa932807c9057d8885754195b295696cd9d33e865057aa00083434520692d98c80f52df37262645a907db777c0a708a4d902d352aa3c2cdf0
SSDEEP 12288:UpTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWch:UpTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1796523CB27AA21F2FC8B07BA0DC945E4D1705EB27CF81597A698641F633B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 4d264abb936df24c73184c883e45debe5d4f2b8ba7c1166379354abcc7993e15
MD5 9665ef43d3867c84d5c8bcf9ca6d07c2
SHA1 ff1f6abeb9c9fe6192c330cb8d0aa8b4ac7ff790
SHA512 360243e7bdc61c66e5cc2c0ed331ac26e0d861d62ff3d069d3699aa8c67bda42ceaf943edb9bc41f14202860f2faf3865d05c3baea289d4122e2a9f575dff235
SSDEEP 12288:D9TduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcp:D9TduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1686523C727AA21F2FC8B07FA0D8945A4D1705EB27CF81597E698641F633B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 82f76aa29480a8801d41e1a1417efae924955a0a8fb51b259526753610f32b99
MD5 bf6ae8133dfbb2862ab0d385ad586f43
SHA1 6af798ea0b801fab987b81cd6efec64026e5ebce
SHA512 77cd1f9c9626b64a9bc3901116b2b8e37e27df9a53407415174706fbb47812f6ab041fdd343b86d2c201dc41e310280864c9ce65ce09727e060ea11d5dfa86cb
SSDEEP 24576:IZMSzFVSOlTduSZpUR0GHrVQ1aW4mSOgv3isi:IZMSzfnpAHrVQ1/fSNvi
TLSH
T197850195739018F4ECA7827ECD558915D2B27C661AB0C65F03E8366B5F333A10C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 30028ede8d1f3fcbefeb0e442bb27bfc2f4540b78c043fbbbd2af9421f2d42a8
MD5 27a05e2cfdf80294cc6624b8a723d6b4
SHA1 9a1acc4cb847ca9aefb19b69aea9b0be36ee3ad6
SHA512 a911135b6d03ca52815f652b110fc6214eccd20ed904db62c97be81446fc525ee015d6bd356e119fed0faa2e6a51045c6d7804d9ff03011faea2713107da2a05
SSDEEP 12288:iOTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcP:iOTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1366523CB37AA21F2FC8B07BA0D8985E4D1705EA27CF81597E698641F633B4D14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 bf7a5233aa9d81651dcc778b25857f48633c69ba982e88e9ca59168a037e7867
MD5 8e54e4df1c683f6f0e485949e9e47559
SHA1 bc2f87bcd7e6cb13f3437f9faf883f0706adc3ed
SHA512 342b564ec59457ccfd6757eac9874b6fdc49774ac34c22a70498f813d4761dc296b7d6bc0e94b80ba9948c8bc6f37093c4abb0ca85a8c009395f07e4be2300a0
SSDEEP 12288:1KTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWc+:1KTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1DB6523CB27AA21F2FC8B07BA0D8945E4D1705EB27CF81597E698641F633B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 f003a6519a854f695908f7abe37c81c8be7224eed4cdb561c25d139bbf35c9db
MD5 4caddd943200ea46f26298f3e1551195
SHA1 d163455efc9c714333b8bd2ed2d570c7983627e6
SHA512 cd98329a4ceb490004b20a9e7f4eed7c7928fc7e8c1bb7a39734180e25942ddb7a6a62ac001f06efb4cbc5899691fe6d4f0c95a8a16ae419b75b8388d8b00413
SSDEEP 12288:oyPz5L8RTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWch:pzyRTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1E375014733A530F5E867827988920A51E371BC721B744AAF57A4067B2F376E09D3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 7706c9988d29c21897169539f6f994d14096b3356b98b8ae56b1780a45d9d72b
MD5 4aee305a74601d34bb8fb856c32588a1
SHA1 72bf828f0ee2886109aac5c24e5636fa1683790f
SHA512 90384ce8e76bed06398189911b812328ee326bfab845c9b764b7cdfb3863094c0afbcdea9455f12712e80ae3cbd3235906b03f9d18f85e80a087b87a0a1559f0
SSDEEP 12288:2OTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWc5:2OTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1596523CB27AA21F2FC8B07BA0D8985E4D1705EB27CF81597E698641F633B4D14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 89dacc278790ca1defb4ed43236d5f16012596a556451997fe32bfc1ee8fdfe2
MD5 312b18e89a91993b5a9c6a724ee46a11
SHA1 4374478bed0b8d8cf04b4d016bbde0fbc2f5868d
SHA512 2b963048a2afbb98ac94fa89140e170f7685c730328e39588e6497c416476b7c54fa62fd2a3c26c0cc1a62e7450a236dab3f376df6cc94de43ab0839c02261bc
SSDEEP 12288:xOTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcs:xOTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1006523CB37AA21F2FC8B07BA0D8945E4D1705EA27CF81597E698641F633B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 41db6c5a9dab62f9102e533acad36fdbf4b96f9ba028f6e7c20a49b2db1b117e
MD5 771cb119398d25759c5612a7c7c1ca45
SHA1 d5b40d05c8e8134fe46917c941e6d512ed99ac7c
SHA512 77cde448bd599fbcd25a51969856d6293b9a814551d0cc1f574712f040f674d8b0460b98d3e22a3fbdf517fe9dabb99af8899db784bbc99dce880c242bbd79a0
SSDEEP 12288:wyPz5L8RTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcP:BzyRTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T16C75014733A530F5E867827988920A51E371BC721B744AAF57A4067B2F376E09D3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 0e94491c960e8982dfb8799b34a62d1e824f3fa8a16ff585d158da1e6844ae21
MD5 a9e9e829d8fef7e546e6e1bcae9cf609
SHA1 8fd4cadd4f84e1d167edfc3f33b385a616bd1a02
SHA512 876885eab08a6494fcdb50c9158d2de554a9896e99cb0ee02f111ba21361dd7af82d67ba21f91dc0ffdd718f37c3afea34fdfaeacd7412f93f2f211bec445fc4
SSDEEP 24576:aTHaLl3z0zDHTduSZpUR0GHrVQ1aW4mSOgv3isi:aT6LljgpAHrVQ1/fSNvi
TLSH
T136850195739018F4ECA7827ECD558915D2B27C660BB0C65F03A8366B5F333A11C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 df795d2a612918e3eb12656c5674d4da64094d1b0fa9a7cc6bb3c23b0890b713
MD5 af9fd03daa9d052fea1b75ffcff715a1
SHA1 8b352744007b4aef61223ca5b8531d675bed09da
SHA512 b0d04117449823786b59a495ad50c966d2da05f6776309663e1345be7d7052035fbd54ea39f2df0fa80fb41eeae46802d158447780954cecdcc0972f5248dbfd
SSDEEP 24576:p37d9CHKy7GZ7TduSZpUR0GHrVQ1aW4mSOgv3isi:57d9CHKyanpAHrVQ1/fSNvi
TLSH
T12495CF91B3E410E4F4B78A358D764511DA767CAA1B71DE8F03A8261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 7d8d721c99807f927bfd295faa66cbbd7f0a70dc0b520614a0e8bf8d2bd07cb6
MD5 63511d8e17c2e86b8c302139472b7d58
SHA1 5c025040436bf0eddb60cd688b3e993b1dddcb2d
SHA512 47ffa93ebaa27ae6e49f7c86753c17257ed69efb78c9d93ae04fafe0a4a58c1f93759e8d23804355551576c87b35d888970199ed05f173e2ff8b092cc9e2ea55
SSDEEP 12288:jXTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcY:jXTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1566523C727AA21F2FC8B07BA0D8945E4D1705EB27CF81597E698641F533B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 32dc373cba0321e2b24931ff760d271112004818ca47d423bf0838a69175956b
MD5 7e1caa9c18483eec701ae470457f1b31
SHA1 6318e5ceeed88a141f0c76feddc02a0d040b6fa0
SHA512 1341fb49090b16648b82b0ee0b39340db8239b0dffa51552577dd3b1a1f4e1a5972f302603a22773aedf47e16025b336175a8b65afa9f40fcd88dd65b7131c98
SSDEEP 12288:JxTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcy:JxTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T10B6523CB27AA21F2FC8B07FA0DC985A491705EB27CF81597E698641F533B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 6840dc25607cccecc1e9ba0c1a8064664685cc9cf8a92f8b78c06da57e0d845e
MD5 10ee4bae17a61f57ff9035149b7c8d7d
SHA1 8e662eb64b04217275be02b894b73c8f1a28197a
SHA512 cfc647e53f874c2961268e60edeec7a609baa7857cb5eae8523f782076063dd94a9a170388d5e129570dc8f58577d49bf426491eaa7497f3739fd36be4ac9764
SSDEEP 12288:0oTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcK:0oTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1396523CB37AA21F2FC8B07BA0D8945E4D1705EA27CF81597E698640F673B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 ad88e690732ac0592bd9e87a8524620bec161ac07590067c936d09503b3d0f7d
MD5 d57dc6b9944cf7252345301071fd8e44
SHA1 4709a163d38c2c49f415fca291cb9cda5502d12b
SHA512 8e9791e114efd2971486edbddaed121a070cb9060d3b437c6e811466fb47af74f4ea7da22d376d90434547feceaaa228d7a9f0001c496968e7b1f984f0d91550
SSDEEP 12288:UOTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcT:UOTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1FA6523CB37AA21F2FC8B07BA0D8945E4D1705EA27CF81597E698641F633B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 acbdadc1fd6928fa6f130f87cfc16f49e3d3cf3567a669b1e55326d8bab3c307
MD5 a16df3d4b23db51506a10b532c6d8fb3
SHA1 4b70b2aab54308567c68baae02093926773c372a
SHA512 d30cb9d0ca8b341d39d74d024177a30dc2ba5065ad60d398259a3e8d42f6ce18efc487177d007b0f72e668e2cd78661b2e4ba2cdc1394a0589a46115cae49fb2
SSDEEP 12288:hXTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcR:hXTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T11F6523CB27AA21F2FC8B07BA0D8945E4D1705EB27CF81597E698641F633B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 b9b73f84db72a3adbdc60987006ab79bd5f05ca2edb1ebe520d2d60c42e8e8c6
MD5 4bae0da798d322c5766f04f341c9b555
SHA1 16c3c10d40bc2ee350d73cd5587cf105cf42bf8b
SHA512 65239443134c9e63c6eb4ee40e77b1825aef4f764131757a75eec9e9cc849126d1a9cb117995693f36936009f8fdbe5146c4adc3a2919d269b910e22a5301f93
SSDEEP 12288:jGTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcF:jGTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1046523CB2BAA21F2FC8B07FA0DC945A491705EB27CF81597E698650F633B4D14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 0c8cc2beb1b627e77b3950e4ca21309d41cbbbd5f443be8447a8f25da5f61bbf
MD5 188abbffc455344195d1364053c429a2
SHA1 0f65709cadd231a968b6da8a88926fd82ccc9dc3
SHA512 bfea9308491f75cacbd10b7388b8a4cb36a53146642b5422a6e610a9301e7d85a4e265c75ee58b13387bf0b58035fee0efdd524e4d5fba1377476c835d464318
SSDEEP 12288:F0TduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWc/:F0TduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T17E6523CB27AA21F2FC8B07BA0D8945E4D1705EB27CF81597E698641F633B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 f7851afd449feb19825bf9e111f4cd19a1f16f312d8ceac38c3e65477ae56a7e
MD5 44667b1b3c096b78ef7dba2696d51a7c
SHA1 f251381bd41bd0f369caf9a576a21d0e00233757
SHA512 0b4b819a15d4377c0f1cc4572ee5851a113d987c83c3d9eae66612090f75338b2548c21689ac7cc3b5c1438adcd557dfbed4600d4b63c78563bda59e561e8abe
SSDEEP 24576:ifwvok9RX6wkyAI6TduSZpUR0GHrVQ1aW4mSOgv3isi:OMnYIGpAHrVQ1/fSNvi
TLSH
T1CC95D029EBDC04E1E1B7923C8DA7460AF2B178691B71C6CF1299536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 45572cf9ec49c748a1aa3d127965be77b32ae09c3ca2a3e025401fbe274a4648
MD5 9b9419bd8282b6206188f63e1599fba6
SHA1 1ba721ff6637ce25d975a77f1a50cb94256edfe0
SHA512 350e087392ba97b95d520aa791a17e7611db0f73d5ac3124ef848a7f9777cdc192893859d8b97c936015bed1f96fcfdc5cfa0b93be1835f904d0579469f94c06
SSDEEP 49152:HYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0lpAHrVQ1/fSNa:jySzP9pAhQ1CNvi
TLSH
T19F066C96A1A801D5C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6ed442c40012329f504f9569b61ca24b98682398604b6d4ca63cf1a9596f9f9d
MD5 2839d8ad55c8ccefe241641857d6cc76
SHA1 5c1a9c6a5c8c451c009f21bf321760ad8ec7752e
SHA512 2a229abc42c1bdd559921ddc0e921c580b06dd93f867451d8b0fd6264e07dbbca91244be1d2d3818e146d9725911e64c20913400edd26e0d61ef42969db56ed0
SSDEEP 24576:847Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYVTduSZpUR0GHrVQ1aW4mSOgv3isi:847JUQj1irIhCnDHUPfF/1pAHrVQ1/fn
TLSH
T13B65AE1EA3EC01E5E1BA827885554A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 a519ce8a84a4a7db059bd44dff598b3792a737a839360ab7accf83c0db6bbb2c
MD5 e6e4d579547bab70f9519bc619c8fee3
SHA1 4806cf8f2839786dad7d3ef79f6fd6bf0a40eb84
SHA512 551d444895a61bd4b4d97d069e14d78251f1b078d567fc820b37929727ee4e94df191b99e4190ad298c80298fd458828a6c9c0ce6a541ffe53208c987d894c35
SSDEEP 12288:ANsfeTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcR:heTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T12175F14AD29812E4D49E5279CB864A40F3337C619BF193CB52D0F53E1F3A6D09DEAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 d3e9968c20470b7b12ae7c39bd6594a087d6af888e20f73fc1581f4fe5b477f9
MD5 afe0ef3677d4582cdcdecdb6a57cd12a
SHA1 652b62c4d373375c36299b4945b5a6f60b0a72d7
SHA512 595dd9c806554ebcaa74f755190bebd3bd3285a5dbf94f63a8e7c0278bd5980b55ae137a755dfd9cad3e9db6f8d7dfa86246464d989a350a2f2874f6ad4b8a26
SSDEEP 12288:NvkWU3f2/lhAxqpOLQwxY5V1eTroKRp5Y+ton5:Nv3UPoMxqpOnxY5Tg0KR/YF
TLSH
T1FD3517017627D74FC6A940321E72D1CCAB707D45EE04AF0373C99B3F95B6658BAE2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 c318bb3b4a477759cc73fc7d98d49fd75441e03a558842657528aa9f27d92d25
MD5 4b34bf1817e21b9f56135ad7d3c0bdb7
SHA1 4a5bae64e52288a54e7b0e8c3401373a550148f3
SHA512 f396a01cfc9989b79f71ca1777a95b54851aef85f29d344b56918f1ccf9aaa48dec92070d39a9ab4ea2353ce2e8fd0e5d4f2a7d8d08011b2222163861a0e9f91
SSDEEP 6144:1miDe1V3Jgw3mhjmt/X2XZqWNgMuFkmYbdppnD9tMxgD9tMxjDD+t3jRg+s8zTxs:6JgymUt/Xup48hs
TLSH
T1D765E9415137E38FC1BB2072072A9B4C7BA4EC46B7496F26B3C84539D86AB15A0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 d7ac0e9194a5122eb4653989e5c4b95a561a430501bb4cd38d60bdd3c545dae7
MD5 9d438e12cf545e362a9e0bf25bb91796
SHA1 3df9e4577b9512549c405275ebaa21895e7c5ef0
SHA512 08191c41044f64065fc9638ea4539af0677eec9454d0e818bcd729d4c50ca680d9a56d81b0eec32b084ec8a1adf1909c52358d65ccb692d74a5d019c87e9262d
SSDEEP 12288:lF7WTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcr:TWTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1486523C727AD20F2FCAB07B90D8A8574A2356EB12FF414D3E658614F663A4D08C7F529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 560f698a77ad7e19be93ebdc34ce398e25f9ac5d05dc26efbd0eb6f703eb9543
MD5 0ee4e787a6f408a3c5ea9a36cfd3cffb
SHA1 1e73ac8eaa365d2723cfeb2a7d647a41dc1830ef
SHA512 15702e98cbc15b7388cf8c661ec9db7dd882cfbffcdb3e98c7886646844280eeb5679c4a926bfb9fdb4f705fbe2e930b156304b2e145f53f47792da19ad4abc5
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYwTduSZpUR0GHrVQ1aW4mSOgv3isi:Ngb4mBIBhGFjpAHrVQ1/fSNvi
TLSH
T14065AE1E22EC02F5E0FAD2B88DAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 385fcaae1531eddeca527d3d6e0aa0daeacf5627a2dac0aef1f913b6f53e5e47
MD5 39a3590b7db12578d749e93120885571
SHA1 bcd9dee3d1dd708fc8ccbbf6d95302be7f65b4cc
SHA512 1f34ca34ed54be96ec4ded36b69981b01fc09588d11ae41b687c2145b9a65912fa98a03903c26701516e2a5bd1e94c1a21a80fddb7e17537ce986139c0fc6814
SSDEEP 24576:lG88u8FpJqH1bzria7/mlTduSZpUR0GHrVQ1aW4mSOgv3isi:I7ZFPqVea7/opAHrVQ1/fSNvi
TLSH
T1C995F16577E101F0D47BD13889864663F6B2B8211374EBDF07A88A561F23AE14B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 e808fe243eae622aeca0f75c31d55ffd5c9c38c22a0d1f6a41c9ad7e2010d0f5
MD5 7d7607823327ee10fc2955b412e3a941
SHA1 ec1db3b811344dad3b401a51b7655e268ef9d88d
SHA512 e14b782b2f73d9050228d303c71f94d042d8bbfcd00711f54c7be105bfd9012311d822f5e3dae12c861a62f2073c21ba84d9f8a68f8ef3481da13f0b2a18cbe4
SSDEEP 24576:2PUr+NQZTduSZpUR0GHrVQ1aW4mSOgv3isi:2JQnpAHrVQ1/fSNvi
TLSH
T14C85E15F22ED18E5EA77917D89868619E3717862175192CF02E0817F4F37DE8AC3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 71cb8d76b655f242a0d6dd6d2ffb0e2d55f7d80bec2d668a051ad0bf89ffafb8
MD5 f139cc9a0184ce5b28c9ec9256b23a82
SHA1 a6f2e777a12ecb06079a481676b84c449b8b1822
SHA512 2ead678292e77d1c7ae8eda23d060ee0198e294f2d0f065cf7efd75db9a0dcaf61293fa94c0566139bf9868c547eea3bca87214a986efd738ffd8eb13b484a4a
SSDEEP 49152:DBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXpAHrVQ1/fSNvi:sG05lO43bOpAhQ1CNvi
TLSH
T18ED5BF6E62EC11F5D1BBC17CDAC64A0BEBB23825033556CB02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 01ef668dcfe62855749db6ae81508ccc5aeb52869eafdc819e88682dc9588e98
MD5 dde92ec87f92f1e0adf52432aaf1f801
SHA1 ca748ae9124ae7b45e77d4beae6364e212fe31cd
SHA512 1999d75387afe1597b3cbe1f11bc5f62aa137cd02deab18506e2a56e902f95a2919a30d0b01d5cb380fc92a4819159d8cb3e15e9f45b8fdd6bdad8c2b2108ae0
SSDEEP 24576:afa5POZ3dpFWVM50JicR2hG0lasx2+47eidnzTduSZpUR0GHrVQ1aW4mSOgv3isi:ya5POZ3+Jt2pasx2+mPpAHrVQ1/fSNvi
TLSH
T1CE65AF5EA7FC01D5E5B9D17DC583861AE5B1342253319BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 607a1799261702c281a1973cd3783f4a6573c587cd75548cbaec7e3ac5137ff7
MD5 798db12f0827e2237d454b02ddbf1f28
SHA1 7cfc855e1744d6ddfc4ac5595bde37e2dc295674
SHA512 3524097e2a4582a587705cb175d7d7cdae3efe0c1f85b5de801872b310492c8e0c774a8b846c4574637379f4a2afd45c55c84bd31b492743fcaea3cb7b501c8f
SSDEEP 24576:ZNcwHdjbyQ4nLC18lb/EOjowL7FkNTduSZpUR0GHrVQ1aW4mSOgv3isi:ZNc/zEOVHFIpAHrVQ1/fSNvi
TLSH
T14E858B1623E901E4F5BBE1BE89679546FAB1786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cd484392013ea4bd7b65e2307a15ba1c9298d68ac76e4624ed23ef171268f256
MD5 b777fdb562830b1dae29fd762ca7f587
SHA1 2be55761c4fc0246df1adf2eaab7a767a9c2a896
SHA512 0bbb7cde15919f4237a262b3b4513d15b538afd4570caddaea054fdc0529a47661d5eab9eab894186ef3d4936bc5022f8f19e3b46a6743c698a8b3e9a8488e20
SSDEEP 24576:w8kNvNnaFeYhJNtmZBm/TduSZpUR0GHrVQ1aW4mSOgv3isi:w8MwBtOmBpAHrVQ1/fSNvi
TLSH
T1B655AF6E76F806E4E1FEC6B58D238512E6727861173253CB9290C13F0E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 7bbd6b93ed2749c8cfc2b8eeb39fdae981d760c5edb0797ccc2abfc3bd83484a
MD5 cf09e8d75dac2d662047fc58c16c1e42
SHA1 2e31b3e63143a7efcd66aa996acc4e7df04c784a
SHA512 4781f1d137a3674e8d8faab2e379a4830a9da8f4e92e2f517262b7d9063f983a79a60550a231741824db78bd44a2622f533cda12092f17c5a7b5306c452089f8
SSDEEP 24576:SD3FHshBIYQgAiTduSZpUR0GHrVQ1aW4mSOgv3isi:SDVHeBIAAepAHrVQ1/fSNvi
TLSH
T1A395E17EE79C00E4E57BC2BC8A538906E37138A9077155DB029481BA5F2BEE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1096-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1096-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1096-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1444-252-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1444-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1444-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1444-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1444-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1724-120-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/1724-58-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1724-52-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2448-115-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/2448-73-0x0000000000B10000-0x0000000000B77000-memory.dmp

Download

memory/2448-78-0x0000000000B10000-0x0000000000B77000-memory.dmp

Download

memory/2768-1-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/2768-8-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/2768-7-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/2768-0-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/2768-139-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/3176-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3176-123-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3176-134-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3176-129-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3176-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3308-113-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/3308-106-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/3308-307-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/3308-118-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/4556-99-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4556-117-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4556-93-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4556-308-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4556-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4588-69-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4588-110-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/4588-63-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4648-88-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4648-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4648-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4648-116-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4648-82-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4648-323-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4708-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4708-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4708-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4708-195-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4708-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5156-45-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/5156-49-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/5156-39-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/5156-105-0x0000000140000000-0x0000000140294000-memory.dmp

Download