c654b2e5dd0205a3495487ed254c7034812ae1ad84ecfe2973df014be153e02a

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.7MB
Sample260910-jsg8aasygt
SHA256 c654b2e5dd0205a3495487ed254c7034812ae1ad84ecfe2973df014be153e02a
MD5 02f1d630782ad46e7ba373808a46a2db
SHA1 45a067d533a4c9de036d8eaf46c81d895440cd72
SHA512 aca2a1a4f0fda8f4c0521e517b8c15b4eb765e2eea075866d1b3b6214a8e254d76117271f32de047706a1e9ce74c10f8802803e1413f910d95d728aae29b3a95
SSDEEP 24576:ouxseUbR9OdN161eYKXXFyLAYCD0sqjnhMgeiCl7G0nehbGZpbD:ouxseUbR9OdN161kXgqDQDmg27RnWGj
TLSH
T17185E09A779407F9E077C17CCA928A46FAB278455720A78F03E44ABA1F137A15D3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5944	elevation_service.exe
2584	elevation_service.exe
5632	maintenanceservice.exe
3476	OSE.EXE
2232	PerceptionSimulationService.exe
1280	perfhost.exe
4620	ReFsDedupSvc.exe
4340	SensorDataService.exe
3172	ssh-agent.exe
2868	AgentService.exe
3684	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ce5a9840e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000032e916d6f940dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002cd1fbd4f940dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ade60116fa40dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e9212816fa40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ddf004d6f940dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000850c0d16fa40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000986174d6f940dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
5944	elevation_service.exe
5944	elevation_service.exe
5944	elevation_service.exe
5944	elevation_service.exe
5944	elevation_service.exe
5944	elevation_service.exe
5944	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	4620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4620	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2868	AgentService.exe
Token: 33	3684	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3684	SearchIndexer.exe
Token: SeDebugPrivilege	1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	1080	2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	5944	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 4196	3684	SearchIndexer.exe	101
PID 3684 wrote to memory of 1284	3684	SearchIndexer.exe	102
PID 3684 wrote to memory of 2052	3684	SearchIndexer.exe	103
PID 3684 wrote to memory of 5668	3684	SearchIndexer.exe	104
PID 3684 wrote to memory of 2940	3684	SearchIndexer.exe	106
PID 3684 wrote to memory of 1604	3684	SearchIndexer.exe	107
PID 3684 wrote to memory of 5832	3684	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2584

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5632

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3476

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2232

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1280

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4340

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3172

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4196
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2052
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5668
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2940
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4434b68bcc91db64e9d8878174847652537acd15728eedcea0729c90d03e2038
MD5 7c727b7780b12233bb5b84163d2c8b8d
SHA1 7245f0a42cfc6bd6a267e62aa5f61a8972c0d733
SHA512 07c026330e59179506da787208e86b909046699a6a7f76bbecb56d87ceb197de91cf56f62db2dddfe648011159b31f5cf780fe95472021bb0641df35db1b1090
SSDEEP 49152:Db+632BuPkFKRrdE6ohvstBhuXjfS4LWxn7Dmg27RnWGj:h3q6sjB0D527BWG
TLSH
T113D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 bc5f40c097a9aeb3a15f7bb19a53201da90c88325456c2b9a42c779022049f6a
MD5 ad583ec1bb675a763ec716c5012a6f99
SHA1 2cd8311844b95c6249e5e15d2738961ea365e69b
SHA512 264a809ee98c3aaed94013e6c4d4e94367fa0cd8f5ecc0d5ded5679530443a3d89fd7ac4b731738a06f3cf69b6cfc919461559a9b9b365c3093a362c76842f96
SSDEEP 24576:jXYfDtczAssqjnhMgeiCl7G0nehbGZpbD:mtc9Dmg27RnWGj
TLSH
T15165F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 470f4375f0df052a30862d05143e5a1d0ac9d1b710613fbcc0a4b11cc096dbc7
MD5 782306f1c3c837c5f285c51ff85df380
SHA1 8dba86a6a490c51103933cf5f93a4db782d5c567
SHA512 c4ee909f155e83aff0aeed461751ab83a762b19f5fe39d9ab7fb28130918781d9d6be50e2818600ecdf6c1e27d04ba88f182a53816a26f03af0e1f0e9699fbca
SSDEEP 24576:r0Le5ji0hmxxrMfsqjnhMgeiCl7G0nehbGZpbD:rPji0AjuDmg27RnWGj
TLSH
T1DB859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 819f80ebcd957c32a3a53aa06750f74e312ff85ceac5a1bc7ec03b4b11c1b8fe
MD5 af0fb2dac5b38826a67aa521d7119add
SHA1 e67e6ebd12730e6d2b897f46a88d04bfb56d8762
SHA512 99adacb3023802a09452fb4783dcea6fa553d879899a85b6a97f278eea38c439df7aa642a478e07c7c70c97f2cfc0a24641cdbb0be1dc59d0fca6487bae5a233
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWn6q8wyupsqjnhMgeiCl7G0nehbGZpbD:E/ezSC6vUzPveHjyiDmg27RnWGj
TLSH
T172755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f6c7da9a04f79da43721c63e2c4eaf6e1d11c2a8cd82d26a6cdbcda0eca70a4f
MD5 57022dacf1af6aeef9d9636025e98005
SHA1 912f0cb74b66d27e356837d67c0141ec07660adb
SHA512 da7b3699d7cab248098f0a03a4bd112f8778804b172e5f8f0f8cdb75bb7a42d014057a5ce4a5d98d2db7bd03db3ec584893eda0ae35cf5f4285008d0b7f2ebee
SSDEEP 24576:uVbqPb88hv/l+Y4sqjnhMgeiCl7G0nehbGZpbD:uVO88hXl+lDmg27RnWGj
TLSH
T166559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 bcecf7a39f33e5fa5fc1097d34680ff9c315a143700367119175a8716e9d50f7
MD5 7e491bce09738347ebcedae88f001b78
SHA1 2c02f5a76819f6e8bb205e58b1a79f546a32a37f
SHA512 4b2f188c50c729565610761f8605b516527805aa898bf484fde24fc60f224a8f2de05ef3093efe09870aa37896f66bc8541673202fc8996b73b392651924fe89
SSDEEP 12288:WLbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WLbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C34523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1cf8fd7ab861f50b06bce7d8db98483bfa967b0ac7165bcde0d143b94bf721b4
MD5 e4c18045b9e8fa64d1283af9e7875c34
SHA1 8167513285e2d6883efad23569db3ce3acd98a86
SHA512 b78330355c299d071dfeafa1c423001b6196dfbdeb53cbbf6bc115010c53cc6ff4025adf2adce3c76736c2425e2eab74616893f126bba5038757ee64998e5a31
SSDEEP 12288:qeBNUbTVO86UQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:qJIUQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17765CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 82306ef3e0f06b28edc1cd3e57ccd0f4e28cc3ab3cadb73b477bbc22913606a6
MD5 ffe135fa47d39698b87b99dde8a1615d
SHA1 e91f297f914a8f1a4a0f20a2dee5b88f630aee14
SHA512 1d35166fc0d855f7daf11e9cdb87de21a384c40cd5ea4f5ca3bc5b571117cab25af1f0123d9a6bb7522e57d5780e24f3be2bd3645bd900124b5c01d9082bf7bc
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THv:JQvGAdlCEL8c/DRNw5CdD527BWG
TLSH
T145266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 8eb275f68bfd2b49552b9ee21992ea11dc29aba604ef6c0fe5797fdb9e0bafce
MD5 f4c1cb6e890cdbe49c249156219a658e
SHA1 a9b595b5e0c0ed1ce58b79a94fadb3fffe77ac05
SHA512 4842ccedeaf7aa5c01eab9e2c8b55ff12d8cdf0df1bdbd207bdde4112de497e7263fbd2c1b9a53df21587ca0611c5aa5362747dc96e134bd51ca13d79b55be35
SSDEEP 12288:QAwSfxL/2Dc3RDLLmt0LDQewsAjKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:l0ewsAjKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C975E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6fd1d28f433e78e8888d421393e538c989bcd4dac8bf6da568f95997dc3e8388
MD5 bdfbeb42d2cc2171251c5b4e36ce6b6a
SHA1 9e82536122f5bc828ca17420426bb87c6f89a365
SHA512 7e4f689c35973e5e82272b029ef5e4c6d9d94e96216791559856f7cb0cb89a6b0c0f67a4b745ea6f982b05439135ff3660cabeca9a188688ccfdb072bb426045
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHWVQBWG:xUEtQevvqc2W1cpV2tI32pB
TLSH
T137474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0e78778e29a0885a355f0222b6a72430c01de9c6ac1dcc8193c0dd939dc8794b
MD5 10bb1fe497fa270d71b2023e66627dd2
SHA1 8acbf76e568fbf1e213a993af73cf1c29d19b2a9
SHA512 7c3acb101e63befb58d21bba22b021317b7994e361e3a3587048597c6f1effe91042ab6910ee3110b5c8ff25866f8567877c31866a3fe03d6d0122faac4e15c1
SSDEEP 49152:UCbRquA/m2yL5zTfFiV+XenmE3/z+Dmg27RnWGj:9oquVjnmRD527BWG
TLSH
T1ABD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d05c8dfe397b84bdaec3f9bd7b925ae3888adc7d59adb491025aa39f078a0694
MD5 60986458bbc9bf6b180de5158c52c812
SHA1 76f1a53ea7bccd52a06535631e6e1b6eef27804a
SHA512 9aa31efdf528f00b442deceec0563c9c87f8e6c9be74cdd9ec8c92b3f9ed214fe7deecc6bc4195cd87199f726751d64f6828740a92cfac0b4121b0561d9af3d4
SSDEEP 24576:9AhGL3IFoiwtA5l7S53NsqjnhMgeiCl7G0nehbGZpbD:9AMUFoiq5BDmg27RnWGj
TLSH
T148359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 f4d2b34ce45c42c42cb975ab8b4fb4fd28482a9cb108679ede6258ee559c3ded
MD5 ac1f31ea6658295fed37fdd200e76a96
SHA1 90eed11acfca43146f9dcc9205797b6522cd683f
SHA512 733041af64f270b7f534ec9bebecb14f5d41c40c1ad6f7b820071684b888a2e4d9028edfa27ac6e7adb2bd51e84f1e577ae4336404792e726c5353baf6aa1dd1
SSDEEP 12288:Cmw5HEjsChNVBFgl0WDm+CJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:bwu4OWusqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D65F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0a6224c093bbcecb24247dcdf84d10782686f46896394ae54256e63e1a1bcd3d
MD5 fad912bd186588d710b354c9b27ff9c1
SHA1 8f6ea2e21ae8c35f4fb0ef43aadd557ee56958ed
SHA512 d1c175553fcea74aa952db473f96f0e09aedb81205d2c4affd4d16e11ef83de99106825591d67a826cf38867ca5b42f32d735a898c478af115b768cf67ace03c
SSDEEP 12288:3eZ1Iy6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OZuXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1425512AA239820FAE163417CC5E5D609EB337C62673003CF166656AA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 67af677b67cea94b01e4680542917b1241f6ddcb4f349c6e30f34b7504cc283a
MD5 0c4820b3f209086c709a404789833b08
SHA1 902a2504152e758d1f928b36869e1c3ea9751e19
SHA512 6637f3efbf32ee97e3ef1e3b111fcb816bedaa3c19938ca1bb4489e86e54d69d46254551bfbd7edd64f372dd6dc2f79fe7a442b55c209a0908bf47144a228c91
SSDEEP 98304:xQRQyi36YOcPbLvw2gAf+PN3AD527BWG:oQyiKa/X+PNQVQBWG
TLSH
T153667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e59c6c2e3cdbdcff7b287d431234fdc95d55f8f564572827384536124d67763b
MD5 36e49a36dc4e73baa4d432c575464e48
SHA1 8b608dc831b740ed1b8053374ef0da9e96750a80
SHA512 e833ee3d0f959d1ab80bdf4dd14f2ecebe256a09ecf7082dac9aae0de48fa1386f1855ba8a431e848b054de2616c350e089c5ef94d2eb677823effaa173dbde5
SSDEEP 98304:YQRQyi36YOcPbLvw2gAf+PN3AD527BWG:PQyiKa/X+PNQVQBWG
TLSH
T14F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6c7ad7e95f3cd4f3b18f257560dc8f648397030646835c35552b18a11f7dfdfb
MD5 87a4df658353f0dd1378f1be7575d5e3
SHA1 04cbd719856547f01aabb12c454936c214e9220e
SHA512 f25d7ce4683f84bb0c7a5e36b32fc140636a1372e6269cca9665f1ce8fb479448cfd8d8dd4155ea63f4502b4094b28aba69f41ca3488099e46356d8ce6f4d289
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0nsqjnhMgeiCl7Ge:g68Qg55nhceWu7PNU3/uDmg27RnWGj
TLSH
T1F7B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 37397c52c131eeb956b099a4c3f1651f42444621cdd14c8390d3a0619e81b128
MD5 eafa393a860d49e3f0e88b7959d7bc45
SHA1 a256d6146ea06932c1dc06eb5674f40e4d958488
SHA512 9433cda7950743a5e8815a5e2bd0b4889e0da5842c87dec2e534c7f7bfa5f15ade001ddc2c144fa92c9bd2ce7e21cf819adf4eb2ac144243bd74899f22493bc0
SSDEEP 98304:By5112gYy5azzVvt69nLKnhZPD527BWG:cLIHEWhJVQBWG
TLSH
T19B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5c9881255ae817526d9ae797956d5056b476b153c402f182b8ee3cd53938bf91
MD5 8b5e0359d902b105780d795947518b34
SHA1 e00198cbc0418670c3fed95cfb6419e20f2c2032
SHA512 5df138762ed8b39a31fa6a7fba81e9afdc035fe4871f447244a974b84cf1829344d6e63030a00f9fc2fe43529c3de9e88c06bd6c33e5992ef2ed607ca05c7ea1
SSDEEP 49152:7B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gloDmg27RnWGj:tu6Jmdxd2doD527BWG
TLSH
T1D9D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0c05b254b6a20c4bb82a2d0e61e2fc2e4ab017ec4dd857edf004d1b4607693f4
MD5 053a9fc8ae93e55a5a2ddac3245de9fe
SHA1 793065f451752a4a2ffcb1a0225e82a87caf9c88
SHA512 128653be1fa414ba260d28bc8be7cc6789d89b03ab4cd45e30e48bc0cd8f757f7dbace2689bcfd0c40dfdb4dd426176b67533d52d7a75e4095155ce3e4a78d7e
SSDEEP 49152:M1hpsNoJpF1A63U44CwH7R4xsDmg27RnWGj:MmifPWRRD527BWG
TLSH
T1AEB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 08305535a73b587c42bbc27a4600dbf40c851b2894587c52c1b33522d6967161
MD5 a02557a5663bc99e8df427a0c8be17d7
SHA1 4be7bccee71abed6ae00be3fc0eb14c41969c0b9
SHA512 c36ade92be6b08f177860c8ba367f0de627be0dde0d7a4632332fa2fcc158842a72f8da869feabf4a53147600b6e35f85773591ebe65367c8e670372df730a98
SSDEEP 49152:ESuZQIY0Be2KcRVtOnks6NMHqrDmg27RnWGj:W5dKii61rD527BWG
TLSH
T1F9C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c4f79dca29640ddfa93dc14322cbd81ebde9023129bfae8d8f4a30ed0b178c7e
MD5 c917c4194cd56e9932ef7b9322410e8b
SHA1 2be84e6e407a2d95facb3d8c3b0a16596e7e0c3e
SHA512 132d39b08a610db003f857d74434edbf12cbbe87cc60807a7acd54b3203ec4ab980de35d006aec940f4c9499cb356cf4cf00e77b15800cc0aacfc96c3cc84475
SSDEEP 49152:ihtSn8EApI0fig3giDn0AP5wYDmg27RnWGj:DX2imphVD527BWG
TLSH
T1ED95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 264ac717860c664b5bf7a4a97805606088fadbbeabcb1ee80c3495020b14ac44
MD5 209d0bc0922cddb858d70f03c7bc0070
SHA1 615e67eb655cd86809f8db0f5f7edd0e5832b9a7
SHA512 9464ca09d9f30780714e1c1204005022ce1ec4f0ac5c6f93fddd055bb2af6cfedfb3a3a1ce2ecabf9407d8bda4eb0cb2a81c7433ce921792f48b65a9f3d2103b
SSDEEP 12288:mTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CF4523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 60583bcd2bff29f3216574fb8aa65aea8b106af5171758c4aef77274c4dc5253
MD5 6ed0e3a27ec93acd42af09a393af72a1
SHA1 fb5b9c334ef0f897ef442a8dd4d1c748fa9a0b90
SHA512 c7ee07c6cdc6939ca1083d1bbccb47885bae0cb75dc7f3ce1c8855eb06e5e5cdce0aaf8eb3230475fc0bae71726eb81a7e63c24b1445318f469cb665d41f9a25
SSDEEP 12288:0WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0WsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE4523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e371d28dedd925c431a29e9a081d232995cb9c43cdeb5711e37082076c54b796
MD5 38826ba606d675c2f37857d6e724f6a9
SHA1 e453415f6755fc8dd719cfb86b438d12723593b2
SHA512 f85cef5a5f72f67ec3791fa582d01080d147f6c28c77ae9be7c1bf1106beb10a6d2a6deafecaa0826c3642aad06e6e1b34ada06b3be9dfe9020f23cd3cc51b3d
SSDEEP 12288:DIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1774523BE965C41CAE52648B5C3E5F14DAC073E5BE9200483BA977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 9a538c31853daa141df3804c2f818aa0e9a0336edee7f9c4fa62d7590f536702
MD5 0bb0bb51cc7627be100628bec81b2276
SHA1 16682961fd768b990046de348655a30e22b10506
SHA512 d33cadf54597ea58840e35aa99c4408cb3ebc5843c5f3c1aab1487d2720f07afdc4cacfa2535e5788e6843b934d30dbff0ee523e8791813af2f645831787a570
SSDEEP 12288:/VtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C045236B675C01C6D83285B4C2F5E11DE8237D96EB3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 54253422d7d2f1fd079a4fb9701c0acde9c192f5edeac814a505b5e0f5742035
MD5 4433cead6912fb710d230edfcb9f861e
SHA1 78f3e21aec5e66f3a6f83ad08ea14ab65548517f
SHA512 b864e7cc321d89f471a26889d0169b8b53209f6a234f1f0b24218a9f045ac2cda5a7d3d41651006029e3af459fc9b993bed84fb5439cdc893ee42d5885b174c3
SSDEEP 12288:S1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:S1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D24523BF965C41CAE52608B5C3E5F15DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2430b1e74bd171f2fac474ddfbd10a0e29ddbbb1e9a8ecd4fe97d7229d6ff404
MD5 420a0b12470d31ca85f966cdad0cbe47
SHA1 ae853cdd7c2ad76ae6f82f3b98cab2105d733af1
SHA512 25be7cd4ea7dd5f3b20eb17396b4b85bff31fa4a9c18a6bf1e647aff4f1ff037c8d3310cae84d4578c9083eda39fe4f8e1021f042e7e5e9af32465c76264461e
SSDEEP 12288:VCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A84523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7c1d51499ebf64b07de249ad0b850bcd1f4a66f855efc915a8156a480ce1c362
MD5 532a8d0398bdcbf6fbf1d23115d3e1aa
SHA1 7c29aca62a2dbea5a4785dac034244b546b9d182
SHA512 8d0d0e0e04318c90884ecf667fac089a90bac5651feafd701ca4fb0b7164c74671180ce7e6af4dea71d4766684005b68c05ebb885557b398e523ca5711f1aa0b
SSDEEP 12288:P+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:P+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1534523BE965C41CAE52604B5C3E5F15DAC073E5BE92004837A97BCBAF7F14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 23ae88d818ccbe293829cae2fb6cba1152fd4d9ddb2e904df572a58aeef55e7d
MD5 9fca90cdb57fa118642c6da40ce62c67
SHA1 873383922156a1106f01e5c6ec39decc97725224
SHA512 895651095a13bbd45434ae7ba24170e232c94bce02398776b03fc3b9b857d1c67ff4f96fa017f24bd48ddec3f723cc3c01e3a7c1327f149f92731355549931fd
SSDEEP 24576:pZMRzFVSO2sqjnhMgeiCl7G0nehbGZpbD:pZMRzf2Dmg27RnWGj
TLSH
T1DC6501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0d6360a759745184e79930144071b9c0e36e734897b306c2834487a343ba4c82
MD5 5e55e95f670043e094c3678e28320d2c
SHA1 4da443c04e04c65bc9364191a9f6ac60e88cc043
SHA512 1f902bb592b54c389fb21248a190e202d3e1d5ad98b3743ba7b8ddbea067bf50e3913ac4163f3f3e4a5b2bf96ed40479c7ce57513d7f09f49d182a0aa3798b6e
SSDEEP 12288:iHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1714523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a00d5d3aa6c406c7de14f973901818a3196d8a2acd7aff151e2b0606e629814e
MD5 b01dad002bbef950f72b1055945bfa02
SHA1 a833a9190b891837679d6cb797449b2f68de92a9
SHA512 e53b227be7d4e2dd85312a8f13b64de17b8d8ee76fc9c3f75164faaa74f7a3ba8d33cab49c4df3aa6373f3d7e9eff4cdf01f77d34211c828427682a87d5e2d1f
SSDEEP 12288:5LXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5LsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1724523BF965C41CAE52604B5C3E5F15DAC073E5BE92004837A9BBCBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0358f6530b0f6d74ccb9ac70b559d55205c51e30b4346fe91cc69348e470c96b
MD5 eefa117ad4bea2d22d98e8ce66c804e8
SHA1 1beceb298cb5b50417863971a26ef3b2da82e834
SHA512 dc57eb449cc436b3409873b1d3ace8e361a060c235bcb50435fdb7cb83d70a9301aa8f8a8fde19226dc2d35e4fea5558bbee756b6d5a790a02e7ff2e8ff76102
SSDEEP 12288:NyPz5L86Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kzy6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16E55125B73A530F9D1368178C5A29A06F7337C3647204A9F17A506BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9ed053829b425814d94a0c93d68d6ab3be72dac9785e675b48d4114285b39cc6
MD5 d099042b8c55c2b256a4ed83215c53de
SHA1 987f781d43c66033b02e3ea5cc41f31e5e0f0418
SHA512 46c893ed492ef452af4189184ee42cfa059a1e83d02a6a0ae59b5ff13bad4f2b51b0b9c3b68446d75e46dc9ec67d545e824aac0804bdf069747b203f49049f22
SSDEEP 12288:XHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e3a49329647b1fe1f71ca2c26420b8ab68e27b170f3b749f97587713b4a89897
MD5 ee55f93f275b67e587999223ab03220e
SHA1 89cb1b0828d59d85393f5e8a99802945f9b08107
SHA512 ab36d21855914bcc282f37af2f9dbef2bca9d0951a28a6ed9e0f9fec18e6ab379650942836e2c171b25d98b3161348efef1e87be05d2d58cd277d96875fd41a8
SSDEEP 12288:KHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A64523BF965C41CAE52608B5C3E5F15DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 9ff162ab6cf3d0ed47893ac29b98c003b3ddf9a61a667cce811b1fcf5f3d4c3f
MD5 7a0e57e8d1fec44e8a5993b90d4c64a7
SHA1 9b0dbaf3e295f76e2b45e87e604b45b9ff93f1a1
SHA512 c37bd85ca97bdd9e14f3013bd182f6441f7081bd91a8b15fc29468a56e26d4a7ae3712fae80956afb8816857f63838a219b0729403657d56b5637281071cd8a8
SSDEEP 12288:XyPz5L86Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:azy6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD55125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 2971de2300c8c3c59364f8c42accfd855b3699b7773d62017a0fc24e0152c95a
MD5 f24e71a3a9157b481ec407224edce8f9
SHA1 6c3a783f7e7e8867dfc103311021cf9fff99b4b2
SHA512 6f5231fe8966f5f0e2b4a14963998c43bc71a6d2066a18e8515510a23385cb887fa9e4190656b780cf71d566283295b862a9dd57be1be9bb18e53ebf8a0c978d
SSDEEP 24576:aTDaLl3z0zDYsqjnhMgeiCl7G0nehbGZpbD:aTuLljtDmg27RnWGj
TLSH
T1BE6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 16216ec0027dec8f74d0d24e886dd7e4335613bbe54614fa227b0078c180f653
MD5 998dbc04ae2856c71b6a0a9e2883ac7c
SHA1 aef3074c1f876635744e94104da10b07ec971931
SHA512 0aeafab5c8b983cb59d234c922269e25e1521cfb924f02206c802796801ddb036b11832aa0079078b2a5b6b35c4675c467ad7e6826aba3f2d7180c87669fa987
SSDEEP 24576:X3vd9CHKy7GZEsqjnhMgeiCl7G0nehbGZpbD:nvd9CHKya2Dmg27RnWGj
TLSH
T1DB75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5cdf734b5f50f8a07ae60a085ae99b7ff14d88736a2b602fcc8e45a551d443ca
MD5 a1028f4d7bf665676fa4182a508c8946
SHA1 bf63a62951833cd33268e2055b35757008463518
SHA512 865754358b3fa9153460c7110c027f27ddc859da15ef845caa15bace1c4551a8322bbe9208f3d09d9eb4ab8fe7455b489a5e4fc37bf6ca67590db28815a61459
SSDEEP 12288:8oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8osqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A4523BF965C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 a231e3d8c99bb05a8360ae979aa9cac3187948347e3e1847b8b8ed80261b144d
MD5 a6f96b332bc68a204c32ac1419201e5f
SHA1 0129484828db84b0e3c40e60102f6b938e498197
SHA512 f0c50a92f7771f9461b8bd8920e5551dc030635318e5726b0f2d561477a184aa5fe3a70e3d9de569eaae617e4a250ffb365b433b42dbd963a1961880bd3213d8
SSDEEP 12288:/aXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/asqjnhMgeiCl7G0nehbGZpbD
TLSH
T1404523BE965C41DAE52644F5C3E9E10DAC073E5BE92004837B977CBAEBF24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 eee05d51235b36c2190f76b0d7ef206f138453dd3de611c0c477e067de0b228f
MD5 5c947434af0978f67ef80bc3203fe52c
SHA1 9a79101a8ce8b8aa16042e1d4833abd396d40b74
SHA512 7b28c914ed4c9a34ef7f9e2db4796f2e5b80798c81c10ad85b6f75fa0e58fc98cc95d7ac7f0edbac84b3782b2a10a5eb73e7179432a09f5011ade85107cfcd8a
SSDEEP 12288:5xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5xsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1584523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA977CBDFAB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ec2136c0356a4e2bdaa095ab94c8244dc10e83509643e9762df77d927c548c5f
MD5 070ec46f10b378dd55000a9589a52a03
SHA1 aba732a4353134774ac47c34455747ecc14b377d
SHA512 6f2ae71daecc3890a22a7872f47191d581d14d06d98923d97f64fe88922c6c13fd75fa4b814630408007d6392cd6678a1f5fd21031b431d34b7c183ecad2171f
SSDEEP 12288:vHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C54523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e4d8042b549e72254c3ef77af9b07a41e6db5f2a2355fdd0f005ad21ab4311b8
MD5 5b823c69a6dd83a52e673da4e0beabaf
SHA1 0cd745cf2b3a3e2b8e8bca44b47162af7f39d8ed
SHA512 ed695d1b6fdb43ad3f73c96984c20814a7e8c1538938e5af10ab1f2a50ba9dc1a2f81d71d002c933808bd5ff0cd49b2b19cfcd1c84d5e0f839878f28d76beea4
SSDEEP 12288:hoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1664523BF965C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 6ff6afd91a585caa38bcc310c1df904a35930bd5d297f68e5d8469b07ace6a6d
MD5 aeccacba1d6aeeb7dcd8519d2eb89b1d
SHA1 2e22782621a5e4c1c56802c55f12d65a54993c91
SHA512 80b16223d2733dde1d3fd46d2ab426e7a11a98064bebfaae49e839706e7ddeebaccb7bbb4383f0827ce251ab1c2b644444be2db1e3c3f9fd88932e6f0eeffc40
SSDEEP 12288:VvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E4523BE965C41CAE52648F5C3E5F11EAC073E5BE92004837A977CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 b9bef5a71c68e87390e8d63369677933766f6dc0ea02b27d31bc4739a7344b44
MD5 97ff8b686f3fde5539294997de4c1753
SHA1 5ec85c3e37538e69a413876e7f91e955a7f764f0
SHA512 6a6e09806c156500b433adc8e59ff75358e6bb8dcc96667264d2bc35439c4ba79d2f94dad0ed463a71bd1447a356ac615d819bc8102d9a85d5f439bd430d68c2
SSDEEP 12288:E1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:E1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1924523BF955C41CAE52608B5C3E5F15DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 6244d7458eb7c9874c30ea69df065ea2da51ebc2215b74bba2b55f79c0c4d2a5
MD5 650f138d144bf22d059f323a7665073b
SHA1 487f67b261caa6708b8bbfa882b8530838c59f03
SHA512 58f99112bb5d267ec3dd3fd76628fdcf9846cfab7f308749381441d4a32756a080dc65e9089cc4e564c697e50089ab6d4444a86b519733a22913407cfc188cbc
SSDEEP 24576:zfwvUk9RX6wkyAI7sqjnhMgeiCl7G0nehbGZpbD:pMnYIvDmg27RnWGj
TLSH
T1A885D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6268026f6ce80a989c1b8842730f3ecbafd05f29f429baa5dcd5cbf9c9d1dfea
MD5 5e2a1e4658c1485bcd43e451d43034cd
SHA1 f294c37646684c2462d0446bda456b76155132f5
SHA512 6940c4091fa680062ca0c8e8299f6f38b8638f5312021ff403e8c9536ba028a02216f160f4430652c399c893baa5aa6ffff00acf225710c06c7676e3c134a229
SSDEEP 49152:lYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04Dmg27RnWGj:IySzPgD527BWG
TLSH
T178066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 48de21068f1118b92d506f9c2dce9269446d80cdad543f336678b1ea332368a0
MD5 fe506ecee285cfbf7df7da98e9426173
SHA1 c33400544662fde41771ae12a3252786e9929495
SHA512 13b863414715b2f5c3df7e721f9a4c1927126deabc41f3580fe2fceaf37113fc5ae327f6337666649266b2f8d4b77cc314d7ded0918f6722fc2bf5ed13fc3d05
SSDEEP 24576:a47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYmsqjnhMgeiCl7G0nehbGZpbD:a47JUQjTirIhCnDHUPfF/oDmg27RnWGj
TLSH
T19865AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 015a1c9eb70dcb5953ebb2eae565564c842dcfccd772298af91ebda0566cb3d4
MD5 b8d5fc70e13209e461fe128bdbc4b941
SHA1 99e924cbf03f04b1fc07df9625c52a9bd43a5dca
SHA512 7a9fa23b9722f778a02e404fa544e60bb00c508150bc2a07d5fecd05cb18ccfbcb44dbc903fe566c53e227108ebb1cd7af5fd2579fcee24eaeddf935e6b4453e
SSDEEP 12288:ebsfXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AA55015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 27106c41bcf259803457e72c94d75dd0756df58d5c456c861007fe86fa3e9ba1
MD5 8f51f696dfeac0a5095426270c37e245
SHA1 97e71c7f002bae8a19de3d43799f254b77705e2c
SHA512 6bfa0929416b68ef267d1367321a91650eef3063a7b9589cb14ad66e9e868cbc755d119232e5291742698b3bc2a99d433691a3a0c0c06f0d6c77d0560bdc695a
SSDEEP 12288:3HMS+DU3fjwu1o55q0SktKzIovcI/J7oDOcmaz:3HRkUP7nkEzHvcIBcOcHz
TLSH
T12F252800766BD75FC6A940321E33C2CCA7707D11EE45AB0372C8872FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 9328f17449ea987bf17c49640f1784d4281a4575b807739294b62cdbdcdbec0b
MD5 c69d31e1635d9339388445efa9c9963b
SHA1 98945bd21f8f8077aa09ce9427206164002ca5d9
SHA512 87a5eb7916c95cfc52dac374308ba476f72d82adc7e39fb16e35fdabd1b8e4ca95a84bb7cfe220533ff1d5d382cac59c9732b0e5ac2fa2d5d576c6c1ff50887a
SSDEEP 24576:qrMUtmOMz4QCenx+PvBDE4h597kdthoLJc9BF4:qrMUtmRz4QCenx+PvBDE4h597kdthoLh
TLSH
T1F355D5815437A3CFD1F76032072A9B4CA764EC0777496F26B3C4453ED82AB26A1B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 eb4745d6e4e47a019ce532d93563309c75e803c447a10fb9661b6a0794275113
MD5 b5c2f140d3c5d75e146d6ff4ccbef89c
SHA1 06388496b30e0a7cb17e118b638ab1fda99e8038
SHA512 74f1bfb3c1a37f14363e2c3504ed8b540011e989e966401da86a225c21362f5f2f1ef69035c2056e18b2f5fd6074c1d2e25b36a648e2e143b750add6e3309d76
SSDEEP 12288:S07/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:D/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F145237B935C518AF83605B482EAE12D681B7E669F1004C3BA4778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dca8c805cad26f81c3690374b18f705a0464698a2137c94a58e7ec0d75950bf7
MD5 028b537ec0d16b82f3ba4b2b9f1ee538
SHA1 1d5b4d61cdb6c6982da4988062836ac45edb81fd
SHA512 30dd18496e22d29a554507daded876ee2cc3c66f5d5c09095d89a772f9f07e14064db737639f191dfc05b50d04b29cebfee67cd04915891e2a7f37327f148857
SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bYpsqjnhMgeiCl7G0nehbGZpbD:agb4mBIBhGFqDmg27RnWGj
TLSH
T11A659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 eef7608e41aa7920adbe8a280f2d50234f5e055b6241ae28bfbb6b49f9bba018
MD5 93d28a1da7069de9eac7c999f6217a89
SHA1 0ae040866f3385575dc29827108dec43d0a3ad17
SHA512 ac593cd73322be95dce42470561b0238a1f7fa84978da671109839ad3c75d845c42e08acb35852c3f3cd2b4e3d820306031a4ac47db014de33ddf9dd250486a6
SSDEEP 24576:7G88u8FpJqH1bzria7/m2sqjnhMgeiCl7G0nehbGZpbD:a7ZFPqVea7/lDmg27RnWGj
TLSH
T1A485016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 de51f5ed2fdf4afdf3c9679d0c7d169d188ae443c9891113fffdfc6d58be6220
MD5 f63290ac6393ba4309e8e57711ed9d67
SHA1 148174507b555e09380314a5dcb0cbc54fec74c9
SHA512 23456352115b9dcc7264942100624cf16fd4d1b27c04b43e9203a7ec63d536a3dffa1b5831fca2c36750fe88ce14ee6c33306990e22977194b0d3789c65fc31e
SSDEEP 12288:yHvUrBFrEjwaQyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:yPUr+NQysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE65F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f32cc4c153e839c99bc55df05337a7bd3bbf18b55f4279307e8b38c916c2c3b2
MD5 da21a6286219ac8da4a17a009a555235
SHA1 efdc19427b8d7b740f3e4faac6e9a25dc1313368
SHA512 03db91f39a5cb8cab59be05090429a4a1618095854fbd61365efc8c89c041619efc41f2848cfb11688b6faf63f71a26093e33d68fdd5892e08de385140b6eb08
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjGDmg27RnWGj:PG05lO43bHD527BWG
TLSH
T1DAD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bde895fc23ecbefa95c8e41c4759990b118d4134db609f43923c521e1d60bed3
MD5 1c3f731dd7810f874ed8216c834f2e73
SHA1 53a2f1d5d6c9546d13a05b47eb93d3f1aca900e9
SHA512 1402c5b2fa7e6ded0d4ef8779f403faaee62135e4b482a3b3770c37ff962a06bf384bcea335ac04965b1199ab1a6dfe2fc8a048b8841a426ad7537091d9c9db6
SSDEEP 24576:7fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnMsqjnhMgeiCl7G0nehbGZpbD:ja5POZ3BJt2pasx2+muDmg27RnWGj
TLSH
T1A065BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 af0bf3460370bcaa2f5cc00cd12ace6f05fe8b9db30f4c0f1378034f990a0129
MD5 a771fd620d52026abc8ed0b2061bfafb
SHA1 b8af80662619282e6f2ecfbf004119fcbbc219ec
SHA512 f8bd01d67a8875d8b481320f5153438ef5627dc1f06a96acfb7c5657e0e7caa7a67fc6ebb277b2a75ea7326cc2b3f336852445dd088cc0f89cd420636947a972
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7FkOsqjnhMgeiCl7G0nehbGZpbD:6Nc/zEOVHFFDmg27RnWGj
TLSH
T144857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4779a90852955eecf0d2b5e6916c9a6baab17822327f8228293308813c88d206
MD5 b515a7d9c61b0a8e50ee80f468a5163a
SHA1 98ecfe104fd1f060e6b84ea718fd4ab129f3b046
SHA512 21c5ab21880d059f7ffd253e6e12b576911e0303449efad07bdeb780bbde785bc46a84278ec7664873918133587bcc3e71ab1dd7f7cecd4470c954bd73e66156
SSDEEP 24576:STkNvNnaFeYhJNtmZBmAsqjnhMgeiCl7G0nehbGZpbD:STMwBtOm8Dmg27RnWGj
TLSH
T1CB55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 33f784f3238c94531b91ff0066e8ab6bc926cf83d87132939a7a966f6ce6677c
MD5 a666d897304216615a15987806163ba4
SHA1 066afdbda200fc73f4bfd68cf864f8bb3ccef040
SHA512 1f52add277d563390881f0f18a9b3075acd6177cb5e498c6d5bc2ce4c6cf9ac91f352bb3fe4cbd331f47f22c26c5f9633bcefc344f7ec5f30d8db8eae906dbfa
SSDEEP 24576:2D3FHshBIYQgAzsqjnhMgeiCl7G0nehbGZpbD:2DVHeBIAA3Dmg27RnWGj
TLSH
T1E375E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1080-77-0x0000000140000000-0x0000000140257000-memory.dmp

Download

memory/1080-8-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/1080-0-0x0000000140000000-0x0000000140257000-memory.dmp

Download

memory/1080-7-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/1080-1-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/1280-302-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1280-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2232-72-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2232-66-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2232-73-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2232-301-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2584-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2584-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2584-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2584-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2584-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2868-121-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2868-127-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2868-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2868-129-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2868-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3172-115-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3172-109-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3172-108-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3172-305-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3476-300-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3476-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3476-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3476-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3684-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3684-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3684-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3684-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4340-94-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4340-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4340-306-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4340-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4340-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4340-100-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4620-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4620-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4620-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4620-320-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4620-88-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4620-82-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5632-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5632-39-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/5632-45-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/5632-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5632-52-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/5944-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5944-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5944-21-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5944-15-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download