stealc | b66a8d41abdbd353853b88f31dc994d41fea786a2a58a3a69aaec18c97c9ed99

Analysis

max time kernel
129s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 1.7MB
Sample260910-d9mw7swelc
SHA256 b66a8d41abdbd353853b88f31dc994d41fea786a2a58a3a69aaec18c97c9ed99
MD5 a33229b172936cb7b99671a6b243c8f3
SHA1 e1cff46c1864331215789b58815341cbdd3c9cca
SHA512 5c0d0e95d5802d0fcb0cdd8dddffdef82ac6843678bd508897204224f34ee8c011668b5af98eef248ec204300ba5507cdd99c84ac88581edea0e3e5ae222b774
SSDEEP 12288:yIYlcGG6N6HukZVI/njZU8Fo+U+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0Zu:yJle68uTOByxknw4FYnshx8OfVe247
TLSH
T19685E115F7E810E4F5B7A2758E725902EA367C9A0730D6CF13A4825A6F339E08D7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/484-78-0x0000000140000000-0x00000001401C0000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
5476	elevation_service.exe
3576	elevation_service.exe
5844	maintenanceservice.exe
916	OSE.EXE
3768	PerceptionSimulationService.exe
5508	perfhost.exe
4972	ReFsDedupSvc.exe
3016	SensorDataService.exe
4904	ssh-agent.exe
1716	AgentService.exe
3432	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b8bdefd8b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6cf7978d640dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a4dc077d640dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a48c1b8d640dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6ad4f79d640dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009bf36877d640dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060ff88b8d640dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000348a3b8d640dd01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5476	elevation_service.exe
5476	elevation_service.exe
5476	elevation_service.exe
5476	elevation_service.exe
5476	elevation_service.exe
5476	elevation_service.exe
5476	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	4972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4972	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4972	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4972	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1716	AgentService.exe
Token: 33	3432	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeDebugPrivilege	484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	484	2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5476	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 2960	3432	SearchIndexer.exe	101
PID 3432 wrote to memory of 4952	3432	SearchIndexer.exe	102
PID 3432 wrote to memory of 1280	3432	SearchIndexer.exe	103
PID 3432 wrote to memory of 4644	3432	SearchIndexer.exe	104
PID 3432 wrote to memory of 4632	3432	SearchIndexer.exe	106
PID 3432 wrote to memory of 5468	3432	SearchIndexer.exe	107
PID 3432 wrote to memory of 3148	3432	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_a33229b172936cb7b99671a6b243c8f3_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:484

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3576

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5844

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:916

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3768

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5508

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4972

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3016

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4904

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2960
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4952
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2860 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1280
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2880 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4644
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4632
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2860 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2880 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 583c8df9542b3763041f1f9e22476fbbc9ddca15b2c9765d9393a3daaff75753
MD5 9cc32773b4cbe251796cf2d867067394
SHA1 73bc1fa76b8afb84c4cadf94c59a6ffec0db7b43
SHA512 d663059c0a0e9962e867ab9ad8dc5a501cb73a4d5ee3be76c41d8babcd0771479a65259fd3aa91723d1758ac75cfbb79b3c916db86d00917f870a6f22bf11532
SSDEEP 49152:Eb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn5x4x8EVep:+3q6mjBCix8EVy
TLSH
T160D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 d913c7ebabf74572c5b7fc12f3eafb0f6f21d9ca7087d91c566bb45f63ffd5f6
MD5 1b0dff892b609b9f96d8158085d23949
SHA1 28a705cfbf607aa6ac72513ebfb20e0e77e64733
SHA512 11f183120815066121d97d0d64b8bc4928c96cfc737a87ff46a8eb2e531d3bb42d4094248ac91e681e7286b79a8f2b634584e8d5c68f811cb1a3201543e9d1c9
SSDEEP 12288:j1XLsswWkxy2lRq2czAD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:5XYfDtczADyxknw4FYnshx8OfVe247
TLSH
T15875F12877D548F9EC6B8139C9B28112E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 508d2a3089ced3710a1d120757d575a8bb2d5843647f9ef7e4969e3de4f9e164
MD5 60a1b82f58e3d8982aa4daa74e0c2a5c
SHA1 0c7f5ea1127164cf4fd590e1ad4f08f33b488918
SHA512 b7589f5d489f8057d5ebd535771bb33978996b0ba946866157c4bb2337378e0a2649cb1a500ca2c52db49263843ae1d8b4b2db8ea0f8d92248d263720d28df89
SSDEEP 24576:70Le5ji0hmxSrMeyxknw4FYnshx8OfVe247:7Pji0Aosx4x8EVep
TLSH
T1AF95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4a31d8c68085b73b502a885a2ca4289c46a6ffd9090bce9bbd05153e9db741ce
MD5 c9c382521a3c04b3ea0bf9688efc1edd
SHA1 eaa2d6db50fed540f72d7e791bbfcd7c3c374cfc
SHA512 45c54f9bc0a00ae3f8e067cd0b61f478c6c53a536022f1004d41bd71452f6b3ebef6baafe0947b78429641b89a40c9beaeeec46a415b4ce57542885e936b1852
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWj6q8wyuIyxknw4FYnshx8OfVe247:R/ezSC6vUzPv+Hjywx4x8EVep
TLSH
T126756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e950183643a900dd32283e9b5ba212e64f7e6bd4bfe68a284098352656070117
MD5 2c67f524cd191e437e14802c3e8ba6da
SHA1 29de58b6fe2a549a87b6e1f4e7e9cf651b95d45f
SHA512 a6c2e4bbd842c352754b26fb13dafa3ab89553626de64afbdfa90afc60b5e158ee151b7a655943061c6b05332656ce68c2569fe757f30b5656616dec1c938206
SSDEEP 24576:1VbqPb88hv/l+BHyxknw4FYnshx8OfVe247:1VO88hXl+Mx4x8EVep
TLSH
T163559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 540e1bde45db4852128232dd6ee5edca4990b37ca13074c7c2ff06d9336d1bc3
MD5 7601c6e26650ba424ba18ac422c85542
SHA1 766fa40d70ae36e365236915b32a74523240aa5b
SHA512 231a9ae3889fa6c663d988279029c5a53846f5a279e30e319f297a4bb49f1cff9bf8b789def6e104124fa50624c284df6a55ca326298a504ee764b77e81a10f5
SSDEEP 12288:laC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:laCyxknw4FYnshx8OfVe247
TLSH
T1456523BCABDDE4E1F65E14331A7572223605F9A0DAB4C11BCB78B54EE0B0C50E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 61ac03383d646e471ed364c2110f269b65ea1faecdc062f957afb0b7158b6311
MD5 a2160474056a4599f2bc32f85ab5c0d8
SHA1 9e96a9148863d107de20ab5ac9f54cf2811db623
SHA512 6ca0b9882a6fee8ef4ada905deecfcd22d3531742968c2b58df18a40c281d946f98dd71ba011aad851877b2459fc89035c30b7dc33ffe94bc6eb74e7c1d76a8b
SSDEEP 12288:seBNUbTVO86Uf+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:sJIUfyxknw4FYnshx8OfVe247
TLSH
T14675CF7BEE28FCE2C27E5DB95B918200A77274704B6193CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4ceeb498a24ddc75b6ac21fa5d1e7aa8fa0cbf4a8847b03c6acbaa640dd6db21
MD5 9ab384008787d0eb26b24642111efd4d
SHA1 a48b69d9359a1197477fa2f37c5ef96c4b2a5b0d
SHA512 9364539d1db7d87d68fe09b7e03179b3e30ac49f409685d74901225e960e1996b63c4e86aa0c4bcb7a493ce163dff8454c56cf307bb5345e00eb9f5e1e630ce9
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THw:dQvGAdlCEL8c/WRNw5C7ix8EVy
TLSH
T173267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 2f6acd258e77fe0ad85589b4bcedc48217d927b62aac9a12db3f2b155ff00b06
MD5 1e8c1ca0614d9e76f4eef2b585fdca3e
SHA1 a254343669d7cf035a9b95fa5f49ca52427e3694
SHA512 e67d609d082f01e5a6adea2419dca05bcb4307996fb1cbbd3a0010545d3611566939f0e48554dba237140869e1af22cc7cb5584e1409dd0ac162b77415467d9d
SSDEEP 12288:DAwSfxL/2Dc3zDLLmt0LDQewsAj5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:8+ewsAj5yxknw4FYnshx8OfVe247
TLSH
T11A85E030FE74E032C67F0DB21B36D716142DB9604B611AC3E3E89E9E99705D2637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0ff85aafa956e792cbe7f3f63835a374713fd2a7785ce2d5d819d332a1344af6
MD5 52758af09966296675fe7281ddcdd77f
SHA1 e6c16afe4643d35602fcdbf7c531986464e084f2
SHA512 7a7b4489670b02e32ae8eed6c6592d6224f998c2212fe0d9361700b83bcffb4fc56e3f09483da0237cf09d422cffa3f7129bc192f80fd75aef868d162adf4c6c
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHZ:wUEtQevvqc2W1cpV20I32
TLSH
T146474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a1206d333cfdd065273c0e8de483d28fa4bb16856068cedc59f517a302e14a66
MD5 10c0beb6c0882029b1b2e1cb52baebeb
SHA1 8abf99ac009bb99afb72b08dbca2923b755d26a2
SHA512 1366c9fad71d4f6d0e2da95233189d00d32a466fb212538661576bd48c591b39b4ef84c81b8a600d0bed01c01891517e445e8de7128228c817b3b57be765b8bd
SSDEEP 49152:TCbRquA/m2yL5zLfFiV+XenmE3/zcx4x8EVep:soq2Vjnmfix8EVy
TLSH
T1C8D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 61207f9be19c3cfe878768c1a9f129e1191f8de5d3f7cdc5d8dfd7f843216d0f
MD5 68a1920b84137c4cf3b7e472471a5910
SHA1 b172d80c550c031e0942941f14b498cbb9a7665d
SHA512 23b0e0743a4c8ee88e7670863fbac6576025a723e3e303eb59776cb2afdb8eb1006b4ef2dc60a6d05fb3b3649b40dfa824c9e8bcf15a56a18e48f293dc4146fe
SSDEEP 24576:rAhGL6IFoiwtA5l7S53kyxknw4FYnshx8OfVe247:rAM5Foiq5vx4x8EVep
TLSH
T1BD35AE80EBF955D4F5B3AA7899B69171EA76BCA65E31C20F1260D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 d35b0d9357260e055d373755df07132e48c7d7c52532f15f547eede14e75db65
MD5 0792e4da8599247f4306a8c4e93479df
SHA1 fc3b74f93ac6b22151862fdd7fa2077bfcb8971d
SHA512 0a5a5f1ee89b6e68ffb0988564f408eff4542df573d5fa0e48b924149cef2c820d2e3c1b78af6b26dc1ada771a7705e8b3717946f7f787ecb026cd3d9de69ace
SSDEEP 12288:zmw5HEjsChNrBFgl0WDm+Co+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:SwumOWFyxknw4FYnshx8OfVe247
TLSH
T12E75F14977E81CF9E9A741398657D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 54a584b87b125703ded882f13d0c02b7262bb152a8f635829ef582d4001a3ccf
MD5 6cb778403e8fe2b33f7783ac12d7c422
SHA1 8345616de02245411384ea189880931e0fd43746
SHA512 1458f7b3ea78f05a01d29c4658190387d073339695e8e93cc04935ddda4b59641f7b65364df30c7833d3ef1bf46e36cb706aadc1bb7c2be9da1fde4568a12277
SSDEEP 12288:0vZ1IyJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:sZuWyxknw4FYnshx8OfVe247
TLSH
T1306512AC33E870F1E1AB113A89F15205E762B4A2677183CF4768625EAE71DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 61fbe2fbd78bc018c528c87c76130318dca290f036bc23a93e4ee29152c75217
MD5 4c2a73c24f0266589ac6ae81beb4139d
SHA1 249f9483b0c6f87e1e932595b65a6d8b76feda84
SHA512 cd864057672d2ab5185b933b3ddee5244a54939ff63ffb032916644eeced74bbfbda94d6e15ed0063f3436222959f23598a1448852a1cf10363411898afbb00e
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Us:QQRQyi36YOcPDLvw2gAf+PN3+ix8EVy
TLSH
T11C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 deeb71622f6c784f62114e98ef78bbcc8115304ebc0a791c6c2d30bee2cd321e
MD5 4880c01f9bf52f576d0eef4b07d1ed06
SHA1 f9edd30b466b7c1150faa33ea18a4f6b96c2b488
SHA512 85529d9197b165bea8a3fa5cc39e282b5517cc9fa185fe37768caf8f1f249b6b762107ce7cd821f92bc27af7513f704f572866da66ab254c6388ea040dc4d996
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Us:bQRQyi36YOcPDLvw2gAf+PN3+ix8EVy
TLSH
T195667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b8bcf95886d00f3867f3f8ac63beaf80a8f73771bb701df7859a4ebc660bc20f
MD5 b9eba7869022df1e61a95f4b1d2c0520
SHA1 4d672dc0b8d3a6a6ef16333555bad24221604c44
SHA512 9610a4a8e7a8acde40c711e1a8814fe42a646874d3e5705b869dafc55d903a57d0d6ee725446d7a2379e5295be5b51f33af074483e0a4ae3073566d44bce04b1
SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0Gyxknw4FYnshx8Z:G68Qg55nhkeWu7PNU3/sx4x8EVep
TLSH
T182B55A33B2F600A9C44DE1769F4A973196D17C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a0db53d828d1b858537c8e850df1ff0d2b661bcf17ebe5cea785763ec4f982a0
MD5 09db4e7c3d72b6f5068b3eb367421613
SHA1 d8ec97a0e383ca9532b54699a1251be633453c9a
SHA512 483aa719c86728f2a085ddf4b4efcc114989a674172422cc41dc695f59997fabd5b03d11f325f102100a7391821a79aa7fa1ea668836867bcf4067b636b0ab45
SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99y:7y5112gYy5azzVvU69nLKnhZ9ix8EVy
TLSH
T1A3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4036a432c805adabb3c00a632042ca9bf3bf4cc6cd0325c178926927802be8c7
MD5 4a5b8d8c98118d58a87693cfc70f628e
SHA1 7d13a4446626ffa62509de3ab530cd8f003fb5a3
SHA512 80a30bb2845781c3afddb9d866001b2440d477d39cdb1f42b67ef2e399e317e4fd991ba88537edc05524dfaf06b5eb99550639c51a0848a35bacd897851b05c3
SSDEEP 49152:eB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl2x4x8EVep:Mu6JmIxd2d2ix8EVy
TLSH
T18ED59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f44541bd28c9caecfd1cfd77214edcafbeac45ab741f51bbbdf08f9cdab75ab2
MD5 63e9a59e7ec09318ea1b0210ccd5215b
SHA1 fb77db8c6609da025e4f8b150b2154d1bc1be2da
SHA512 2cdf94d02c1ffc8e2ccd305dfcc9abe3069a8f35a93663a2e3c9bb853fb1be165a92c64eec616f70ea54b4a6ac082787e50bd64f817424f60a99c277120bdfd9
SSDEEP 49152:l1hpsNoJpF1A67U44CwH7R4xqx4x8EVep:lmifPqRfix8EVy
TLSH
T15BB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 652cbaaec54e60aac6f3ac99543a235327916fc0e5085ea69c354aefe1884b90
MD5 b7483672deaccef66d98e0c2a81a59ed
SHA1 014ac82133359b69036d531383f38b2e1d53e737
SHA512 067a3f245f099b879d2a1413269f07dff85b6664a3db8decd0c324e105eef3f2c40cd18764c1404dac2af04d8da99bfd5eb3affee99a8f134c60f29e5c6143b1
SSDEEP 49152:ZSuZQIY0Be2KkRVtOnks6NMHqJx4x8EVep:35dKqi61Jix8EVy
TLSH
T160C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5726d4261b0edc942cc80d75fef1753e502ab54a5c5c0e4fc8c7896f351237d8
MD5 9e866541c64ba9c946bc2d00161cb54a
SHA1 9003cacdc7bd234531dd8329a36823dcc0772b32
SHA512 574321fa81880fdde319f20736bb550b779bef6a34cf5ea6a439c09faa875093f63511d76bb592fd4a6dd07b7d4a95eb571d60e1e39e64a68ecb1baa32f19505
SSDEEP 49152:FhtSn8EApI0figjgiDn0AP5wGx4x8EVep:0X2iWphDix8EVy
TLSH
T1AC95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 5688fd91770344b5570bf05292d68d8a2ece007bcbbfa8c5277c6b72d6561c48
MD5 3f999679fbdf998ff3979c634b491050
SHA1 634a8681217e4720be67e0532a183bbabec748ba
SHA512 488ee839676b0add5b25ceee86cd279e703e2d0c887b19a9f38fac90393749c874ae5c74a167229175ea5a23ae2e36335a11ca7279f5bb5093513ed1d17f8a6b
SSDEEP 12288:5a+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5ayxknw4FYnshx8OfVe247
TLSH
T1C565237CBBDEE5E2E50D11734A7133566609B5A5EBB1811BCB7DB00EF0B0C90A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 d6b9ce8efffbdbc5d3bedd015e13a489a59d3caf7a2a3cf394923feb417814a2
MD5 d67487e2783c32fc2b3653c95a09c417
SHA1 48b1cb8bb806f6df4f52f9c317e05122fd3c39d3
SHA512 a398abdc9a0e250a9e098691c76a06684517fd4a2f67db795ded881007e3d9dcc48cae5552fd6c59e4fe4e7aef372939743d6e39b2e32717a1085e18d4a05343
SSDEEP 12288:mt+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:mtyxknw4FYnshx8OfVe247
TLSH
T12C65237CBBDEE5E2E50D10734A7173566609B5A5EBB1811BCB7DB00EF0B0C94A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 a96d13becf2ceb638b9695c958d35a7294d3b30c483e96a8a4921335a3f6eb4c
MD5 8b4efa421fc757191ccab56aed1e290c
SHA1 30dc1da0e7a1d0745dfe9fc2e38f27bd6a88e989
SHA512 dfb567b936c859e33725a7ee28974161c55f20dd7c050e4e9fcc2ea687f32da9f400c82a78343b20480da6d81166ef5bf51e31096be2917be5c3c952272b042f
SSDEEP 12288:C3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:C3yxknw4FYnshx8OfVe247
TLSH
T1FD65237CBBDFE5D2E50D10730A7173666609B5A5EAB1811BCB7DB00EF0B0C94A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 666cc427098018f23ca11050924d66cc0b1fe76fe74966750218fc40489f9ed7
MD5 ae81f375e3f855d6aee02bcfe7c30992
SHA1 5a56d3511512fe74ba213cfd2647cb98e0e17a1b
SHA512 13764390157eb815806fc50acdabe731d5af7503d0b8ae8f31e4c0cfe6af4bb39626b0328ed695242b78f9c636484fdea41495e03c44596cd11642a7fac26bd7
SSDEEP 12288:YVE+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nyxknw4FYnshx8OfVe247
TLSH
T1ED65237C7BEE90D1E45A51738A716222B365B8E4E731C25FCB24750EEDB0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 4feff0477a75865a878d48937709f5b6e3ed5bced7a840f446a294e26d8246a6
MD5 1526a183cbd643e4aea43bd10b5696ab
SHA1 7c27753939cdac14940c37a194a1075d61933eb9
SHA512 12cd96bfcdb10ccc138b5676de3a91fd5b18c28c58b34c902f1127b86e6fe393d9026007f4b0d81276af7b6141f80c065c156c093e30a512569eacc2f2b2f2ab
SSDEEP 12288:gs+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:gsyxknw4FYnshx8OfVe247
TLSH
T1EF65237CBBDFE5E2E50D10734A7173666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 29a5fae468142b8f37639c582105eed7b5c3527cb588520c446f896b3cb5cada
MD5 5c9825c86c52aba94d3d30556e6ef180
SHA1 800c2971edfa66332f83a408086c41284ce86df5
SHA512 1a6b5fd248c063603070f7fadf7ab7dd52890ad1b4b18bb526ba1dbdfbce35d305c4546830078b8fdf9f4f8b8476a4be0f44f6747616087a0dea27df764521a6
SSDEEP 12288:pR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:pRyxknw4FYnshx8OfVe247
TLSH
T15E65237CBBDEE5E2E50D11734A7173666609B5A5EBB1811BCB7CB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 640c7166479f9d2a0b3309ae721c2d4be0ae6581dc9bcbbae7f0a0d4df694f24
MD5 cfb267968b7b1d08fa16fcde892dfd6a
SHA1 5052a184af4cb63edab95281cd88284f06fb9cf1
SHA512 48f7d765a0df47f2442a789993134bc0be4ec15305390ea5b0f7257b990545e9e1a4baee7794ff435f92f3b20b8bb57b79391a5b6598d7f1ef9f39fbac742604
SSDEEP 12288:p1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:p1yxknw4FYnshx8OfVe247
TLSH
T19865237CBBDAE5E2E50D10730B7173666609B5A5EAB1811BCB7DB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 5bb78b417d3eb5d172c0fa131c537d8a651598b0d161b4e11c7b6e67f43aa94d
MD5 63c9a1a316c15013afe5f1019f77f589
SHA1 1d59d72b2c6cd064e9a9aff5ce616032b349494a
SHA512 e4c722a24f54fb1adfe6685340f03c3498edfb89a767897098a4ccedd4fa6145422a9a3efe9a5b418a78380786e2b86571669d1138e4e77ddfd70a22123c724d
SSDEEP 12288:7iZwbyzzFEoS2cPvyN+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:mZMqzFVSONyxknw4FYnshx8OfVe247
TLSH
T1FA7502A8B39018F4EC67413ECD259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 e6a39533ab1db6fae2cb46c502d5fd65ea5650b95952e015bef40826ed763509
MD5 e8efb3b8fdece940532ce8a717ed30a7
SHA1 e77c722c251bdbdb1ed2c5d78af495c0a596b5de
SHA512 fb8ed6e75d3fcd6e0f969d18a07ac4840ebb08453fdfaa2093018cb1c0ad2d9d6e8b826ea8858dcc8496b0a18d89675dc44727a32dd24bf0ec7f107e2196ffe7
SSDEEP 12288:Fm+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Fmyxknw4FYnshx8OfVe247
TLSH
T1BC65237CBBDEE5E2F50D10734A7173666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 1dbfa72d794ae2e30c54c5f3f8f55807ed92fd5f94bd6193962622f7dcd5c427
MD5 259a6115e86d6fea0637f1c7fba1c392
SHA1 96d53de7ed3aba132b50b219b38438919d5bcc4f
SHA512 f98bacdd34852dd0671aeed6c7ba4550955d625cef19c6dd109185e9ae5688485cd15f15bcec3c7ae529b078bd284157f1e045cafc9949c345e0afaf6473d388
SSDEEP 12288:7S+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7Syxknw4FYnshx8OfVe247
TLSH
T1AB65237CBBDAE5E2E50D10730B7173666609B5A5EAB1811BCB7DB00EF1B0C54A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 6907b82446500a40aeced4ad2f49689e9a6705768a23b8e92afbba5e1fc311a3
MD5 98fd8a58f65e5ed2cbb897c248c24902
SHA1 3cd1163b07ea20f876f8b88edeaae7da76d87227
SHA512 9a9544e39bb9b3b59421ce9d4203559e86e6a9ef4afeeb9a70d751efb795d58f910410dd123d0d65de1bfc3ba270e2e9974341099f2bf82483d860d24265661d
SSDEEP 12288:SyPz5L8J+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:PzyJyxknw4FYnshx8OfVe247
TLSH
T10F75125B73E630F5E13A523689621602F372B8724B3086AF47A4537E6E725D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 2af42f5891368b05998786a62345144820dfbf579b86d65a3c6771a6216a116c
MD5 548efc7a5a40ba1930a4dd0d95a712be
SHA1 198f043445b3511346e9b741640ea3df541f4382
SHA512 1cfe42b77d403e3c8debbb30016a315968ced404531e30ffb8da27c02bf331abae0021d1e1cb8e21ead3f26b57c53bea80e395d7899340fbb138aac592c880ea
SSDEEP 12288:am+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:amyxknw4FYnshx8OfVe247
TLSH
T15265237CBBDEE4E2F50D10734A7173666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 e54f6e154a5978e15410e57eb019f5464b7803ad6ac65ad3b8a419c5d272b1f9
MD5 60c824a47f9992b1e9ed6c0f3d04f41b
SHA1 e2095ad465ed68786d3007e720b59d13f4d6083d
SHA512 7b62ede66b22c0e52890ccdefda63c79d2003b6dba35a64b0d6ca036325692fcd4089ec8ce4e89a22d3253eb9bf7b6ba55f26f653bcfd6af061c96dd332c1c5b
SSDEEP 12288:Am+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Amyxknw4FYnshx8OfVe247
TLSH
T1AD65237CBBDEE5E2F50D10730A7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 85715bf36c8eb9db9dc5cad599d4ac91fd3910dae22a6dbd21715343a63b6ec8
MD5 975c4438a94bbf938bf72aecb4752260
SHA1 81511aeb5299e8c0a8d24eea786d97be46619192
SHA512 d1a7b3b36206098c4940b6fc93b78c4ffe2504b14f18a92a26ae4de43b0521f12a30ed4b64f2c0e1f6a5618bd7214da372f07e3535a335f6b5df0a8e430bd430
SSDEEP 12288:yyPz5L8J+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vzyJyxknw4FYnshx8OfVe247
TLSH
T12075125B73E630F5E13A523689621602F372B8724B3086AF47A4537E6E725D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 4af90c5b30fb6c7ffe6e77d0f8fadf81b5a1de8cbff8c2fc1e095b74b4a77795
MD5 bbf12fa04a613f7fe70e5b3d122a0f74
SHA1 9be0612389bacd147b0a1642c0b0a087105f6b01
SHA512 a58d59e2f82ba271ba14c1f947a9d3cf199f8d4aedf644186381d41ba389d50ae69a856d0d17bc04d5a344b37c361a0a42c0d4f2e38978d33c9ff9eb4cd306b3
SSDEEP 24576:qTPaLl3z0zDnyxknw4FYnshx8OfVe247:qTSLljrx4x8EVep
TLSH
T11F7501A8B39058F4EC67413BCD259516D2B27C6A4770C21F43B8362B9F736A05C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 ff5d2de849b56430bb3cc0a23269c33184dbd5dbaec80993e6b75228bfa50460
MD5 ad938d6e9a6a32f7133f94c5678a9269
SHA1 48e09ca36c75656f54e030f9e7d5770d34c18a23
SHA512 61702ac5e6d9d85ac6e143d3ff8385c4682139cd15ceb54929b13eff2a539f42c1a085613e798592a01a8eb20a1c903543e69b9f7c584037e11d96f0ef8933e2
SSDEEP 24576:V30d9CHKy7GZ7yxknw4FYnshx8OfVe247:10d9CHKyakx4x8EVep
TLSH
T16995DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 9e51fe457f1a4daa9fda60d5078925e709de83190b4c8a1de7cf2db1574c79d1
MD5 d0dd9e74ba47c7d3cc3e4216ee2f5a87
SHA1 bc87b7ee2ee76a94d3aac9db3677290f25383c98
SHA512 89eb4ee388a27da56895b9c673757b01d071d6d8d7052dffc14420fef5446bda0ede5852ea423042297bb2c6f7fb890cfa52c5f47cbaceb634652cfe4575ea96
SSDEEP 12288:OX+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:OXyxknw4FYnshx8OfVe247
TLSH
T16465237CBBDEE4D2F50D10734A7173666609B1A5EAB1811BCB7DB00EF4B0C94A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 a027e7b1549230f518858e8b18b130ccba5ae09fccdbc6f62183bc39e9bb4294
MD5 505548829d6cf5a634174085d18726e4
SHA1 b1f0ada096b9590199c541a1b2d49a0783d6990e
SHA512 5d143a5109753e8c1117740a5af350c8155082968cee7c422386d40448de6d04a31511db80a8f8d3205c768f1597a803a714ad172234dadd9260d95ab11fdcc1
SSDEEP 12288:rp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rpyxknw4FYnshx8OfVe247
TLSH
T12D6523BCBBDEE5E2F50D11730A7173626609B5A5EAB1811BCB7DB00EF4B0C50A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 42b72b907d1169bbdb1c3aba24918c09ea7d4d938249c5b9f9a9094d92adb05e
MD5 6eedc11e9562dd52c55989cc9bdaf5ef
SHA1 0026952c0bb55b73afef79e2b182945856651b9c
SHA512 46c8dca121236fb3eaa6d63bfc0e38a60e5bccef9772735b2f94151c8b5b699a50eedffdf9b8f01f58c574ee33e366e50eafa04da452484359f9cb585c8dd61c
SSDEEP 12288:6Q+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6Qyxknw4FYnshx8OfVe247
TLSH
T1DE65237CBBDEE5E2E50D10730B7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 f9158db8e11c97d37bea7c35e5b87f53f45f9aa712f0883fc8270bb4ed63a31c
MD5 656506c6488a112de5e084b8d6427dee
SHA1 339e9d1da35f1a1cff3a8317956c4439c00697cc
SHA512 4fcd01459b8c8fe702b8bcad3a1313a6d03773f23ea1bf75ab7eb24068f04c28cbf0eb4a89743c8e4382706e96033c755d9e9849b27aacad29451e1cbd8a694c
SSDEEP 12288:Nm+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Nmyxknw4FYnshx8OfVe247
TLSH
T1A065237CBBDEE5E2F50D10730A7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 f77c91b468d22aab122db508b8f4dcd3852e13a082cc57da6671f6e0f0b1c432
MD5 c4112d52a015e331ea10efbe73d53117
SHA1 23f5d96c50afbf2850e166ee952a5b0f58eb7a9c
SHA512 db8313fef4f058c94310d450319f30c72f19f88456698ca9b7a541faf75f358a71dc53c95b842b6d6d93b2afb8a878dc32156f16263b79f70a5ea614cc1df0f9
SSDEEP 12288:KX+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:KXyxknw4FYnshx8OfVe247
TLSH
T11C65237CBBDFE5E2E50D10730A7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 6e82ef3d0bd6d7ac50530ad2dc54ab04e826ae3add41e3dcf3cd8c7dd27ac1b7
MD5 10cbf522d2f9ace7d47ec40c10b900a6
SHA1 e77878666db35cf1d232b9776e1190eb42a28e32
SHA512 bef63accca5288acdddbaedd9c2c45f640d94c01a5c9811f6c97257a67042de8922b46271574e67548cfc5c0237b62139ba23f58eabcfa7507f03ab3533a9fe0
SSDEEP 12288:FO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:FOyxknw4FYnshx8OfVe247
TLSH
T16F65237CBBDAE5E2E50D10734B7173626609B5E5EAB2811BCB7DB00EF5B0C54A01E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 1a6af22a1c2bd128ede29aaf24f276f74d6065dd909031385543f556bca7ef96
MD5 c3c5b0fcbae7adc07fd3d567e6478fa3
SHA1 12e029278060340929f3c669c9e20b964c9e8271
SHA512 0626b9048bcd441e9beae21eef150997ca0ce1a27c78e84a85f0853706c19e27b4e9b6db20f2fbf887ae12f55594160020d2b8c960f66e29815b69abfcb00eb3
SSDEEP 12288:Ts+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Tsyxknw4FYnshx8OfVe247
TLSH
T1CB65237CBBDFE5E2E50D10730A7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 c1659a26d7a51d62f1b4fd6c69de819ce2f49706c1b3d0700ad8826b7ebebe07
MD5 8c54905ccb2f1bc86afeb2b7e6e24935
SHA1 be459f52309cd8b3b696bc81156fab378dbec82c
SHA512 d930ac8c701f3eb920c109bf35801852c87b7e58f87414911cb415f377af06004b8ab817bce876c7c24dc893b1d0b928d3b304dcc4e3abb421ce5a437a9d4153
SSDEEP 24576:Bfwvgk9RX6wkyAIiyxknw4FYnshx8OfVe247:zMnYIdx4x8EVep
TLSH
T19395CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f1b02e79f18ec46944d13c99f263a0869cc6dd2d50a7c05fd2917e0dd46ac9de
MD5 94073f60f97171866f6ad95977a3752f
SHA1 643c47c0c8cd7b5fd1900ad1773c854d96726565
SHA512 b2e8ba60d1d9c55862cc7b63686f6dca68596218e27837535adfe45ecbeb4b90e7ffb7f04ad57ec0341d3285fc063f94713a199b54359abf0c9838423d990416
SSDEEP 49152:sYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0mx4x8EVep:jySzPeix8EVy
TLSH
T1CC066C96A1A841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e158016799ea4c375fe910c008f4a03ff69ea08fb4b95955ad55b908ba1f9fe4
MD5 8b22915b3fd9ccb0948c1ae2d2339294
SHA1 fb7b1c6a04e326b9191ecdb8d306a46cfb1ba50d
SHA512 8a4eab73799b33e4832392c24e91dc53dcf68c894dba240da632f49d720e102233882e34c06cee234086e89be408dd5c9378e447958d84338155a725e7020247
SSDEEP 24576:r47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYdyxknw4FYnshx8OfVe247:r47JUQjqirIhCnDHUPfF/2x4x8EVep
TLSH
T19C65AE1DA3EC01E5E1BA927885154A1AEA71742E5F31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 c1c76ea9fa73db409d5cf886de154cf1a31e04c09073f67e75c054e095881d12
MD5 c287c0572619467a52bedb927be6abf5
SHA1 b4574843df5a9aa2834e4940d8f0554d83ca9c55
SHA512 60f0ec818b29e3885598bdecdccdbb265c086962607110afe4233b7b3261f212958a3f592027d395374f2223a8239abdf24e836befe993bbaa3e164c884ea229
SSDEEP 12288:o0sfW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:OWyxknw4FYnshx8OfVe247
TLSH
T12F750128E29852E4D06E2276CB625641B3237C6597F1D3CB93D0F53E1F71990ADEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1000KB
SHA256 75ffc83d5e0de96682478a6b68d3396a9b6a3e5057c619ea4f039f16fd89fca8
MD5 c9bb98e8322c5717b11700ca6001847e
SHA1 b1cc42ebc5d4b7d0fefb1dca5d7b2d0906598ac0
SHA512 38b1a33dc41a69ed018886d573b4e139825d006547721c222b584310e53c6c19c030ff2ff6c53da72d11668409245c034a345078f7086037ac1e49f46781328d
SSDEEP 12288:i6MSOmKiU3fNQBYp3Z9RQtJa7qYbHp4c3aOx:iHtmJUPNzmqBbHWc
TLSH
T1C4250700762ADB5FC6A940325E32D1CCAB707D41EE05AB0772C9473FD57666DBAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 12ffa85944da435cf27f2bf64627ad5df742eba9bb2c3add12109e3b981ec880
MD5 b3e86539e3854d56596c359df8966b7e
SHA1 683bd4fff8eea75cb1a38cf14072aebaea9469e9
SHA512 c5f11f51563de2f0c1ea7eb47e8968f0e603ce56ebc93dcdc099302874a0af5f45061f9a0749b2bd0666eca9bf203bdc24b572160f77f9f8342b19926e421aec
SSDEEP 12288:lr++x+IUFSP5kfK+2F6nkM2CmHZjZdKtXCB2aGV01hxoE5uDQ:lr++xwDQ
TLSH
T13A65D6816137A38FD1F76032072A5B4DAB74EC07B7455F26B3C8453ED82A726A4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 4bfd3f61080f457b1fc35e3a0066f229c7cf38a95e70e235be48c87708f55ae1
MD5 3baf9ead886ac7ee8b8bc1e06340117a
SHA1 c0fa1f1a2b0300cbe8f0422ae9fce5e00dd1cf0f
SHA512 c2985dce7f6c97e7aaf1afd63601c01423d035a4c0fc47139f9df6c91b2d352d4e752e177daeeb1f151e555754d5faab1eccc3d57d39343380c71bcea21f3a05
SSDEEP 12288:LR7++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:l+yxknw4FYnshx8OfVe247
TLSH
T15B65237CA7DEE8D2F46D11730676A221360AB5B49F70C19BDB28B14EE4B0CD0987DA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e63a0f8e2cd7f07021f35b537d7c5aef9365b834de8069a9d8eec74cf5e12298
MD5 7a0828f61971bd7f5ddf10578b440ee7
SHA1 2b705876f6ed5ae9381e70195e6d23938c72aefc
SHA512 99ecd7ca97d91c87e844dbd7a1fe80a97628d840a8da89459599faa1e5d8a92d0ac78df8829d7dc26ba9340142bf8379123bd4d13b21f92312dc7850e65f831a
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYIyxknw4FYnshx8OfVe247:Cgb4mBIBhGFIx4x8EVep
TLSH
T1EB65AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 7e72cf088f3f32f1c0ea90ae874f255e0dd3a7f12f52ff47660ce5867daed903
MD5 0314adfcf0516f9136e648e6de18e8c8
SHA1 a3c4fb6c8be5dc9c65a63edb69f3b3cf1e557a53
SHA512 9478ec4abdd9abdc3f60b37b8b7900ed7a5e230be8de6535456f08e9d4831413192e1a08ec2ad6e145034027223cf2c9576deaa749e11e0967170f95f88072a2
SSDEEP 24576:tG88u8FpJqH1Izria7/mNyxknw4FYnshx8OfVe247:g7ZFPqV3a7/zx4x8EVep
TLSH
T1C595F16577E101F0D47BD1388A924663F6B2B4250374EBDF07AC8A561F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 8d0ed2d7adda1766dd3723e24e26ab4b0d196901176005959f5be43e7512153a
MD5 604ba7dc11841bfb34d2806dbdf23222
SHA1 c87b3e7ee154ae1d038a913adf1937dd308006b6
SHA512 a69bea7aaedf906585603dbb31f34fbe818217b418cb9b5a7b3e5e2624bb51756f9cb13cea9583719d7271b207289c1fde68668dd9bbbd8abbe4f0d157ef6df5
SSDEEP 12288:XHvUrBFrEjwaQh+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:XPUr+NQhyxknw4FYnshx8OfVe247
TLSH
T17A75F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7e079aee3162213e8df3c0086ec58c41a5bfd2a464110d679e7a6a665d8eb0c2
MD5 eac1e2b8454ec3a2c94e202784a10140
SHA1 cac3489b553cdf1f69db34511dcd2d37f705a8b1
SHA512 9ca5c3e58d1073fd4d77d980628453f07dfb961c8c3d80d617093e1358ea28452a9f04fbc8a1cf82f235fa0399e5475fba290e881f0fdecf9dd857a735fa86d2
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjUx4x8EVep:+G05lO43bFix8EVy
TLSH
T1E9D5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 28bb0542bf5394f875b98e197ae721250208a298ab2a1a20cdaecb3964aec2f6
MD5 070ee0b39db84c0e5576fb055ee95410
SHA1 d58cfe6c2f0c9c5631a6065a7917928a822cda33
SHA512 5b274fc4575f91b38b09dc1c06391950822c55471b6afac64bc632a43782f1b862d64b400c102788d9b427a0397ea39aa7008e6ad11f88b62c9846198ef91ec8
SSDEEP 24576:sfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnjyxknw4FYnshx8OfVe247:0a5POZ3lJt2pasx2+msx4x8EVep
TLSH
T1D365AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e87639dd95cca5ea4223903328d19d245804bd2799d621f159ed177be29f9855
MD5 d72bc50b470f290597102028768cebf3
SHA1 886db822fa76764afec273185b24376a7831c3b6
SHA512 dee4c3af2d14f5e99a3466212891187198f79572d26b96747bfb3f08733940209241375633a089315b324d7f686b13055f7ededf6e4ff88d55c96c49df18ffff
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7Fklyxknw4FYnshx8OfVe247:QNc/zEOVHFTx4x8EVep
TLSH
T157857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 be992f22792757ccd0faabfd5f9068de7ad979d032cb6c360994fe34b38792c5
MD5 4716e2f91b179732c9345633c5b930ea
SHA1 18b3ab0eb88c8a410aa8bf2552efec460ffa442a
SHA512 3cf70be365037b86d82eb92b00658bd29f0c0651ec98aa92c15cf9f5ccc6e0f6b6a26e70886831bd94b22531a40b624a748bf4df19135af17822f4eaa73152e2
SSDEEP 24576:OzkNvNnaFeYhJNtmZBmvyxknw4FYnshx8OfVe247:OzMwBtOmax4x8EVep
TLSH
T18B55AF6EBAF846E4D1FEC6B58D238112E6727461073293CB8390C13E5E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 d2b86c0ece0f97415af790321362746bd4e006b784e370d83e461d3190171009
MD5 b01cd891c0577eb3954b7c3e0abec9fe
SHA1 9ccac6cb746abe91d06f9bebf9359a8f4deac828
SHA512 19bbcd134da29b05e2601bbb2faa5d720f9c9b47e848812f23b349cc866d38c535541289eb1a68b6037b2ad0a721262fdd4d2f885b6d87aa830074b2656c4d52
SSDEEP 24576:ED3FHshBIYQgA6yxknw4FYnshx8OfVe247:EDVHeBIAAVx4x8EVep
TLSH
T1F585E17DEB9C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/484-78-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/484-7-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/484-1-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/484-0-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/484-9-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/916-55-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/916-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/916-294-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/916-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1716-134-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1716-126-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1716-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1716-137-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1716-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3016-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3016-109-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3016-103-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3016-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3016-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3016-314-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3432-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3432-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3432-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3432-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3576-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3576-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3576-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3576-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3576-132-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3768-66-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/3768-308-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/3768-74-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3768-68-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4644-328-0x000001AB44A50000-0x000001AB44CDB000-memory.dmp

Download

memory/4904-121-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4904-122-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4904-313-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4972-90-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4972-96-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4972-330-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4972-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4972-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4972-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5476-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5476-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5476-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5476-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5476-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5508-310-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5508-79-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5508-85-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/5508-80-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/5844-39-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5844-40-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5844-48-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5844-51-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5844-53-0x0000000140000000-0x00000001401A1000-memory.dmp

Download