f5e803b11b0266b11ab5bfe8d97c4cb62a9b2269d6e46bd712bc4c2188f3e4b0

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.2MB
Sample260924-eakhgazz6j
SHA256 f5e803b11b0266b11ab5bfe8d97c4cb62a9b2269d6e46bd712bc4c2188f3e4b0
MD5 57bed30bafed9948c2f1ab356d08a32f
SHA1 ad6f46603bbc0dbe837c58e8d20333a9834ad114
SHA512 409e0534cced0fc0aa49e046557c6a7c096167dba93e3310fe35f6e800e84b4035f8da2f56ff165b84bdf2eb35bfaf39920392dce0228ba0fe1906d566970148
SSDEEP 24576:9Q9KRfK5HPRHLEpATTT7qAFu14yTUxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:OwR2NEpATTBu1421b5+Pl6bJTIZ5jdg6
TLSH
T1DF45E096A2E900F5E077913AC9C64607E7F2B4101721AFDF07648A662F33ADA5E3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2572	elevation_service.exe
1756	elevation_service.exe
4700	maintenanceservice.exe
4092	OSE.EXE
6096	PerceptionSimulationService.exe
5800	perfhost.exe
716	ReFsDedupSvc.exe
2996	SensorDataService.exe
3520	ssh-agent.exe
3368	AgentService.exe
5632	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f2ab574b612dd39a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb0f1202d74bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a1eaa02d74bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095168f44d74bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f3c6fa03d74bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2a49103d74bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005120d444d74bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2572	elevation_service.exe
2572	elevation_service.exe
2572	elevation_service.exe
2572	elevation_service.exe
2572	elevation_service.exe
2572	elevation_service.exe
2572	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	716	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3368	AgentService.exe
Token: 33	5632	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5632	SearchIndexer.exe
Token: SeDebugPrivilege	4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	4740	2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2572	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5632 wrote to memory of 2648	5632	SearchIndexer.exe	101
PID 5632 wrote to memory of 5980	5632	SearchIndexer.exe	102
PID 5632 wrote to memory of 4464	5632	SearchIndexer.exe	103
PID 5632 wrote to memory of 1964	5632	SearchIndexer.exe	104
PID 5632 wrote to memory of 2292	5632	SearchIndexer.exe	106
PID 5632 wrote to memory of 5372	5632	SearchIndexer.exe	107
PID 5632 wrote to memory of 4632	5632	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_57bed30bafed9948c2f1ab356d08a32f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1756

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4700

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4092

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6096

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5800

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:716

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2996

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3520

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3368

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5632
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2648
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a0152f032935c8739d1015b9b0f89bd974ae542054b8ccbf9189fd488cb2e0d2
MD5 75346c244f085054d9c9ab36285bb1f1
SHA1 1ad550291612230d3c473625eea2de5fde297350
SHA512 c7451dc4fc38fc3cd07f97f40b92e4a98889623109a053c3f39a8ebc4539d70b6a986b06c25e8c00548f4f6bfda4fd6830f4f7cdae4121aacc28ff2890d3abac
SSDEEP 49152:Fb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnSb5+Pl6bJTIZ5jdgp9:b3q60jBFslgJTIZ5Bgp
TLSH
T178D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 947bc826018382772c732b72710e0aa6681d26a061607cd3eec4ab075653d99c
MD5 f3ef473d50f6519fcfd9515290acb472
SHA1 81b7adb7e7f86c02b8fa42cfd0a62119c7e59e94
SHA512 44a1ee532c6722a6a2343f37a1f0f1e15e9dd887e377fdb435227707d90953ecab80bb11ad18f89926e090d1ad052c87a17aac0346a400f0146f42c31fd1426b
SSDEEP 24576:kXYfDtczAymb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:DtcYb5+Pl6bJTIZ5jdgpb
TLSH
T14485F11967E504F9EC67823DC8E2C611EA73B8558760E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 1c929118d8e8ecf86b86e388ae001b99d21793a8633d6f53ebee5348b169d581
MD5 613ed6c552b4589e21d4480dc281d7fa
SHA1 4876642c293230cd2bec00de2d3e635fb6351c2f
SHA512 6422534a0dbe0b6c54c862f04bf4e03c91ba1bd8138f20e2e2fff3cb7a18b65c029901e0284d8a443793fc885439d1a47cf709669e6635ad1994acd314adafdd
SSDEEP 24576:W0Le5ji0hmxqrMjmb57GBiOl6a8JTth/RWZvR6wQQ92pN3F:WPji0Ac/b5+Pl6bJTIZ5jdgpT
TLSH
T12E95AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 732b43f5e83792ba7031767cf86c3a6298c83949d20ce7b1da1acab8b597a29c
MD5 adb9d1fcc88c76c8cfe0e2a48dcd30a1
SHA1 fbe8d6211916dfb61c06148721a12863967730aa
SHA512 1ca51181c53ea4a1c45f37a234b93b34746899ce8b64e60601a5a84b8df5467a391a12def1917b861714c923e37fa987b21fac6b323e7c11c35ac717e6b5a930
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWr6q8wyulmb57GBiOl6a8JTth/RWZvR6wQQ92pN3G:F/ezSC6vUzPviHjyjb5+Pl6bJTIZ5jd9
TLSH
T1EF756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2faf942b722641138db5d4cec388d4196a11c95236db7b79f66be08bbf2bf41e
MD5 3de5464b44fe93dc755ac5ddb2fbd8bf
SHA1 8e6f8ef234922a1f08f4c713bd3c3d13bab7ee98
SHA512 db4f80d36c88e15444a7262db0ae54c3761b917ddd558e5485282c1b2f0fba945d646a2ea682b71e19af0c2361d6c1cbf7774ed97c41b85eefe9c79c4fcacb44
SSDEEP 24576:RVbqPb88hv/l+bmmb57GBiOl6a8JTth/RWZvR6wQQ92pN3W:RVO88hXl+1b5+Pl6bJTIZ5jdgpo
TLSH
T181559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 c6522f480d0adcbd178bdfab41502f4d8d1f936ebc833e54d4942598a6a1cd27
MD5 9ffe20d3b17f8e11b3ac3473e83c4874
SHA1 dffaa5528988d9a917a76fba3210e092b9d42711
SHA512 513546c8e7c8a97ac5216b5dc47e9c32442b630543ed61423fbe841eb60e9567d401ea14855078cc70961c77bc13d6ad5cd2c88c33a6f06cba70f3b02e02c7fe
SSDEEP 24576:2MHmb57GBiOl6a8JTth/RWZvR6wQQ92pN3o:Wb5+Pl6bJTIZ5jdgp2
TLSH
T16F6523834B6A30C5E5AB1739E9CDDB00F879EF55CD866BB6C575282BF034349B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 820aa4fb04b2e9bde4016fc57d52d0a39611dc58b5e90d8ff044adb7acf2b1d7
MD5 c147d9206f0b1f85578b2ef7001c4d29
SHA1 75f5714658f802923d28c51b3e5e7eb8667be059
SHA512 6916641f662078dc4e1874354665d777282575d7f67b8941db3bfecd4f5cb54adefb9fd7962e45696957e92f02c2fc4ca7a32e59cdce27c0a573833775da5e7e
SSDEEP 24576:2JIUumb57GBiOl6a8JTth/RWZvR6wQQ92pN3y:2JIURb5+Pl6bJTIZ5jdgpw
TLSH
T18385CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c6525287705ebcb2078efde027e5887823781449b3431458a17bc8e7ccad3715
MD5 84e58b1565d1caa6e3c2f435ae4fd1cd
SHA1 4abbb7f98593111983b01f45a04a3a2fd43a1101
SHA512 53e8cb9d0c9a58d8df44dab5dd6fb24b6c99fa0b434b34bc1ac13182f0f2c72730d43007fee9a7552e6e7e666791bec06b088e112b7b49376452e911d1a3c47d
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH6:JQvGAdlCEL8c/RRNw5CWslgJTIZ5Bgp
TLSH
T1C9266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 65a617f1fc54aef75ac33509536e547c38cdf2866c9a83aea235534dc400be87
MD5 32193f3921ce20da24801b80bf2ba601
SHA1 7e19a0064af66ffefa3011940b9a5fd2f2b7e135
SHA512 212a4adc6853364f599b8b6b159a18e61b989adfd8909e0a8a25b921b4c56012158ec7cf346b357476a27850befd26091285ab264c96169414e8e0e53708aa17
SSDEEP 24576:9rewsAjYmb57GBiOl6a8JTth/RWZvR6wQQ92pN3R:pljPb5+Pl6bJTIZ5jdgpP
TLSH
T1E285E031FE75E036C2BB0DB65B65C706647DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3cbe4c47204a3907f6d04fa9903b7975f9faff4c4be91cb803b2ac96eda8f531
MD5 1908b60e992033dc5a5a1b82a50a8fdf
SHA1 18171e2c002a643cae5d301269ea41a61c213946
SHA512 4cc12ed4eae748d5c99894824ad1fc9d1a932c61c83cb103f1ad91cf3a0ed29785c7f135b1fa1dcbf6b3fc73f792de6026c04432970699869b878b3c426a0fbe
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHbsT6p:WUEtQevvqc2W1cpV2RI32bs
TLSH
T130474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6d2b8cd55a3d79f437c4b63e2bbc201f8513b4f8921a8901c0047f59b03aab41
MD5 3897e604ff660bed873a8c0000501151
SHA1 55d5a0f22b8e05db7a2b09a019f901e24913e212
SHA512 ef5acb34e9dd34b8d85eb41909b641bb3ea6a22304ce6ff9ae0fc374d28d524d1d54296e7a12eb64c12a43e8820c162460dc89d6e21b8710414fd25efb0f10cb
SSDEEP 49152:aCbRquA/m2yL5zTfFiV+XenmE3/zvb5+Pl6bJTIZ5jdgpz:voquVjnm6slgJTIZ5Bgp
TLSH
T136D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f7f6ee9f5793924adb60e15d4a7c0d43f22369e3028278dcc9ef0ea88fe6dc26
MD5 32d8bc5ef6e189be285173c341c3d71a
SHA1 7d8961b97a7d9848a61d50571df0250d2fd6c920
SHA512 02c4689549ef51dda30332c331f528455af31eb8fbd0333ad46863344f5515d40a18a6dc4d119f21ee898dbe5861be68537a55277e13024cc4dbd75558b1ccaa
SSDEEP 24576:6AhGL2IFoiwtA5l7S53Bmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:6AM1Foiq5Mb5+Pl6bJTIZ5jdgp8
TLSH
T136359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 17bfbaa63621262b3d00b531b8a05a6ae7a25e023ba8af580185e80b983dd523
MD5 7d71a5b324768ad0427e7c97fbebdd9a
SHA1 91f15b8876169b3595d6f180ba6e9fc1df699ea8
SHA512 b9cde1e5894269fe936bc8ab8e4f81c1758f10212687d0f7e93bfe9f9c5856479e5a841dafc6473d1718d45f28399f485c7f3671580d7b07e31518868818e05d
SSDEEP 24576:qwu2OW0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:qwZOwb5+Pl6bJTIZ5jdgpR
TLSH
T1CF75F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 5cafc95251eb3bd11ac355d3f535b381b04120a21e3ee6d67405e1d9581cfc5c
MD5 d72dac4c2519921b098eaa29c8a99825
SHA1 15935536d6720ff66aa0aeee9d82682443713ed4
SHA512 8cba7ec7072ce848e7b499e9f57901e4ea3bab1cd6108362235d003a73d4b1f4e3edfefb82d44ef50bdf11c2465ce9ca1765314009f90912e1a86cce24424ba0
SSDEEP 24576:EZurmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Z:Mb5+Pl6bJTIZ5jdgpD
TLSH
T13265128627A830F9E0A7523DCCE58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 de0205f9fe0bb4bac6660afcc18aef6275442ec8dd4604feb62131d7a8ec230a
MD5 cee69c9b8811bdade7642af8f8286d2a
SHA1 20559253ff7fbb1685e208aa5820134fc0505ed4
SHA512 bf8049f211352f0bc7c1ca222f6fb9db18fd205d504b25d4a5492980abe84a5d837e1f36bb5b645dd47f8a4ed160e419754c974908678ccc2e5cc136a4cb8bab
SSDEEP 98304:tQRQyi36YOcPhLvw2gAf+PN3BslgJTIZ5Bgp:EQyiKahX+PNRsT6p
TLSH
T185666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5eae1bee1652f88e3c3cd4d7bc1e3db69af0564bbedf332d6082fc5ede281181
MD5 4302d27601fb07a771dbea0bff2d3d40
SHA1 c26fd8214c369fa9a08d981f597e94c256b938c1
SHA512 66939c123f0b3bfd739bcd964c5940def8ce77c44a388fafdca132d82a4c03c15ed5e497d62a992a3d040b227583e01dc9ebf8414257b26345628c5433f606d7
SSDEEP 98304:2QRQyi36YOcPhLvw2gAf+PN3BslgJTIZ5Bgp:9QyiKahX+PNRsT6p
TLSH
T10A666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 37232b2cae02e438125329e261680ff93cbc3b671228ccb8feacc36aa74a7895
MD5 3c2cc0dca64a9a06128193bf3dc0cead
SHA1 09f60213374ff954157b3b8830a1cdee897b6f57
SHA512 7d43e3069d4befb7856114d512869f3cfa1f3496ac3d2b2876d0292ec1fa22c7f263415e1da560dc1a268fe7441e79bffa843b2b1e0a4d92853568c212c01fb1
SSDEEP 49152:E68Qg55nhceWu7PNU3//b5+Pl6bJTIZ5jdgpK:uthLRc/DslgJTIZ5Bgp
TLSH
T169B55A33B2F60099C44DE1769F4A872196E27C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 149b47ff1bb5236e5b1aa5accddeef7753399c6fa45b360d2904042a45665c96
MD5 21a0854df0754b36666a1421f4c9457f
SHA1 10b4dd976403d4f282c65f711a4852f361d82176
SHA512 26ee697b3b7c362d06444a6f20f8f1f1b7698ce0fd69e0be92c04c24edc08f0a8bfd51fcf3fbfdb751ab15e89cdb202969738536acd0b1371859e4ea1e7c1077
SSDEEP 98304:xy5112gYy5azzVva69nLKnhZ8slgJTIZ5Bgp:MLIHjWhisT6p
TLSH
T1C9167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9ac5d0d6efaaa32445a087fea78d23ac26fadafff0ca6e7acd2c0c4297ef9b2c
MD5 93f9430ed93ceea21bec830f573b31ae
SHA1 93b54d49690bcdf4c67f3fb5c0fd5106f788a0cd
SHA512 6020233f554020be773ad4615a01a9f9b44c4025052db63f560b698b8d392702ad9e8a68162f6884a34e480883e2076924b68fdf850ff4acb92d216e74bf8160
SSDEEP 49152:VB+taZ3usBWOBr4tEG20bqx0z+n217aau1gltb5+Pl6bJTIZ5jdgpz:bu6JmUxd2d5slgJTIZ5Bgp
TLSH
T181D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 068b7e202daa2d71c8d7d78376a9ec541a7885f6278ff11038756f8bf5027c0f
MD5 9b9b479554b9ead1e739fe650b26325f
SHA1 bb134c524d8e85c70f4bb6c38fef32699855323f
SHA512 86e99ab7d6dfb1c25b9c9e2972ce3a20c5cd8f8ccbd83e78cefd6f93631bc25dbc6f0e087178b498b814f751f3e0892fa916a033294907188ce8b421038fb346
SSDEEP 49152:K1hpsNoJpF1A6BU44CwH7R4xxb5+Pl6bJTIZ5jdgp+:KmifPkR6slgJTIZ5Bgp
TLSH
T155B5BE13F2D900E8D05ED17887569232EA62BC460B35B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3e35b652a559d00c84c070c3fcaa7ec825e78c03a7e17039470e8b295327b292
MD5 8287ef712ab8dbdd7224769b66ff3c49
SHA1 512df4039f67c2a7b5cdcbbccba17b57fb9f59a2
SHA512 121a7bf9173f82021c233d4431a002194df2c4758253f212f3ac90e22ac9ba401bd419027daa3a6eff5a400230628b245eb824fd4eb36bcd24860f2828511972
SSDEEP 49152:CSuZQIY0Be2KNRVtOnks6NMHqib5+Pl6bJTIZ5jdgpj:c5dKvi61oslgJTIZ5Bgp
TLSH
T1D9C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1edd3f7ca3e566f249120b4a102b700ecd8c173617a3feb03f94cf0caf533058
MD5 4516de71b3f5dbe32f05c2ff9ccda2ed
SHA1 5daef630be9ac6eb2a8f87c5b8c8e7ec166cc446
SHA512 1088d9a21c5f2b65eac673e648ae5102da8040239f4d2315a972d54e3e9d4c9a63796a9de629fc0230440d4c8dd8f23061947d9b587f4d8997d46efd53f8f8c9
SSDEEP 49152:FhtSn8EApI0figXgiDn0AP5w9b5+Pl6bJTIZ5jdgpC:0X2iypheslgJTIZ5Bgp
TLSH
T1A795BE13F2D900E8D05ED178C7468632E962BC164B35B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 0dbebe2c02b8931f302f0348368dde7b2c819414e818141157d2f23182354478
MD5 983219009e8997162570f204134819a4
SHA1 2b3ad7f936ba9786d48fa5e517e318b2aadb517d
SHA512 5510e6aff0e5a6917949f5d2123c864d1ac39d3e106890e75272fd6565c3421430a2db1096f172a4e6f28fc3fc453500c662d1fa998a624b552864a5cbe30f2b
SSDEEP 24576:Fvmb57GBiOl6a8JTth/RWZvR6wQQ92pN3N:cb5+Pl6bJTIZ5jdgpn
TLSH
T1EC6523828E6B20CAE09B5779D9C9DB00F87DAF56DD8727B6C67D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 490fd94e4869003f2db21c47324900cc2028c56d13dbd56b369feda0830bc76f
MD5 920ed1969a409afe1387f3b92e171175
SHA1 a7995ba8929c0d06fec346a6297d3851683e90c6
SHA512 9ced15a67dd87ffcc503f522e89c8aed13f6cc23c93579d49a0b08c0005f13e763e98719a4706289a1fb3336c7492ee8a3f05e7fadfb5e2f293177a660f62695
SSDEEP 24576:qMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:0b5+Pl6bJTIZ5jdgpD
TLSH
T1CD6523828D6B20CAE09B5779D9C9DB00F879AF57DD8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 56419040e2bc2bdd07115b6a7cd824bf0829b72a83c1f9185fdd404e4a83ac88
MD5 3b4e021108a774172dc7e678150d7a6b
SHA1 0fd50eb755746d99842610fa11e71310aa5976f9
SHA512 8ac36b347de6de32642a6147072bf87f5f527c01c973d76db3dd251c047a3f632d5f31de23cce0edfe3343a393b2159fed47e70db62ad09a833a7e82f4f99dd9
SSDEEP 24576:YWmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:wb5+Pl6bJTIZ5jdgpD
TLSH
T14D6523828D6B20CAE09B5779D9C9DB00F879AF57DD8727B6C67D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 c699729e5a3ddc5c0ffbeb395b822a25ee6036603c241ed3a9442c704be5b6c8
MD5 07fb321fa050809aba42218002da101e
SHA1 fb7c410f9ea4447a37d5ad332ba624d759f29bab
SHA512 b73cf57e15f266abbba9c2703e85746dae39a4ce342314dd60c5aadb102734d73121e9f7375553a9520ef24d1927cdd586cf34ead9385fe0cb815048a9935c10
SSDEEP 24576:Imb57GBiOl6a8JTth/RWZvR6wQQ92pN3P:/b5+Pl6bJTIZ5jdgpl
TLSH
T1EE6523424B6A20C5E4A79379C9D5D700F4B9BE96DF5267FFC675082BAA313883C3130A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 9eeda933662a8342167d346365c7a7582a609e7931c8788cb12476a97b6e978a
MD5 0cd646d7b186c177dbb1c556ee5a17c9
SHA1 43272cca48edea942d7d2b676eec825a1dd32b93
SHA512 aceaaa157f19533b5decbb3f2c0189b24cdfba7ade62b16714712475135142fecefe2e3237c2c8cd87fd3bb79bf4f6a5084cf7132e6740080e8b633cd641049f
SSDEEP 24576:LZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:ob5+Pl6bJTIZ5jdgpq
TLSH
T1B96523828E6B20CAE09B5779D9C9DB00F879AF57DD8727B6C57D042BF134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 942d4d3677f0311a1c34351029d99b6477ea822a6c12f25c310b07e219a66e4f
MD5 9a92532a780d91ab3ada4e17d1741cb7
SHA1 bc53cdd7a31194a2ccbfa23dd07812788a3fb75f
SHA512 3c18de1e71161ee18c85306dde3d6aca6013c23fcb6b76838c0927f5cc7c65998453ce595e5900954a2a1c68f499af89ebca058c20d134bd1a34315c5946261d
SSDEEP 24576:xAmb57GBiOl6a8JTth/RWZvR6wQQ92pN38:9b5+Pl6bJTIZ5jdgpS
TLSH
T13B6523828E6B20CAE09B5779D9C9DB00F879AF57DD8727B6C67D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 6e93298126823bdad0af13492f41ef7bbc996d93a95f15b1443a6bb4ceee33f2
MD5 a186639e1d000afc4d61644e2a4abd3c
SHA1 91fedf89cd09af6a31cc5494928f0d6100eb771a
SHA512 7e54fa586e9b62192ed71f4ce1f9bfd4b8ff6411ec3417093a429de75e64e3ededb80ef640b3bdd44734542586d343ebd1b878bc683d101dddb7921ccce8700b
SSDEEP 24576:Okmb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:gb5+Pl6bJTIZ5jdgpa
TLSH
T1F66523828E6B20CAE09B5779D9C9DB00F87DAF57DD8727B6C67D0427F134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 83a2b37da09e3e5570b9fb8f5aabb379abb1e307cd2c8a38baefb6223050b2f1
MD5 296126dbde976cb21725874415b87750
SHA1 7bad3bdfd890020725558233b127a3106eb3c2c6
SHA512 92467d5c338269642d91d8b4716532fcc1e9d14c1e7515be201b90dff8fa1394ffc86b82862ea99f637575b48027abe193bf3e9791bbc99d30bb71ebbe116de9
SSDEEP 24576:jZM/zFVSOsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:jZM/zfHb5+Pl6bJTIZ5jdgpC
TLSH
T146850295B36018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 8dd986984b5d3d5b07e7de0515c84e8d29cd0ce3a9aba05fb87bb738e20dc2af
MD5 cf2d50266c66b3e231ef551cd2090a4e
SHA1 3ad4f4c948f6949de27871fc75211d4e52151996
SHA512 03ef13d7779d57b3af545d1882b7b744209d918ce6ceef0a532792602b2c1789ca852aeef3dce2e8d6ef7d7a7ae35a8c62ba2f71c7d5c900543edab298421b01
SSDEEP 24576:Z7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:wb5+Pl6bJTIZ5jdgp9
TLSH
T1F6652382896B30CAE09B5779D9C9DB00F87DAF97DD8727B6C57D042BF130389381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 129d24652d8bf8ea2127df3a6ba6778a03c770c5acd7f350d1ce9859d4599ed3
MD5 08978e68726b3ccaa9098d5bf51f2b85
SHA1 5741774e1a06390e16ea4ca525e0f117b13d57d1
SHA512 7b92bc9d8748d1e5c509ba234871c23cd1a622988348b1a38c326a97fccf83a4cdf45ab54598cc4c472fb161cb4a91c55b9e0bb5b67e0ee3137d89549dd5bcc1
SSDEEP 24576:gXmb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:tb5+Pl6bJTIZ5jdgp9
TLSH
T1B0652382896B20CAE05B5779D9C9DB00F87DAF57DD8727B6C67D082BF134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 62386344f80afbd384df916f444203c45ce97088f9b38afe2043d870c93f43ad
MD5 10fb95f1fb643cec5877319e67247713
SHA1 773249cbaa9dea4d2339dcf120288aa3ba591ba5
SHA512 6da5efdae518ee1f836ff2bd913c46467141816c1216b31da41a291d67a0b897e172e0a669f49b932812796381cfbd56469acaec986bd45583294021d65f9ffc
SSDEEP 24576:0zyomb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:0Qb5+Pl6bJTIZ5jdgp4
TLSH
T14275024767A630F9D0678239C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 c3bac67f1f97f5927eaf7e64bfe35daa24618a4c52423080bc25304f6eb913d6
MD5 1b7c45427a621ce5380997086edbba6f
SHA1 7d5254bf0c3e4f512fc6da850d3c5a838995f6a3
SHA512 1b074bb02497fb50803a9a189fa4d655f1c8b5f084bce7a1370f9b66b8e65a94997c99badd048704a2f25ebeab4b3e362d6739326da0375c71f65d51dbc8c897
SSDEEP 24576:P7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3o:6b5+Pl6bJTIZ5jdgp6
TLSH
T151652387896B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D042BF134389381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 b55701036e70510850a45d7c7a4c0f9d452da5be06304da83b81beb10769c23f
MD5 6a123ffbdf94059eb34c602310e7a1f0
SHA1 4e65fe3cc994d393c4605a4b067454845eca156e
SHA512 84c2ac8e6c18e25facfb0b15ba1b0f319a12d464600e7db620250f898887cbeff044832d122a80262b9f43c7a969e0ad95f52adc79c91a3c8bfc731f519ea139
SSDEEP 24576:J7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3j:gb5+Pl6bJTIZ5jdgpF
TLSH
T18E652382896B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D042BF134789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 fe8266b8b52ecd31b3af6a03242121694b8a8f9f0eec1d4e86960cdabe84e985
MD5 61bf4d116ba0681c654e6abbfb4f9ff5
SHA1 c44f73fad8af7e9fbe54eed5efc55a0c25d7fa35
SHA512 1560f789d3d66bc353ca2314e9358c95e7792c2edb00f5fc0e3c445da8b2c9c49042b2ed449d9442b68a8c1ee31a7f3d3ed22cac60818df098b41969491d3701
SSDEEP 24576:Lzyomb57GBiOl6a8JTth/RWZvR6wQQ92pN3Z:LQb5+Pl6bJTIZ5jdgpv
TLSH
T11D75024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 b7b0eb2245a3ad7dbd10ed2d7cf9bcf2e8e59cea1df416cb103f1908e8257d19
MD5 be7f3677c26dedfec546fab918586cec
SHA1 c20453dcb40329cd0be4d31892a613f55daeefb3
SHA512 57d49c68ea9b168bd2960f2a6ff4863102b8393b0fff0928253e062eb1b0eed8380fa93a539154c2f739106d5f137f680c18063b9c8cc416a2b6f8858a5d0d3a
SSDEEP 24576:IT0aLl3z0zDGmb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:ITDLljob5+Pl6bJTIZ5jdgpm
TLSH
T116850295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 bf34837601257567834467e64fa5ca2d713fc120662fa4cfda5ebf24a2a172bf
MD5 85875afe597f00e16111f5b17449bb57
SHA1 863e093d8560fded88b50e228c22f3e172480ab9
SHA512 3f4525c828cc2efdd9ebf86756b11124dc61e9f55e849fa62143f5319327ef8e42490bedbd4449987d6847b5b1334c060585c400520b117458ebea6b3bb504c4
SSDEEP 24576:u3Id9CHKy7GZ6mb57GBiOl6a8JTth/RWZvR6wQQ92pN3Z:wId9CHKyaHb5+Pl6bJTIZ5jdgp/
TLSH
T1E295CF90F3E410E8F0B79A35CDA68611DAB67C5A5B21DE8F03A4251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 3e6bd57908c5253af36b945dffcb6a487a99a7dd997d6af3925b876ccc326305
MD5 0c2d667751216ce18974729a7f1eae7f
SHA1 8d1c18e3afd64c51e6242b6dd1fa31f78e770620
SHA512 9810ec2cfd120ce5d266ed9c142e9ac177f957924fe8010b824f3ce79ce70f5b843805a1f96e2d8e8c3c669a64783eb8cd22cc22d1ea3f882500ef0ae99c93f4
SSDEEP 24576:u2mb57GBiOl6a8JTth/RWZvR6wQQ92pN30:eb5+Pl6bJTIZ5jdgpi
TLSH
T1DB6523828E6B20CAE09B5779D9C9DB00F87DAF57DD8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 de4204faa187340d449f689d83bd79ac673ea5f041ada8c6034f1ec08ab47b7b
MD5 262213f488941680a05300455aad4437
SHA1 150401e554b9b47a93e9f738ca41a5f9df84212e
SHA512 2b1cca2bc7ea8e513d4131aaee9a3a4ab9346662daca684b58c1e4f1b2d01777bd89fbd80e95eb11f89a235828b4b5bc25fcfc6739ffe666303442dbcc57d618
SSDEEP 24576:gImb57GBiOl6a8JTth/RWZvR6wQQ92pN3s:eb5+Pl6bJTIZ5jdgpq
TLSH
T1096523824E7B20CAE09B5779D9C9DB00F879AF56DD8727B6C67D0827F134789381220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 8b80ff5c0b2252a7f673b3e471e680bce2bdf90df9043d5622444fd19a910c2b
MD5 54bf976ab1b2f327c33ce7fcc3de3adc
SHA1 9ae013be820f424be92cca99664ad501cf119e24
SHA512 413b5f463cdac470453d88d76b70c3be3afdf2847e0e52e0b96b12df6fac7386ecefbb56e2d40e206fb4dc48443eb81e319865c8dfc460abe7e4d2a7ed419f92
SSDEEP 24576:Udmb57GBiOl6a8JTth/RWZvR6wQQ92pN3+:jb5+Pl6bJTIZ5jdgpU
TLSH
T1F1652382496B20CAE09B5779D9C9DB00F879AF97DD8727B6C57E042BF134789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 5f544c555bf4bd400d2128ddbe78491a3fa1ddeed72d72ebbb5799612c035a16
MD5 9907a40d14d217f0297aaeddc0848f12
SHA1 ebfadc474b766e87005fd3e8ca6611cbd39fa230
SHA512 1914a6b3d20fb75b3b29f5d53992e1ab2608317f1264ad722546987be4be2ea30c66637f4a3c0b6a9eb1f72d03f8a2a19fdf1658426db4c8e0afc3a560b5bdfd
SSDEEP 24576:c7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3+:Zb5+Pl6bJTIZ5jdgpU
TLSH
T1A0652382896B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D042BF134789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 2337203746f04405031eb9b18afbf7134b0ecd7b77b505fab6deb3f20fc38a0d
MD5 9f01d4c2cec706e9cae5dfb51f576f02
SHA1 043a68927f3577cf45aede4a18d7b8bb3da990b6
SHA512 fd6f438460e33fd1272216db5fce2f896c7f7d6fc25130bfb1a80231d3a46497f8b247208f3f1d386b2a4c76178f3b7d5b3d66edd3a833fa4619b300390f0ef0
SSDEEP 24576:/2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3S:Bb5+Pl6bJTIZ5jdgpg
TLSH
T1926523828D6B20CAE09B5779D9C9DB00F87DAF57DD8727B6C67D042BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 7b37184669e476778a31d7de769ee3e0e59152a2397e294d554efa9fecba3b41
MD5 67e480bfca4fad644c7599ba815393a3
SHA1 7688573b334cd8a5932466cc7a14e9e20054bc7e
SHA512 7992061bae0825313188a6a674a6ae7a4eea40940999825fe219ab074dce70ee32f4c6f87dda1897991fab03b49222f63de40156a3acecae168e8c7dc4fda184
SSDEEP 24576:RTmb57GBiOl6a8JTth/RWZvR6wQQ92pN3+:Ab5+Pl6bJTIZ5jdgp8
TLSH
T1D86523868D6B20CAE09B5779D9C9DB00F87DAF56DD8727B6C67D042BF134389385220A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 61f147deca043a51c2e083c8f3f53e6392c195d2b1222f7c822761d24dc9e213
MD5 2df34de7e1de020394c91be7aa8db198
SHA1 30252ad8611a6eac6d4cf216e3362c2d374fc53f
SHA512 5d61fb0d0f6a667fdaf9a280babdf03bd4cad2dc175729cb9abd38497abe8b31a3dcf79eab11f10c6aa5e3c83b360adfa58e8bce36fb5ef7d4d8dc528d2be613
SSDEEP 24576:sZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:/b5+Pl6bJTIZ5jdgpt
TLSH
T1B16523828D6B20CAE09B5779D9C9DB00F879AF57DD8727B6C67D042BF134389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 390ff7c0bf61e7cb834a0c32e7495ba3672973bc85a989fdad34f4164455b0ab
MD5 84f7bb64fd8fb75e61730536d974b3a9
SHA1 816e10db5e86dc9e09c22b5af4ef96a2d7719338
SHA512 b5a48913ec3bfc074bc585d801da9a352dcf0c23a62bc1c44fdc92e641763afea999ceac843ce8bd0c6764a1daab98b53cde43d8d003d1ec4af8e0de09e4db9f
SSDEEP 24576:hfwvik9RX6wkyAInmb57GBiOl6a8JTth/RWZvR6wQQ92pN3i:9MnYImb5+Pl6bJTIZ5jdgpY
TLSH
T13995CF29EBDC04D5E0B7923C99E7460AF6B178595B31C6CF02AA536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cae7d504f7145868e7f47c7f9e9cf33b050e226b879fcdb7d63bab7d57aca754
MD5 fbf85d1354c2bff6855a4c1fd1026c1f
SHA1 35876c48b34a5e0af1cf75785ae33646ea343543
SHA512 2ca070cea87e83c7ca143c6fafdebc2d758e335b1a0d626e33d5d050fcf7d202fd0da703551abe23967cd080f1dbfac1e6dedffa223efc81c701b5ce0d25d070
SSDEEP 49152:OYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0db5+Pl6bJTIZ6:aySzPhslgJTIZ5Bgp
TLSH
T182066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5bd7c4970b08dc66315fbff4cadcc1b2af4290c37409a89fa875d45597778839
MD5 5153b78388d7d29833ecf661a0a48c9c
SHA1 8140e29864af7e71caba6fe933c553e64a323d57
SHA512 90dd2e0e55f0950149dfe5f5717daf90839e40ad623cf9fc1b1e3bc7d45b98723484d417de1c7e9c23399d29f9ee5bf56a6164b6b8912d42cca8016dca1fb7be
SSDEEP 24576:Q47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY8mb57GBiOl6a8JTth/RWZvR6wQQ925:Q47JUQj4irIhCnDHUPfF/tb5+Pl6bJT1
TLSH
T11A65AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 77da4df065bd3fb06f855ba93ca26630f53385fc7c7d3d8b7f2259d320a9d4f4
MD5 4063a5b4baa408da216049d5a340a79e
SHA1 f75c9062276605ab43696663ce78e2b67af615d0
SHA512 27f92c21bddbeab1b1c33fc7547941ef978974dbfc03ee55d28f06aeb2977083e9477ff778fe4aac8db2d6772eb90ccc4f773c1cd4cd66a2b1f1c614b9e25e2b
SSDEEP 24576:wrmb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:Fb5+Pl6bJTIZ5jdgpx
TLSH
T1B975F14AC29811D9D06E6279CB858A00F7377D65CBE193DB86E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 db4769f7313836914343cee39b12a72ea0cf10d26e1572bf17e887b405d6fe78
MD5 897d554236f6ca321acada72f672b4cf
SHA1 687746d601f92150aee9cea376aeebd114e69c25
SHA512 091cbc289780f1abf130af4b836deb043ad92ac9d7a245b34bb565f5a15722b9525c69f264656d89f022be31057341e714c37bb9f3f135fdf413a014bd8c5f15
SSDEEP 12288:0r45ZU3fEXbNrk2dw8D1Ma9XZHR7oYQDNBWRRMGAiRMaA+7Vcry:0UvUPUNrk/8f7QxURRMGPRMBNy
TLSH
T114351700766ADB4FC6A940321E73D6CCAB707C51EE44AF0773C9873F9576658B6B2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 b514328cb825da182f0c9b9196123c10e2e78fd368b22a1d2e5970f3ecd9091b
MD5 aaca25b2831cabf14baeec2758a124c9
SHA1 16feaf1867c39b75aea3cb7898f071218a0cffc2
SHA512 566e0f12c266241a4ff155038e2b4a50aca068360ad713b835165a3fa3a535941af0b95aedb27e624b49d25d45b49d06d6c4638b23a45cb4bb951d27d60ab723
SSDEEP 12288:0UStJftyNiNUugNBW+rV4dOFqMGOUZ4hm3g8Zk:hNiNUtNBWJp4hmw8Zk
TLSH
T1DD7509405537E78FC1BB503203365B8C7B78EC16BB496F16B389493AD86AA1670F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 1fa1dd8614e1e736e3c9e1ab64065ad64dbe5de7cd0762b607b4fb6bdd6ceebe
MD5 6b2164513998b1d80ad1fae73e35c4b7
SHA1 652bd5922bf0faed8a1a90e837348c0165686168
SHA512 78f051984f03e5b32745513c96cdb4fceb20634e5d23112bf7a4ed1f2616f16216032cdd9e522756a1bfa331c16891f893c895d02445bc20f89051bafdea4411
SSDEEP 24576:EDmb57GBiOl6a8JTth/RWZvR6wQQ92pN3T:Eab5+Pl6bJTIZ5jdgpJ
TLSH
T1E66522428A6A6086E4BB5778D8CDD710B83EBF65CF8566E7C529142AF1307C97C7230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b07bcd3e553de0ca547f8f8589ea45d44c546d68f86af1a2d0a082e0e3616248
MD5 67d41a8a8d2e0a2c71d18901fd68846e
SHA1 2804f57c9140e7cd7dfaeb2ae562142c636008f1
SHA512 0207e625ac7748e9fbc479c2a908010f15de6a6c31b572664bdbbb0abd80191db480745682069cd46ce6c76658b3c297984a840b3e7b8d9fd7d3118eabcf8908
SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bYlmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:agb4mBIBhGFLb5+Pl6bJTIZ5jdgpH
TLSH
T1EB659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 d196bd039aa0468290b9fb845a171ce265419558102ad7c068a056883f8f9472
MD5 9dc1627921c3a5d9d643b82b98286086
SHA1 177801d8d0885ade4dbdc0054254ecc9d81ddc64
SHA512 3120dad8b45d2b91a33bf3f21c3309a11abb3768655147dcca43704598e1edc7ff1c286464c6e315f80f52f1952538b1cd539d213c9b6cce57cdbbc6ee240db7
SSDEEP 24576:qG88u8FpJqH1jzria7/msmb57GBiOl6a8JTth/RWZvR6wQQ92pN3b:R7ZFPqV2a7/Ab5+Pl6bJTIZ5jdgpR
TLSH
T12495F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 aba693b8b9624ca652d4910997d3f7a0c70eeffe9b52f427a251fa9bc1e64124
MD5 8acc4efd84d4aad49a2ba2c636e71814
SHA1 cb822d42b3ad0dc80e97b0464d39d961d24e0a16
SHA512 c89427aa537f59ce8a944266cd2edcc7fe1baf0f6669058a2cfcf2e9f669988022931d2e47c7fa31005a3650006ef28f71f434a5b20a0a0712c6becde2238e93
SSDEEP 49152:7BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj3b5+Pl6bJTIZ5jdgb:EG05lO43bEslgJTIZ5Bgp
TLSH
T187D5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d87c8e2496332b5cd717a160e07756eb075a3cc39ad3449404a03c07b64346d1
MD5 4c7e2484e7c256427a6b71ed2490d37f
SHA1 73d35d3b47a2940fb6c9cb76e73b1aff132d3d19
SHA512 1c68dc9cd46bae8e32406eda5d92aec0adb5ac54fad7ee20e5cbbebc462555a8c2a068dbae9eedd65532c1059d6cd2ebb39e8b91a51a02662008d16628bc29ba
SSDEEP 24576:3fa5POZ3dpqWVM50JicR2hG0lasx2+47eidnSmb57GBiOl6a8JTth/RWZvR6wQQz:Pa5POZ39Jt2pasx2+m/b5+Pl6bJTIZ59
TLSH
T1C865AF5EA6FC01D5D1B9D17DC583861AF5B1342653329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5f94dc35f2312f34e917edf5ae6cd0c4adb63efaf6dd945c85f48e967cde0bef
MD5 fd4b24587d82090ce0287557eefccbd2
SHA1 a486865d27cd92dd1bed3871afba37d483281f02
SHA512 49e057d9052425be4d0f86e585ce27b253075a1ef5d6c6bfe62e1b694b3ef39ffa727d37f4ced88fd46f14346b641357f8b60ed8bb9c4021bfd52bd46c7a1401
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7FkUmb57GBiOl6a8JTth/RWZvR6wQQ92pN3f:JNc/zEOVHFgb5+Pl6bJTIZ5jdgpl
TLSH
T1FA858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fb6c0b14571d02a57d3a4c4820272a5c9efd16fff9a034d330ed874f6bf2d2f3
MD5 2257f09d596913b6ac084585720b3ef1
SHA1 47e9c29b8422164ea6b02b86a776f7272d744eb6
SHA512 b9609a3a1d6dfa73919510e5fb79b25fcfaed17bcf80df35bdc97b6fc0a36151a9917113f317c74316627b9b0af62493ee8105869c718e546e14499da569ef90
SSDEEP 24576:ZtkNvNnaFeYhJNtmZBm+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:ZtMwBtOmhb5+Pl6bJTIZ5jdgpF
TLSH
T1E755AF6EAAB805E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 1d84b234117ef287a4b3380fae06fde9f5c827e928294e4326860b1748230a99
MD5 fd872b6079e296cc427c89ab9fabedbf
SHA1 52f2a37e6e5c8c2e8451c3046c3891cfc60f62a3
SHA512 614c35b34b1e234acfb345b9865dd0e8b7c8fca4f2803c63e0b4cec06dff7fcb26bfcc57f34e89e0e7293189dd3af18b045cc6c695102b890a7f1685ba617044
SSDEEP 24576:2PUr+NQQmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Z:2JQHb5+Pl6bJTIZ5jdgpL
TLSH
T14775F11F26AD18D5E67AA17DC9C68709F771B8624712A2DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 0dc12f5b98d83f1199ec8ae1e3b6d6e7942d828c26d51feeaad69fc5a1bd59bd
MD5 d1292a805fa6752f27b4a5a20fd62a86
SHA1 d4bbabcd83c86353363ab62b38887a58123a61bc
SHA512 5318573a4f0327346d63c1de9f563b8d03fcfceb04c25e309b8f947306a925eeb73d7ff928e736248af1ebcd5119bb1843866ad8666ec7b3d7cbe0f95a045a15
SSDEEP 24576:+D3FHshBIYQgAPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3K:+DVHeBIAAOb5+Pl6bJTIZ5jdgpw
TLSH
T17085E17ED65D00E4E47BD27CDA938A06F67138A9472266DB02D481BA5F2BFD43D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/716-90-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/716-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/716-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/716-83-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/716-321-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/716-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1756-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1756-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1756-120-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1756-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1756-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2572-14-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2572-23-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2572-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2572-82-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2996-102-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2996-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2996-96-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2996-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2996-306-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2996-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3368-122-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3368-128-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3368-131-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3368-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3368-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3520-309-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/3520-115-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3520-114-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/3520-109-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4092-55-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4092-272-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4092-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4092-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4700-39-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4700-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4700-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4700-53-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4700-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4700-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4740-78-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4740-7-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4740-1-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4740-8-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4740-0-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5632-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5632-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5632-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5632-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5800-79-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5800-303-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/6096-288-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/6096-68-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/6096-66-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/6096-74-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download