183caaec17b302ef391db362a269a319af04ae4b3af3d74bee739f6168adc8a2

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.2MB
Sample260819-yt22easdnd
SHA256 183caaec17b302ef391db362a269a319af04ae4b3af3d74bee739f6168adc8a2
MD5 41a45d47ba128520743e0e488da02180
SHA1 29b371451985fdcc4f0015aa45af289de15edcbf
SHA512 34f48edc7f42445b8e482112726f33009d756d47268d96233a284027a30fae500d20bf082cee5b90e51dcadf9fdbae35c4154b5a949a4b0d4960161ed3bc7d6d
SSDEEP 24576:jh01rHVGAxUqVpHi/oSsqjnhMgeiCl7G0nehbGZpbD:jinGAHVpHFWDmg27RnWGj
TLSH
T19345D056B3D402F9D077D17ACA568A65FBB3B8064730A7CB03E446962F276E04B3E316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1000	elevation_service.exe
3672	elevation_service.exe
1712	maintenanceservice.exe
2816	OSE.EXE
3100	PerceptionSimulationService.exe
5456	perfhost.exe
4480	ReFsDedupSvc.exe
1444	SensorDataService.exe
5408	ssh-agent.exe
3484	AgentService.exe
2028	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3269863ce62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 38 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a105a4231630dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000002d0574251630dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000316354701630dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bcb03c271630dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f30af3231630dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063726e251630dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e7f49701630dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
1000	elevation_service.exe
1000	elevation_service.exe
1000	elevation_service.exe
1000	elevation_service.exe
1000	elevation_service.exe
1000	elevation_service.exe
1000	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	3484	AgentService.exe
Token: 33	2028	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2028	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2028	SearchIndexer.exe
Token: SeBackupPrivilege	4480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4480	ReFsDedupSvc.exe
Token: SeDebugPrivilege	6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	6076	2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	1000	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 5324	2028	SearchIndexer.exe	102
PID 2028 wrote to memory of 1092	2028	SearchIndexer.exe	103
PID 2028 wrote to memory of 5336	2028	SearchIndexer.exe	104
PID 2028 wrote to memory of 4624	2028	SearchIndexer.exe	105
PID 2028 wrote to memory of 2544	2028	SearchIndexer.exe	107
PID 2028 wrote to memory of 4208	2028	SearchIndexer.exe	108
PID 2028 wrote to memory of 1992	2028	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3672

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1712

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2816

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3100

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5456

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1444

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5408

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5324
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2812 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5336
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4624
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2812 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ced714d2eb0f572628c756c5cd4ebc5ebf7d7310a6b73f70cd85b41180557a59
MD5 490d28ad5ac403a7319b19f1e357d84f
SHA1 7a01505a5fd7484a673d5937f61e2e8c5c560bd4
SHA512 5704376c1f68c08b935ac09582a9fe52a0f8c02304e3bd62054438c059b5b30debc36f8f0a85b3a9732cd593ebf79dd1af94008baab5cdfb6ef10da375117917
SSDEEP 49152:Ub+632BuPkFKRrdE6ohvstBhuXjfS4LWxnZDmg27RnWGj:O3q6sjBuD527BWG
TLSH
T1DFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 8472469220a1e47736c10e3e159dda97699e008605905a4d53f998a2ca7ed47f
MD5 6527fd7955bb99173f8838c46988d712
SHA1 f4dce09d6d1fbf1e8c21e549af26ba22188b4fba
SHA512 23041679a4ca52177ec08abf8ddeb46d83c45aed29f62ca0afa911f921ac39ad1a7d03373187abbfbc1f191ebf5a5656efd81cdc2bbf0e467343aca170e50b14
SSDEEP 24576:zXYfDtczAusqjnhMgeiCl7G0nehbGZpbD:Wtc3Dmg27RnWGj
TLSH
T151650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 59665ae9b6df4468cbf8c8e8a5a4e9a6e946a3a4d15ff33ac8029a6fda719986
MD5 dbdbfb71f7a3044f75e4ed9ccab4c3bb
SHA1 f1fe8ac0c6c1cfb79bd5f3aa48731615836d3169
SHA512 0ac2f20c74101d1c9c631012880731b4d8a6b557faa22c6b9ee6b1f63e5d86ac5502d9962282e94fc4da98f306720290459d471d6dd9748130f4f19459d70ed0
SSDEEP 24576:J0Le5ji0hmxxrMtsqjnhMgeiCl7G0nehbGZpbD:JPji0AjEDmg27RnWGj
TLSH
T144859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 67581c97c725ee6fb83049d46585142eb35e0cfbc4e51b770e385478d749501c
MD5 43cf48715ad0ef1fcc78333c93da1865
SHA1 428dc6d4a5624391d38f36d13f61611a1003dc25
SHA512 3ee411894fd29451e3487a06a18a876b1563ab425e18c7536beaa6781a139aaa8ea2580dfcce6ca3756a8bb4ca32b2dd2ace383e54765426a200ffe118016d76
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWn6q8wyujsqjnhMgeiCl7G0nehbGZpbD:N/ezSC6vUzPveHjyYDmg27RnWGj
TLSH
T1BC755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b1cda23497ca0acc25d544bf3c266161d83f3d749ed9d0484314acddcbe58a2f
MD5 3e7ce930f36a147e8bf8b831fb82cdbe
SHA1 86880a61eadfa3019925ed20476b1ccfce2141c0
SHA512 a5052dd5d2002a94c870ced185ab490e353561f8819084daa37549ea14ee62224fec14c62b127a4003acd034f6f4411928d862419b82ded37b28c304f0a5ee26
SSDEEP 24576:tVbqPb88hv/l+YKsqjnhMgeiCl7G0nehbGZpbD:tVO88hXl+PDmg27RnWGj
TLSH
T1D3559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1cfc6b30a6671b47bac315f1f7421d5fee1d230b5b694ae643417845d34ed2e0
MD5 ed5ea1438f0692c7f717225d04195521
SHA1 9b274563d8fa0a5d7cd07e7af806e22e9ebf2797
SHA512 3c257fb4f9dd16a8707d13f22ead3db51f4abc2794b743f408bb97bd5559fb552babb1b45e98f26f011dd04c51d4d347c86fc85a0e6ed0f8dd85b3b14c5ada27
SSDEEP 12288:WL5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WL5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1764523BF974C50CAEA7608B5C3E9F11EAC137E5698200853AA637DFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 0a8cfdc2031c9c1c589e033a1ab80ce7301aebf82cfb6f826f14e12e90f94678
MD5 859e69d341cc80bec6c6f5a46c7e56d4
SHA1 f1d34d63a6d1f172f76812ec4cf0306e27408006
SHA512 1776cccc2a436c2d19bdd9dfb6d27ea83a3f10d6358f14feed1e66e1ea617cc815d87ea84d009b649cd47816b4977f137444a9119d209550c31d3e743be9d079
SSDEEP 12288:leBNUbTVO86USXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:lJIUSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15365CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 73bed39855934739771eee0bf0653e099356abf6cb6887c36b06c56ea808e3bd
MD5 09c6173e4d574494861cb5df94b9e553
SHA1 3d5c91db3f59c2490c00b6935eb793fff73a7a30
SHA512 db7d29fee06ea6e8e9e7056d970db2d75a3927a218a392b814b1ff69ddcbdb54af09366f529023a03346056d68d4b9c85dd3d65683d0256cc4c5caa0635dda7d
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THl:jQvGAdlCEL8c/DRNw5CXD527BWG
TLSH
T116266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 683cecf62484ec34a107fa3c0c2460e3025f81c5f323722c572225cb6d9bbd01
MD5 2e34d9499be844fc4eeed24dd664d5df
SHA1 b4792a317e8429f8e13d5e0acadf4798672eec76
SHA512 1b71b4f25e5328bf29a511a81f25d823a18af54e9b0ce6311493727a87b0f82a0156f042b189bbd9059f9644b34d4d68e4aaaaebb2f43758b32cd8624f6a8dd0
SSDEEP 12288:pAwSfxL/2Dc3RDLLmt0LDQewsAjIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:a0ewsAjIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16475E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 75884fa46586af9e044bd590f0ca3cf8058ec757ea46f966e1dfe77393c0984e
MD5 e7e976257a40844dfd714e81f10fe72f
SHA1 57225288d2f27d97163da384ee1a84fcc24c311f
SHA512 a49e782de9c07c5a8e9e33325a4bfc3d214fcc03fcb232b80a98a29d3cb14d78295634fdf6be49db0a58ba79fde2daf35373136685b007f0c1e937b1c80c57e3
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHcVQBWG:uUEtQevvqc2W1cpV2tI32jB
TLSH
T10D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 85aad888c064f16b7886b7f191a25420067e0461710fa063774048e92deb7c17
MD5 ffd6df8e5da8ef332520e9abf6a18caa
SHA1 a7a726aabc96c4843bbd81338cd1cf3a81541de3
SHA512 c41e5fbda4149527b1afeef9a4e3bcf44ce320c0d20767364e5409a75e950b835dde952734cb7322716aa8575b50ef14d1d78f5a501d05edf0b0064e0a7e268c
SSDEEP 49152:4CbRquA/m2yL5zTfFiV+XenmE3/zUDmg27RnWGj:xoquVjnmLD527BWG
TLSH
T146D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 35127662c9146709cf7bbd2d8ee102a64a17d388cff7170c75c0273be71b246a
MD5 73bbc60766a6ec779e5190082a0decd9
SHA1 30dd2d45f27b68136e4b2074c418c4f5aa664df4
SHA512 ebe00cbb77fa8678fc4bc2176bc41f7e4661c11319ac11398258f898988cd5b7d767a1f83adf27dec7432234811675629ceed7d19d19bd912c6121904a792017
SSDEEP 24576:GAhGL3IFoiwtA5l7S53XsqjnhMgeiCl7G0nehbGZpbD:GAMUFoiq57Dmg27RnWGj
TLSH
T1AC359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 57f0a6ff43956ed51ce8b42c4b7e7eaeef90b4ce45b69bdc7ee7f9094a626549
MD5 83b2ee7092246e1282d1b89049212c26
SHA1 9612e62215b6f0ea18a11bb7f5063516bec810d4
SHA512 c58faeabf15b12fac42fdf9d42ff57f51b068b1ee9024fe4fc571e0c1853d2b11946e7edd69063788420b5956a1c87245177709559eb261ea01b0ac89b927b24
SSDEEP 12288:Dmw5HEjsChNVBFgl0WDm+CDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Cwu4OWMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E165F15A76A81CF9E9674139C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 588bb755cccc31f8d571df39c18e44576ede1c7ace1c7ff43145090040770af0
MD5 cee22dcd8d3be76cb0a53c7e63de56d3
SHA1 6701bb9c5bb222a31e212c23cf6a25aa94346e97
SHA512 c3a4c15c25762482063016d7ba4c24bc5b25ae9cf6761fc70c44778ed3d15dc1cd8178d6140da8eb1603d268b4c669da95867a7cd7e03f0c8278b58f1288b5d6
SSDEEP 12288:ieZ1Iy4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vZuVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E55512AA239820FAE163417CC5E5D609E7337C62673043CF16665AAA6F739C44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 160cc3d49ecdd92a30a88bd904aa5f87ea6c1051f0cf54c97ff53314483f9ea9
MD5 ecbbbd4eccd209e369b9e12ca0266476
SHA1 87005775b485fe2114097e1d824cae6b5e40672a
SHA512 959d621e32f6a0005ae0167f1e774c18b699e934db1f27d8d9d2c33bd4cf51a288a77c6b88060ee55cc87162ea4091cc9071bf4b72ce4b26e59f51f1972a274e
SSDEEP 98304:xQRQyi36YOcPbLvw2gAf+PN36D527BWG:oQyiKa/X+PNKVQBWG
TLSH
T13B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1565af3797ff9b5a69f503eda46bebfb00a57077049d1fbfbf379dea0c8f8a31
MD5 677fe99eeb4b13052bb2517709afa17d
SHA1 a669cd827fe9f445c3bf1f3e1a974cbb7d0117a1
SHA512 7fcb54c07d1d75516f356c71e6d178bd68723ce0741925a0c5ec29af8cd1e3956ba1e2aad6c5b30ccd9287955b245b255f90d4ba8084106793bcb29f4c3bf0ce
SSDEEP 98304:AQRQyi36YOcPbLvw2gAf+PN36D527BWG:XQyiKa/X+PNKVQBWG
TLSH
T144667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d9e65e956095814351a7b0177d6de77d4f8397a820fb90b5ddece7676b59b205
MD5 1860022c128bf2da7d7abf3979084a23
SHA1 ad014532a42295be1e66e7fb718ac9fea408118d
SHA512 b20cff6112f74f878feefb41d2101c815251f8cba34d5182585ea18f1bdfca7101e8ca748b37c13a1c87ff5a6a142ccbf310849bc25e6505141d708777b8681a
SSDEEP 24576:6wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0lsqjnhMgeiCl7Ge:068Qg55nhceWu7PNU3/EDmg27RnWGj
TLSH
T12AB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 eb30d796c8f4f11d8bc2e4f9a90cb8cceaf081ab15ba817a698597aa0906f17f
MD5 8dcba2b940a6d4cf7324bf066bc4d8f1
SHA1 78636bf0fd7f473b1fbf8ee4dd616b219f4d6cce
SHA512 e5a8bca2a277f9d218b0331642d9e50f26e3bb3041cfe63e559e472c411dd9b9031dba11de16b9c1e9b1da91d502a90954273919c2d9c9ae2ee5653c944dbda6
SSDEEP 98304:Dy5112gYy5azzVvt69nLKnhZ9D527BWG:eLIHEWhzVQBWG
TLSH
T122167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b041507087e792f2f657a9a3d9acecd0ff1360e2b5765adabdb87ad7400b41eb
MD5 bfba9bfbdbd34f748ae09bef6719f03b
SHA1 85d607298aba356c233ad35651868df5db019515
SHA512 fe6435f804ae829ca8ea07f8173920fb3c9abf9ffe39b494a84e5304a0c43af6e3c423f65cbcf769c4cdf630cf53e9698d0b701183509dad829a9da8d3d1db95
SSDEEP 49152:kB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glSDmg27RnWGj:+u6Jmdxd2dSD527BWG
TLSH
T1B0D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b447ad10922ef862dc35142ab37b6ac68d899636ac83893b893f0d58a3973ace
MD5 621dc16d99fca2a01d5c6edf7b5cf823
SHA1 6ee10ce872e1e795c6acef8cfde7e9011d40f6b1
SHA512 320d41ac61213f44046fb9177843e1f53b9ef51308bc338dbe51df54d120f4cc5e1f758e5ac25098d46f9919e0606de45046267087172a2481ed72a726f189b9
SSDEEP 49152:A1hpsNoJpF1A63U44CwH7R4x2Dmg27RnWGj:AmifPWRLD527BWG
TLSH
T1CCB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 80f2718b238eb8a1d41414dad895d06ef14918a5e276eb45efcb5c31c59cb5a9
MD5 5e423685be2851bca58b258980cb6af3
SHA1 9e34fb18a1418acb7fbc090d4bac927cf9f900a6
SHA512 44750bde49e6a6b629746ae3b0c1511eec1f7c670a7843b15ce4f9cd95386e2fc111889c90d880f8220637406ed5247338bd1e09651aa46fefa63c5f110a7f79
SSDEEP 49152:cSuZQIY0Be2KcRVtOnks6NMHqJDmg27RnWGj:e5dKii61JD527BWG
TLSH
T153C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d03e64d0d1251445c826aee8e5f866cfed837d0b940f1a788285318876d298c4
MD5 473fc6dd401ced68c9c868d112ee4bf7
SHA1 381e18ecab32b6f8c7308d7d720f589c21765ebf
SHA512 72c29cd7fc7ec092c71c165748e243b3d6e1cd25d52bef8794c9c6bd5e33b560a435e394277f7fe54e579581401b42d980a88c433b046fb057870058ca6e9deb
SSDEEP 49152:7htSn8EApI0fig3giDn0AP5wCDmg27RnWGj:aX2imph/D527BWG
TLSH
T18E95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 19f4ee98428c9586be621af08f6f676ce5b458ec9ea4211a997f33702d37f8bc
MD5 3ecc7398379a8d08e0a259ec8b1b0981
SHA1 78923eac0454c2423f10b000e8924cbca54e6989
SHA512 c5aeebae8bf45a771ae3660bc99af95fa95397bead6de1ded1479ebe0db5b8a19c381dbb8c6f42ed647a2eff03db2facc2101dfc4dd1645d85e9ae45826bd23e
SSDEEP 12288:GhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19C4523BE964C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CBEF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4a7af12a73c63290cd2bd5a5964a610d0fc661448d57cd63eb6dadb859670188
MD5 d89688856a6122a30cb7766d30218710
SHA1 dadf5496b22f38a319ce1cc746c24eb9d8ac5f38
SHA512 15653bec559eb3f658eb3006d77d51a843aeaaf4950b23654d00ac2aa4d4f5f49da6a20d9d975c1463cf38ea05ff19bfa68abf002db1fbf2b5433244b5d78387
SSDEEP 12288:HEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F04523BE964C41CBE52644B5C3E9F14DAC073E5BE9200493BA9B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0fb3f99669865e31afd0c95ec8fc2e776fc1ad6421ccff1c2375aebfc82692d4
MD5 a1518b0c1d4282880c97130b081b2b4e
SHA1 44ae78fee110fa8a2c0d2868f659c230310b43a4
SHA512 a92427b0c672232eb192aafb9f258c553521e09966cea361535aaec7ea4a4ece289e3fdaa4afe2cab80132663c060736fc84e66a9a6b3c59817cb306eaa2c405
SSDEEP 12288:NaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NasqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D4523BE964C41CBE52648B5C3E5F14DAC073E5BE9200493BA9B7CBDFAB14584B38463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 aa41033f81f5f6f1cb6029c93d67503172339ec16f5edf01ba49ea27d566f942
MD5 be560d7d15fe232f23407c9a87dd3be6
SHA1 19389176c8563ff72d433126159a5281773f788b
SHA512 e9ee5b082d5bc1d5167fde32325bd195c0e2380e3ea6c542dac9aac831786d5ed1d999b8354d5554e5b25bf444b7d15e9df4e5a078da9dc41128731e78bd9750
SSDEEP 12288:uV3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11345237F575C00CAD83685B4C2F5E11DE8237D56EB3005DB6B522CAEAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 31ca24fcd21ab603f469e64e8f209c4f92da42d205659879ea2ab508b81631fd
MD5 35884586f01e3b39d85ea6e4967a4225
SHA1 d484082392a823d2f740958b165150face85364f
SHA512 22ca5eec56c2172103daa171895fdcf6cb2270119ed7639e6fc47fdc8605fee900d6d2b18236a672529ea76a49409f38013fe9bfa4db32fdfd912e9a4c9de050
SSDEEP 12288:yvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1984523BE964C41CBE52644B5C3E9F14DAC073E5BE9200493BA9B7CBDFBB14584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 57e45ec3286511a5cd32b920725d601de02fe9d442b375607eaeee1c6273f798
MD5 d48f8092a967d013dff1410749c52947
SHA1 895d66919c7a56f9b78b7997fef3be24fc26e55f
SHA512 fcd0bef5e30fc56197f3a6ad8b732451185b476fcf5d60c8492b0c988aa513e25d415a8f532a8b789a38b9910fb194d635e8178f60d93631cdc365e8bb15c62b
SSDEEP 12288:sQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C64523BE964C41CBE62648B5C3E5F14DAC073E5BE92004937A9B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 bdb0f54d0123291b929bf9db44f37e05039d78a41533d47138fa3d6f66549e84
MD5 725ddafd017934d043ac337883cffb97
SHA1 d35c922a6f791b52146bca88dc76dc6be777b55d
SHA512 fee834c2a3b7e53dc1feb0c6cba602be3f8f22402384b15a79a988e20eda1cfa831e7786a7ae608fb4208b0153358f6e3d79854e0f4f71999747d1c4d5a4d7f4
SSDEEP 12288:ccXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ccsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1054523BE964C41CBE62644B5C3E5F14DAC073E5BE9200493BA5B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d09a70c09ea6449eacf59958de189658dee3727a270b9266672bf939156aca09
MD5 5289421f274572687e11c52d17f7b440
SHA1 f2c956b154e91628e87be3e2f3a9f0d7e733859f
SHA512 abd6e848d042291d56b09887434a666ac94bba237ce2196c209aa679fab23d2b804e82026864b68dd894770366e629c1579cc2fe43ce54423983b121becc8938
SSDEEP 24576:hZMRzFVSOksqjnhMgeiCl7G0nehbGZpbD:hZMRzf8Dmg27RnWGj
TLSH
T19C6501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 805da529a730e4c5535b6e78c27cc34d2437b2af7afe2d1cc4fdeeb7ffd3f5c6
MD5 a7f1a5c0bc1c7a3f661b0de776a0f25d
SHA1 1805b50830d083123f6f0cccea166cb62230190d
SHA512 d8aded92ba2b5ddfc7310a809454c8354a838540bb0e73312f2c041ceba6e26626eea70d44f9c73b9599dd58e759fd9a83f365aa2bd9fd68e149f102ac921b33
SSDEEP 12288:cFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1294523BF964C51CAE52604B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 533614b0b315a1592074992d39a217fee40c169cadbd330c5f8e8a4cea105fe5
MD5 3fd5573bc562cd585952707d388d9508
SHA1 8b2ab6dcd3434606888c74c85d87c4786a82e2b9
SHA512 34cabe097bf6dc090c537bf825c7e603d728254884f437d3c1c6209f51ee8bf51d01fda9da7441b9c4d5eebafbdad65b51206326a81839cbcef27d815bb84e17
SSDEEP 12288:ApXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ApsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1004523BF964C41CAE62644B5C3E5E14DAC073E5BE9200493BA5B7CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4616ea81d1b070e46a635a593f0dba87f8b40043b5dc9372b0515c3d8bbb6558
MD5 2d2eb8168a1d67f476d927c9e1493d01
SHA1 37275b4fd34a11be758866cd9b3011374e233b3f
SHA512 836721ff0133c94950566fca2653b72d80c84b5533393e39185fe39df078b45cc10db190574e4b6e326465f6abfd16fa20c5e52b9bb62c113444192e4f2a96ec
SSDEEP 12288:3yPz5L84Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6zy4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C955025B73A530F9D1368178C5A29A06F7327C3647204AAF17A416BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5c0a6f17af2bd463c04b0fb95707e7fcf820e1dc07aa6bee9330cb9db4fc387d
MD5 2198e24dea6a1d8bd51b59e74c2b0f71
SHA1 73d2b0e5fa6610ced701eeb908ea6a7fc4154ad9
SHA512 6080a293ce006ee3b67c616f22806664a38ab9e9a0bf088e81dfa67d26987f6afd4b1a728a4473836670909fb6f8009db1728207da00df1a60c76d50b83743ef
SSDEEP 12288:KFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1014523BF964C51CAE62644B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 221361781255bb99c1e637cefa8f8d8a70da03cf5aae0f4c11ca6d93fb45c609
MD5 a7d70ce61b03358239412e53b3f8eba3
SHA1 711187bd9e92a1527d9f242e28b8a163623d55a3
SHA512 113b546b2238842991f87109abb849b5a17843cd832e647b80e087a4c57d9895134d52a3afa6716659cc097e71da197048bf60d690323a4aa07dbdcdec6b9144
SSDEEP 12288:PFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B4523BF964C51CAE52604B5C3E9F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 5bab52c08bea733a4761dfeef68133ad7a4b742c6ae090b7b36a246d959d8809
MD5 74351d435eee23413a1a210d5c62f4a3
SHA1 650087350eba4a1f96776b9a75e88b0a52273e4a
SHA512 8a7613da113b74701f96047cab3eb86bba2ea7d07ff9f4c259a1e2aa4ff0e6485818b561996ac8946f17aaa431cb94a14aac47792d15def8ff5560baaa2fcd42
SSDEEP 12288:SyPz5L84Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Pzy4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E55025B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 6c8920cfc9228cfaa46b8b5db8c81c33dcee7a942d291f1c899a5125822fbfcb
MD5 8dd4da017079f2eef94ce45149f5ab4e
SHA1 d42423a863aad93128a7847ec323053da437cd89
SHA512 8a9a89caf180f263ae47c0416432a00802eb3ff5fab05a22ac832f16232512093df0a08a21edc50571803dde56759522d707f745c6417e8cff3e6022692264c3
SSDEEP 24576:1TDaLl3z0zDqsqjnhMgeiCl7G0nehbGZpbD:1TuLljnDmg27RnWGj
TLSH
T1066501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 9f2e2f14fc4eb30b241e7696b6606150e31d77f347900f6d412049be58a55e05
MD5 3d646bcafff571183e16d254136abba5
SHA1 d8d1af7be29ef81c40a99e461b2212427e9c13be
SHA512 5bc1ae1f1240bdcd935bebf64b59c7acff9063e68eb1e72c29379cf2ba9462ca3d8ec013b5108ce5cd1e8959a31cb405d6c4c590deb9e7c53997086d4776c360
SSDEEP 24576:E3vd9CHKy7GZWsqjnhMgeiCl7G0nehbGZpbD:Ovd9CHKya8Dmg27RnWGj
TLSH
T17175CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8afb9e2f1db9a340e779f8600fadd17b42b41f36ccf550d72f60c381dd7f2c6e
MD5 fd4470c2083b187ee0390f0f7667b22a
SHA1 37d94aa45740ee642bcfbe0382b5e4c4d44a5eac
SHA512 7ed750b537563c9811b69f49c1e8f67e12ca81e55f231f6ee32bc6db01253ee1d940bc5026f565bd45719c689539427c292e180a2f1dc5b130877a668e89b895
SSDEEP 12288:l6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:l6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC4523BE964C41CBE52648B5C3E9F14DAC073E5BE9200493BA9B7CBDF7B14584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c5f00c73f78f65932a424bbc79ae2b76a432f33487ced60aafafd5fc1386eece
MD5 d17ee2646ee4321b7df9c498ecc92c3d
SHA1 e679cda42246854894018fb01b499fda38793592
SHA512 7b5ddd1ed3c469545ef983e98c7f2cab3ac3afc6bc976fa173606ca1756b195e7281f7c2af19a0a853bfe4cef6daf8e1afb71c9895639b74b5a082db1b84db94
SSDEEP 12288:BYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C54523BE965C41CBE52644F5C3E9E14DAC073E5BE9200493BA9B7CBEE7B14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 eaca4ef6d79a14424cdea53709964ab6b2a2b7cd92d6d31f6b003c81180d217d
MD5 1032a0d89b6fd945ca29cb652e6374f2
SHA1 b04781d526e8aa440cabb8af9e6cd9f1ae7eebd8
SHA512 f5563bf74b86712703669e9518d9f375f7173de97f8edd86c50ca10555c946c5d6d231e48374fa6610c0df4b370e3b31e236285d671a4ba0ee317f43f4ed4ada
SSDEEP 12288:c7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:c7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1774523BF964C51CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDFAB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b1fe62c1d5defde32f1452e776adae599c453b30129de6dfe3eb5d1a6a712552
MD5 8ada0f7e37eecdac9b6544be132b03c5
SHA1 57e04022b80d6f0e926af7f081def00d4e0508b2
SHA512 b3daa6e377850f5691b1ea767ee03ca29e90ead471516c91f8841a01a655eb1e6d514e142d4642c3dbe23019dfdebd0190578d6f8719ab7594a808a608246ccc
SSDEEP 12288:gFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1934523BF964C51CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 d5c539dd8d3eb037975e7deeb7dbc77d563928f061e0d3e2acaa0205e0ee1156
MD5 a20d7c7ab0c70e554c34f15a5572c1cc
SHA1 77843314f9b0a507ae0e13e74257654eb80a0dc5
SHA512 2cbeb78c0118730813895a7c293383447a8584e6f1d87aead1b19b65a3fa34156c62acd8cd752cfaa122f518fa848347b4247e9228a5362716f56f68c4165472
SSDEEP 12288:t6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:t6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E64523BE964C41CBE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8aec22d4022a1d5ffba4ba4d92fd2a51afb506ec783f3c49d057bbf0b90e970a
MD5 7cb63f425a6ed91102e245856e060757
SHA1 a8231e8001ca3bd960ce836ca2eff19913c51970
SHA512 fdf7a88218febbffb85eac04855bcc534e80e467b9d8fcd336e9a6882ab7f17c7918839589f56471ee7b6d1bb097c4d6f9c1c82c35284903f2bfcd8fba786fcb
SSDEEP 12288:G9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:G9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1584523BE964C41CAE52644F5C3E5E14DAC073E5BE9200493BA9B7CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e9003def27d114b5f5e3626bf9d2f53ecbf254b0193c31785ced37904974e625
MD5 8b6679467db0beea51df8cdf36fe2a17
SHA1 3d86a219e226b6f6d3f2087c7b0c1cb8872ae005
SHA512 23d33712acebf552c736dafa235222dfa72be5a20ce8b28b819136cc248e14b33894759da34f72b4a477aefddbc09ec43881400bfc47883c4a21d9b9f7f6abbc
SSDEEP 12288:lvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEN:lvsqjnhMgeiCl7G0nehbGZpbD7
TLSH
T10D4523BE964C41CBE52648B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 28645b2b03490857197ccaead2a7d032eff8c11e7c768d165b792abe7c5931bd
MD5 9c7b09ec1071dfe491c504345af6de9d
SHA1 178273fbeaddcc5aaedde8c1c0cdfce1111b8fbd
SHA512 2044759d063b7fbefc82cb1f2e5d2b7052afb171208515c74e709142b13a529872dfa7cf0dce29edcc2550d226307090a136ebfb3a71e8a4b0ce9036e4805b22
SSDEEP 24576:VfwvUk9RX6wkyAIZsqjnhMgeiCl7G0nehbGZpbD:nMnYIdDmg27RnWGj
TLSH
T15185D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9ca483dde84371feaf3509fff7eb12c87b5630e49928f81a1d7cb8dcb3cde004
MD5 ffdfc96d55becfbcee3c7d7337bac501
SHA1 4dffb22afb6129a09cf1286e2e7aa25a7d275abf
SHA512 3e91508404a5475cbc6697af05add056c47588bd32c88e31f2cfb7b19f8d3791f02e013af8b106951402b051f73009eb44e5296b103d37e761c0c2f0d31fa619
SSDEEP 49152:iYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0iDmg27RnWGj:5ySzPaD527BWG
TLSH
T190066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8cc5bab1e23e043ba5b3deb98c53702cbb0a3024263ae6543fbefe363d741eca
MD5 0d80001d68d0673da616a76ccd39eadd
SHA1 2bff4585a7b2e09853d3f2656e6aebbd46c8e3a5
SHA512 371d5487ff54991d002d14f6b8f8d1fb33159eb4cb6205f8a0d913a5e62d28af080204017c50709bebc2361890b21c7023f71da87227a854d5db7b9bf9fc7faf
SSDEEP 24576:u47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYUsqjnhMgeiCl7G0nehbGZpbD:u47JUQjTirIhCnDHUPfF/SDmg27RnWGj
TLSH
T1F165AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 dd8037d32217f88310214ccc019112baa2aee188a3352272eaaf578580cb6c06
MD5 388b06fe3fef0572854962e00d081b5e
SHA1 afe311d4485429666e6fd0df11b2050f79beaeb6
SHA512 810daeddb0eeaa9ccb8bad6b95292808247d1ba1dbf5115331f72525658d599a54baf7781752f9364baec0de187bd67d79cd755a36c72f32ca97f7fff138fd65
SSDEEP 12288:fbsfVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18155011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 749b4f4b2cae6c437bd9e200d280806bdfa402b2c32cd56d18042c6ebbdd919c
MD5 bc2fdf772bf47f5d3b9941a716888784
SHA1 593c84adf4ea1cda6a383ec69ab4442bd4d422bb
SHA512 5ada70ff7de5ba2d1d8061a1c7583b24a1781c8d3307c3f011d0f509be6a4ebeee71d15fe078dcebe45fbd91c2837d62753f62a19dd5042a3e10feba0f9912b1
SSDEEP 12288:n07NXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10845237B934C518AF93605B482E9E12D680B7E669F1044C3BA4778FDF6B18D88F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 817120d0d067395919b6fcb8cf8262d4172042af0f1d153c27a7c461f527365d
MD5 198ad19f2f9993a097fadae3418c3021
SHA1 f80621a4a35e65f6069dfae015218012fabb8118
SHA512 d03b75ff62f2590efd2083cf436ce0bc5fe79dbbc5b235433b4e7942626686b7f3e57795e4c0d983ec10c8632689d92fd3bcf731061c106c75ce6aaab4b73664
SSDEEP 24576:Pgb6bmBIi49WNNFpg1rSvFv7bYjsqjnhMgeiCl7G0nehbGZpbD:Pgb4mBIBhGFwDmg27RnWGj
TLSH
T136659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 ee8924720b7d9af997001f7b36de622ecda1d84ad46d2fa3ce9ffb3b31cbe168
MD5 49ef9cf627d50caf2231b750a483c6e4
SHA1 7960f20a3fbc28afb15c2b9e493739d3324c9c89
SHA512 af0c93c88d9b0dd75af57cb94950402cd7c8badb1e2b11978e4da090c3fef2fb791a21b489843b577441c2a6a1192846d1905fac72478472b3f5cc8201e28d1e
SSDEEP 24576:GG88u8FpJqH1bzria7/mksqjnhMgeiCl7G0nehbGZpbD:N7ZFPqVea7/PDmg27RnWGj
TLSH
T13D85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 eebc44c238819de17f566270a686db99f6f46ddd5c35bc0604d623c305046092
MD5 e518f677110bae3715b67f805ef83886
SHA1 5078ba1cdcda90f2632d168f535bfe142dbf43a1
SHA512 50dfe1937cb90b587f11f22eabcaafaa34a9e67bd963452379b81d55bf5b2213b1a57b16686da355833ef5be9ff310adf2aba420581431174116be0a9342f38b
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjMDmg27RnWGj:gG05lO43blD527BWG
TLSH
T1C9D5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9649cbbfdf9be48906075c719835b60b8c8b41e13b812199d738054f301b869e
MD5 36929f1e77f6a2ed3629d9be32834415
SHA1 a83560926d29fa195bd3c0e011442c82a666fb6b
SHA512 e19f1f07951134b90d268a305ec719bf8a2133d1726f2bf82b8c458ba095968a097a4fb076b8b04ccf0f646fa8a4558d3cfe41ce7bce6e746a453d5f4501b08c
SSDEEP 24576:ufa5POZ3dpuWVM50JicR2hG0lasx2+47eidnOsqjnhMgeiCl7G0nehbGZpbD:2a5POZ3BJt2pasx2+mEDmg27RnWGj
TLSH
T1ED65BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 805023ae34750b8bee6cc89020f49c12377407b2aef730b78889eb0cd82f123f
MD5 8e627a92d33e714763e0830bdeb81b30
SHA1 83b5933fe0a606a2b72f181ce5e837bc0aa4a5f5
SHA512 74f551fd0c68202997a67e6e32fdf47f206a2279f03242715c1ed6435a4e5297f2622dad1fa864356623c02bd36a59ecd481268eabfde868582f855fdecf2879
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7FkssqjnhMgeiCl7G0nehbGZpbD:1Nc/zEOVHFvDmg27RnWGj
TLSH
T1A4857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f2d68e9fc3c1b42b69e5fcd8ad17d45a1d529201c31fa317f1d6458bc7bf481c
MD5 7542e29482eaefa567f2ce7a70f8b159
SHA1 e1fa56120c0ae8915ecba703ae3844bf48b36e86
SHA512 4ac46b5f2c7f59b7b81d471be2ab8155059b37f09be703bcf8b63888ea48847ebcb889bea8e569074ace310834bd98505fbbff4e8f70f415568a2a1ca7fb5672
SSDEEP 24576:BTkNvNnaFeYhJNtmZBmCsqjnhMgeiCl7G0nehbGZpbD:BTMwBtOmGDmg27RnWGj
TLSH
T1F355AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e8660744ddf71de62b2bc9f85f16fe7ed2e828109aeb16237fd110f67ce4239d
MD5 5d383bad7b59faab7fc2d6a01571d68a
SHA1 f3963c556ec7d69934e32b3538eff5ed008f0c48
SHA512 3b10156bfd61b66b0a58a8a652b97348690353656952b68499d8557238ea1e87282337aab8fbda9164294913fd4226324af768ecd08a093c59971e8383ba2134
SSDEEP 12288:GHvUrBFrEjwaQAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:GPUr+NQAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D65F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 efaf0962934aca2bced8336f0fbc51b442689415c06e00bfc487e6bf853caefa
MD5 504ea35e1fbbb5271cfa77051f1ca237
SHA1 14abad46f4d4e96762f56f89a2fa22f1b34df5e9
SHA512 e55e4118cd503ca599a6e46ac6834320c72f370fb1c3847eac57ad8d1362bb28047d21fcb4c56aabb7db5023ab73d580d61a6088c559b475eb990550c999c369
SSDEEP 24576:vD3FHshBIYQgABsqjnhMgeiCl7G0nehbGZpbD:vDVHeBIAAVDmg27RnWGj
TLSH
T14C75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1000-23-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1000-15-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1000-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1000-21-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1000-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1444-102-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1444-308-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1444-96-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1444-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1444-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1444-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1444-310-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/1712-51-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/1712-46-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/1712-40-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/1712-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1712-47-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/1712-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2028-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2028-312-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2028-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2028-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2816-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2816-56-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2816-62-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2816-273-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3100-289-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3100-68-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3100-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3100-74-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3484-122-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3484-128-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3484-131-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3484-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3484-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3672-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3672-120-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3672-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3672-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4480-89-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4480-324-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4480-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4480-83-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4480-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4480-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5336-315-0x0000012475E70000-0x000001247604B000-memory.dmp

Download

memory/5408-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5408-307-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5408-108-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5408-117-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5456-304-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5456-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6076-78-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/6076-0-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/6076-9-0x00000000021B0000-0x0000000002210000-memory.dmp

Download

memory/6076-1-0x00000000021B0000-0x0000000002210000-memory.dmp

Download