bfeb67607ca3a6bbac297ee610eb15aae3f48031d0a6f954ae23409783f55060

Analysis

max time kernel
149s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.6MB
Sample261001-mfb3aaab38
SHA256 bfeb67607ca3a6bbac297ee610eb15aae3f48031d0a6f954ae23409783f55060
MD5 8e8c212416dd4288f942a5f3c02ddd5f
SHA1 a29d8092fe5caa0ff161976005b2d2ad805487aa
SHA512 dc47389348e3583616e68d7f11d6682349c90834f72d626e1f2b52fc415960d832d493354803461ad4affaaa3d82284af30958896aafc6520cb4e9c860bc69b6
SSDEEP 24576:2wwoho2uGjRL+ccYDZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2wT+yV6SLNiXicJFFRGNzj3
TLSH
T1F385E05AA3D409F5E9BBD13DC6A24506E2723C558F31D38F03A51A1A2E33791DE3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3152	elevation_service.exe
5412	elevation_service.exe
4488	maintenanceservice.exe
3088	OSE.EXE
2072	PerceptionSimulationService.exe
2936	perfhost.exe
1212	ReFsDedupSvc.exe
124	SensorDataService.exe
6092	ssh-agent.exe
5408	AgentService.exe
4336	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
	\??\F:\	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8f6bc6a2e4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\javaw.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\javaws.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f18415148f51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3e2a3138f51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000114433558f51dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf49f3558f51dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3161a138f51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003eac8b148f51dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3152	elevation_service.exe
3152	elevation_service.exe
3152	elevation_service.exe
3152	elevation_service.exe
3152	elevation_service.exe
3152	elevation_service.exe
3152	elevation_service.exe
5412	elevation_service.exe
5412	elevation_service.exe
5412	elevation_service.exe
5412	elevation_service.exe
5412	elevation_service.exe
5412	elevation_service.exe
5412	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4904	2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	1212	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1212	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1212	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1212	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1212	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1212	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1212	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1212	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1212	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1212	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5408	AgentService.exe
Token: 33	4336	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeDebugPrivilege	3152	elevation_service.exe
Token: SeDebugPrivilege	5412	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 3696	4336	SearchIndexer.exe	101
PID 4336 wrote to memory of 5184	4336	SearchIndexer.exe	102
PID 4336 wrote to memory of 4256	4336	SearchIndexer.exe	103
PID 4336 wrote to memory of 1080	4336	SearchIndexer.exe	104
PID 4336 wrote to memory of 368	4336	SearchIndexer.exe	106
PID 4336 wrote to memory of 4364	4336	SearchIndexer.exe	107
PID 4336 wrote to memory of 3188	4336	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_8e8c212416dd4288f942a5f3c02ddd5f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5412

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4488

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3088

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2072

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2936

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1212

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:124

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6092

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5408

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 2768 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:368
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 2768 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 828de3bfbf95f65a7085cda203c93c1079d387af0f4219763945aa20d2aa6155
MD5 ecb8023d548cbad508a86bfe77b7864e
SHA1 a181f2013514d6f9b3a0f1bfb5027f1850283dfa
SHA512 1177db12eec5f006f2347b6812500f136e246d60376507444c5b11c70a7942c6d9cd25604dfe903fb24a91774e7e8219f21460a7970a28b09c0d77cad991fa14
SSDEEP 49152:mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnbLNiXicJFFRGNzj3:Y3q6sjBc7wRGpj3
TLSH
T1F9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 3df7e95c109e7ae42da134ad2be79280c60504911456af041db6b21110f1b129
MD5 4f1f759256042b625232b9c8b0a49a49
SHA1 2be4b6cd0ae3a040dcef0384eecfe5563c913fda
SHA512 2b048a7b8e3f980c93c6e691c1fbee3bd42149f21a252be10c2d74d47626e06fea1a1ac250d063b38fcaf0ab01cce1bb1583ae8fd43a8112918544d1c806cdb2
SSDEEP 24576:3XYfDtczAQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:itcRLNiXicJFFRGNzj3
TLSH
T1C575012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 773a8b9a71c1569fdde816c1f63cf97b6e735edec40bd25e203e6c6d920c52e4
MD5 35d1074a8fb16c2c33a13181ae32dff0
SHA1 67357c1e31a5d47d33596d07461447a4197a0123
SHA512 fbd99372a346ce305e0f21a4ed5fc565aa69c48d4fd12d44eb7992a649fe9d7c0473b28b72decced2b4a895a3e2494d47bd0318a1c17e32fd13bada41da142d3
SSDEEP 24576:80Le5ji0hmxxrMz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8Pji0AjKLNiXicJFFRGNzj3
TLSH
T1AD95AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b502f50bda423aab0b4196b8301d890fd2963e9246db664e01ed93ac7d4e3986
MD5 c3c1ca462576d20c29ac6b491a743685
SHA1 7c222736975d14130c9ca06ba7dd15f7ee6d0bf4
SHA512 69564f084f2b62213776e2adb5ad2b4aaa914cb8a03d56ab6cd6f5d1411034c2bda8c5c9e690bb88ccec6939fae79bdda0be0b60b3d7f3284bfde5b35afd8436
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWn6q8wyuh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:C/ezSC6vUzPveHjy+LNiXicJFFRGNzj3
TLSH
T195756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d7a87b58295c8606979d1b8b6296a37773bc52b9d63f89b3460130144096f807
MD5 f60f212b68d44411408c7f70f7779f8d
SHA1 fe6483373e8eb378d7a964f3ccce690b2b2684d8
SHA512 2d3e009ebea346dcad26e6fab84f70656fb4b1bc08e8488c2abed2601e24f9c84bb6d86419286bd8b01259f7bc0165638b38081b4cd23ad6d1c1aaa556ffdef2
SSDEEP 24576:ZVbqPb88hv/l+Ys/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZVO88hXl+pLNiXicJFFRGNzj3
TLSH
T1DD559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 65487a393c1ff8a00533244dfb524ae48b77e413015d9f16aaafa48b3acc9c92
MD5 30ad4c68afc4db2e1c6f0f9dca746102
SHA1 15f1a9c97532b76ac54cdb8763ea54ca47cfcbb6
SHA512 56cfd71a531e94e125a5c61db21c1a43546466ea78cbb1c88a90012b3a770969cd55fa4e01efd87d49477b36c73a1cecea14d7e7125439a23e5ce1138ae8d37d
SSDEEP 24576:WLv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0LNiXicJFFRGNzj3
TLSH
T1B25523D3468854B1FBFD003A867A5828B5845E2C8A695DE3D2503E5E913CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 24f123472b87611cfedf5dffdd705be23d8f281871df00a2db1b116ccce4d871
MD5 6e42fe8d6847016c6c6ccb9237000c06
SHA1 a97b9c6114b1b76156d2f3c46051c37b902663a0
SHA512 76a56025f45f267046d7b4c5502ebd69ef4818c70984395444e5fa3f83cfc4bc8f14ad16c936f44b911df37423ceac9aef2df4c3947eec32bdcb2e65c254b692
SSDEEP 24576:oJIUk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oJIUkLNiXicJFFRGNzj3
TLSH
T1E175CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dae0c7bb2fd27c5c0a99898657eb64debfef2063ae71870dd858efad66688648
MD5 49326cc325c82a5a3735e867658e608c
SHA1 0b59e2667e14ce23715db869803ce2645023b762
SHA512 47701ae8ef62f75ac9e986f434c1f5ae87d36deac7e5a20a68b3ae5c73f0e916a12357bccf324fb3af395da69c027daa0c30898d83e85a70d4bdd67086cfbe83
SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THa:kQvGAdlCEL8c/DRNw5Cx7wRGpj3
TLSH
T176266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 b5e8f0f5ce1fee069b8914a02cba083c7bc884072d38641b5b0b12024e7f24b7
MD5 f95fe17c9b60aa565772adc8f9ca327a
SHA1 b1f70c7bf591c824b463c3b28d01465e5f03fd85
SHA512 7ad8c7f7d3fb87233c68aef9c0cb4efb464d2de162ba02dce0a0f12d8790bfa47e85a34311b63cca26fb64cc7a830da67ba8d5d24d9411b6a0d94869559b423f
SSDEEP 24576:80ewsAja/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hljaLNiXicJFFRGNzj3
TLSH
T1B275E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ac24b0f52eb0be48207d9d15f6000b9ffc3e92ff9b01213e622f811a335d40a8
MD5 3c97190de86d58ddca37c9f180303c25
SHA1 d737628de77b452a0e8aed9b5381d53b3955a5c5
SHA512 0412089ec2c237cf59bd8c40bf84c3f475ba754bccb22a175a6f6c9c6d1009e4f78c867d164ae8225e72126b009881bb3be37c78e2d9a0cd21695a7204a91b5c
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHGF9:0UEtQevvqc2W1cpV2tI32q9
TLSH
T13C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c7e12cd1df0738c635e55371abc9758d17ed8fa65b230afdedd066a371cce2f9
MD5 1ad5d2bd4f2effa073300623b9666cea
SHA1 3d396c08813b7c34f5259a9d149635c402118ef0
SHA512 47bc54ef4c6e43caad9b33fcae185fbfba1f2d8c9051e51a5d556edb0940af183c5e5305af8be0b6e478055993efa16dda4c95bc314530f96b8d7cf24fcf6727
SSDEEP 49152:5CbRquA/m2yL5zifFiV+XenmE3/z6LNiXicJFFRGNzj3:WoqHVjnmV7wRGpj3
TLSH
T1BFD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 61b0d41b61feb91c383c3fd3298846da71fb3823980d170e5a04e301e3feb1a1
MD5 9565aab7f907119da316bf9d2f81f1ac
SHA1 29ea7aed72be6d82fa1f33d5316d9c0ccd3bbf0e
SHA512 09e95d0dee3a56ae6956bb33bb897914673ff71df396bdcf5e691dea4ec71d6a286d068b994adce973ee0e6b20c01ab8e49f78fa18f4b1d656b69b2650e814ee
SSDEEP 24576:zAhGL3IFoiwtA5l7S531/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zAMUFoiq5lLNiXicJFFRGNzj3
TLSH
T174359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 7718fabeb103ed86b3bdd276a38a7e8cec9e72f4e1e2fef3d0aa2436b87e2e90
MD5 ddf917230a23d60a1f90fdff30b08ecf
SHA1 3c208966fb99bd3c936ce18fd3fd3763338e00fd
SHA512 caa28e3ceb723c300f2197b61decff9e8c286ae38a5e4139e1dc3564a8ad9f7824141fc66d8e8878fadfd7ce9e1920e3ca754bf56a03e3e6b3523559526e0be1
SSDEEP 24576:7wu4OWe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7wvOZLNiXicJFFRGNzj3
TLSH
T1DC75F18632940CF9E9B641398657C035F7F2BC152A25DB1F4360C65B6F37362AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 3ac287fdb866efde0c34946125e7ed74864e8d600954436736094000988d6691
MD5 9b6a72535969a0e56a814a8aeec9d496
SHA1 7d846e8815192059002fd1c93d8e0ec048a5e668
SHA512 fc7ecebcdfcabb6616a2b10213185ee26a86a835006bfe8b9b8780bd909ab54b4ab44b4402c495575142bef6805befbcba5e1529c41492730ee0891c3c51c974
SSDEEP 24576:DZur/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GLNiXicJFFRGNzj3
TLSH
T14365129622D420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6b6a9a6b42b595a2c3c19596cc697cf77377dbb25040141f2fa314b330c55b98
MD5 1391d57bb3eb7f0c1686b8e7b6420843
SHA1 0250cc20b9140cc826c2a23ce88f6a33e1c53326
SHA512 cff9ada25e2bb15993a30b036f78a89454655b5e4bc159944019cb4e874be1a3082b4d678756212d8f208520b92738ecbbbec62449a9f77af554d32266a63451
SSDEEP 98304:FQRQyi36YOcPbLvw2gAf+PN3o7wRGpj3:8QyiKa/X+PNEF9
TLSH
T121667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7922a1c196afd99e8726d8d5b617512b81616876825cdf9c7569b4a2b1f20e9a
MD5 96dd2c04fb2b36f3ad083be6a91833ad
SHA1 4447f7fc6c67471c479326a5ed39da45f98f47f2
SHA512 bfd7b7356aa9e8a30dbc31b8ea42cfa5b260b463d9b3dfa0bd30d03cfc3fef894b45676ced095ff56986666abe285809ab91ea932d71bfa1991341f3762707af
SSDEEP 98304:rQRQyi36YOcPbLvw2gAf+PN3o7wRGpj3:aQyiKa/X+PNEF9
TLSH
T152667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 111f73e7cc220c99fb25be5f8d129c332c1611b84e16880810dc317144d8e60b
MD5 46ceb70b22109d69c053a85c253c5afd
SHA1 872d8797e1e654924b8a30139f0bb10b68c595fe
SHA512 5e1943d7136721391727a330e02f576a30a05f7db045936fd870b473beda918299365674ddef5ff95ea2aa22e1825f15206d24e959b2aab16cb2a2b360f800ed
SSDEEP 49152:A68Qg55nhceWu7PNU3/KLNiXicJFFRGNzj3:6thLRc/K7wRGpj3
TLSH
T117B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 80675c3f7e96bbd01e7198c15b43787c0e76a775df725eed079758a35fd4f554
MD5 1c623ed430296af6e274f0cf57675003
SHA1 e43c5955612d1fb0541a4912d74395c48843e4a7
SHA512 f10dd28182193111d5e93cf4cca11a29c6f5841153272e14f49dea1c8151d061d4cd2c84ce85a1d4e6877b84b21733e216a98e5a68333654678d13fd20c4457a
SSDEEP 98304:Dy5112gYy5azzVvt69nLKnhZv7wRGpj3:eLIHEWhBF9
TLSH
T16C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0ba8d15045322d974dc852db7dc9f3024b9975e68801c304f3aacee84ae81cb8
MD5 8a863986663b0a956a6b3c24f8f332ba
SHA1 57ade6a4d7e4ec585b9c182b488d9bd8c20a8553
SHA512 f1107a5da499392f32e312e0107bf6034e271bd29cf0849e8a047e4e199d19ba5099a09075c7529d4e82919ee96b33f3035ce646e850d7c9a54f1f79f15a59b4
SSDEEP 49152:NB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glALNiXicJFFRGNzj3:Tu6Jmdxd2dA7wRGpj3
TLSH
T11CD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9331e8da992f521389cf5fe4d0ec952cdf7487e641e2decaf11a7e3d7635a1e9
MD5 57403224049d6639c6e5bbfdfa05a6ce
SHA1 f0ede6dedf4b399993074089f9e1132da9fd533d
SHA512 9806b6af4e611215534504fa98596fb0ebdc4916b0f6e2bf7ff1c9044fe9b38abfa7bb17b49552f1825c2178dcff268e1698f62687f06f1b1fdbbff310ddf2f2
SSDEEP 49152:u1hpsNoJpF1A63U44CwH7R4xELNiXicJFFRGNzj3:umifPWRV7wRGpj3
TLSH
T136B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5cc41a574200d111fcbd97df74e9f8fb1387edf945b68ac2ec4597a4ecc14bd5
MD5 2e11744ec6b149089e6b1483596e87f7
SHA1 c37dc46c93326fecc4ab671dad02cea8cc7ca75e
SHA512 e8172f66dbb7fe7e8669ff6f22ad1649940dba1bca4783efff3a20290c93656a611566a12b6f6111f3bfb225a0665263b2c7246b445674516be2388a0ec19f3d
SSDEEP 49152:5SuZQIY0Be2KcRVtOnks6NMHqrLNiXicJFFRGNzj3:X5dKii61r7wRGpj3
TLSH
T17EC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 65ff9ea101f329d5aa0c20867202d1dd3af7639ff717a695ba39d8b81235fed7
MD5 493bf77b87c2695a820dfc64aab17de1
SHA1 2c83dc6c5583b0c48084a00b0e7a4525b47f5835
SHA512 dd2776807b7270c17913ec9a014f316eecd111aa1d87a4bfc6bb688be2cce534641be68ec103d42a686cccc1de8e8ce1057b7074ff63c32847c2f63990eb98bd
SSDEEP 49152:/htSn8EApI0fig3giDn0AP5wQLNiXicJFFRGNzj3:uX2imph57wRGpj3
TLSH
T15795BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 0d0e1b7238fedc3bee46eb33b1b8752c77b38641965899b1d9c41425fcbee147
MD5 3a1af360ea03bafab5dc997316918392
SHA1 2334a1d3a607bd9ef8ce92c992aed48ab30bc369
SHA512 8e4a1da99f0175d59e8e14c694f217503cf6a9917d7e616b3df1ab9bb22d8dba74a7ddaa54ce233e62e10362ecb328b1687ea5c984165949b5b0d7c36f1b5b9c
SSDEEP 12288:8TiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1555523D2548955B1FABC003AC6754428F5882E1DEB5619E3E3483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 f6832da061af438ecedc267135f0b4c879edf50a25fbf89f514f19e9429868c7
MD5 5e70635ba1584e8965325ed70983286a
SHA1 04185f514858d8bf3b5c4350582477e758b90ca5
SHA512 b9b5574aeed2ac253b910fb133470c483ace4e20bb737440540c0f0da49b4bc3126080d0e5d7ddf974827216dc7f6f955f37087bac1c424477a2b8f3f19af7ae
SSDEEP 12288:jciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B65523D2548955B1FABC0039C6754428F5881E2DEB6619E3E3483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 3fd093da2ea0109d2b94936b36bb74fae02c05597f5284d712ccc2767dc613f3
MD5 48e9a1373f6c5c5d7807795a98dd3b78
SHA1 e85272f1cf832565160cf2f7f31f406d27ab958e
SHA512 30d3206e87eb97dcc4fd8ba9c1ade6f9395037a7a687ef34bb19a19798194307e1e8320ae070741270da9cb07c58ceaf4e69e4da34620c51c6be7f97db371ae8
SSDEEP 12288:C6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CF5523D2548955B1FAFC003AC6764428F5881E1DEB5658E3E2483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 e3633df79025a452462aa328c38df3ad0690ce6f45f7a17c10bfbf64c48507f7
MD5 c8aaa36c652414c9735305a6bcf0a571
SHA1 fc42cccab0b51d6654ed1908210d7139c459ce49
SHA512 3ece499f16e46ceb72d38bc7afc7b698ba08cf22041aed1ec221b196b34dbba026f6ed50127478ff7cd9cabf5c81af8a8dbf05be89c4b5601a0c0545147cdcca
SSDEEP 12288:GVJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FD552392168901F1E9FD8039CA764424F2A47D6CD7325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 e3e210f1220a256b4be4f8ca1ec4c3e8d5cdd1c1195f6b96a5e7224229b0ba0e
MD5 b46af1305880c42b653f5a701d76f66a
SHA1 4cd553e9c5389ff130cd297cd56b54c29ee265e3
SHA512 809a51e937d03ddafbe24806e299b1b41d1d13a26279eedc324f5992502b034bb6c2ac3c6e37101f762abfffcccf35a8a26e23a58d1aa1a6f15812cbec359cfa
SSDEEP 12288:CRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FB5523D2548955B1F6BC003AC6764428F5881E2DEB5618E3E3483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 0836062b04bc28cc96293c6b836de320088ba937d311206c9c05392c1a6d8ed1
MD5 411ec06d2ae99ff178435cdb39901bcf
SHA1 84e838222be438de46d24177c4910b6e74ee1b9b
SHA512 98e4b747cb5c81982804a6396331fe7ba3fc0f89bd3b1fdb4c103b1f1ce4718c6665ed3c167dd019b6e1deb00d2015d41557c88182630ac881bf2f642f093638
SSDEEP 12288:qgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11D5523D2548955B1F6BC003AC6754428F5882E2DEB5619E3E3483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 fc48fb34dd2a1f15909fa5cea09e7ba950f355ddcdc58c3bdfa9e41633e9508e
MD5 015fe44dd2e3710620d2e512450accb1
SHA1 f67657ba1e3b81b1e0737af58e6fff743c943ecb
SHA512 380e132ad2f60da53c0fc8ebff5347138afe44e38911a40a2c3cbcb36854353cb44b8655e9331de2d6e35213af7e1b42f59db4f395f8b28d4b083f2a5b46e43e
SSDEEP 12288:FEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:FO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1785523D2548955B1FABC0039C6754428F5882E2DDB6659E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 8eff3db22bd8fbc57dd389e5883e9fb5a8ba367838a161c12000143e25bf4ce7
MD5 95420f96cb0c23352996bb07f36aad8a
SHA1 403e92e0f385291ebcbd6b8a7a08f96b89e2f0e3
SHA512 eca9d9ffab1756b48535909e9b57826ea8c56626b7fc29331f8e7b388799def32adb5e7fb06b528b98022a3eb841bbe833060dd890e97955b84bb5b408e6991f
SSDEEP 24576:uZMRzFVSOG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uZMRzfCLNiXicJFFRGNzj3
TLSH
T168750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 a2fbcedec2ffeece4929b3f5e2147fcaa8494240b43b7273fceaed6bb3fcbd91
MD5 e5206c2720dedae31488a30d7df4a95f
SHA1 420dc1cad4855400824a06d688002d8c764c718b
SHA512 6659b23e88686080afde9347b18f37082bc52b79c5a6292319e54a47c2123c03331db6933f502b1a0b47e83ce4543d879b1e695475be2f663d00cf0cc14b1681
SSDEEP 12288:+PiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1025523D3548955B1FABC0039C6764428F5881E1DEB5659E3E2483D1EE238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 0cdb7d06fecbbe56e7291507f71ad8ab71a144ed70b86dd0880820714929a4c2
MD5 2b72e39ebb0ded762db884ff76125925
SHA1 4aecff4d54784e1bfe6773faa1da4d4845ca1c40
SHA512 43ff3ba4ecbf5b68b69d3a8aa82a5de09d965df4ff275c9a3f80f3c26d6cf5cbdf257ce074de5e624ed7b597597f80551ad24b91b9407f84f7866fc8410a2453
SSDEEP 12288:IriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1775523D3548955B1FABC003986754428F5882E2DEB5659E3E3083D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 714b502a8b120d7e66c88b5adcd1b82aaf293f2ad4f07f1c28446dcc5ec5784e
MD5 60f9377ccdcb5e843b6faa92702850e8
SHA1 ccfd16d37337fdfc727aaf11231e385a847509dc
SHA512 beb9bf0a2614fc59ec67540118231651147c895ebd086bd24744310fcb3b92b9f34a033486460156e5a721a6bb562709390e8fbedea1b04bd5eef3b2ecb502fc
SSDEEP 24576:szyq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:s5LNiXicJFFRGNzj3
TLSH
T1BB650247629530F9E17A4139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 0d75477de473457a4c4df515b3e8272cf85979948d8b51d6f245a19ee5581588
MD5 e6f4fb028db52c3e03d3adfa5632a88e
SHA1 2194779913cf6dcd524f5aaa82f8afd43608809a
SHA512 9bbc7b3dfe205eae6b5330c14afb70d1de05f604bcb3a13cc310de4d14e6384c5c8a7f9d43a83576d22e28088c3e0d66f718b7eb82c01d16a0797f2bb929795e
SSDEEP 12288:pPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:p7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F65523D3548955B1FABC0039C6764428F5881E1DEB5659E3E2483D1EE238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 11707c8c4fe5f0ea2a0861b050237ccb64ee9b47e72114ec0372509f19b000a4
MD5 21c76ac6dbb8fbb751e1f840aa65390e
SHA1 6f66da70deae130ec6af67b4613c853e62ff1998
SHA512 1a599050c7aacdf764c859d19458bd5a14bfb4c7bb4ce332417984afa1048f001823061e6981567f76a4c7ad75c84f0f9e982be019143d07c3a3e9ba109171b4
SSDEEP 12288:uPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:u7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1415523D3548955B1FAFC003986754428F5881E2DEB5659E3E2483D1EE238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 487e1087638ae768c148020e440066255144d4a398fc46c5550ef77b06b9deee
MD5 cb7fc7fffe262166ffe10f797b7f69e5
SHA1 9b919e2959e2cdc1ef3556739adf1a9533d80502
SHA512 94bfd8f4914fb7ff4306bead9b48db77d94b75f95e5d29eb434ada10862c27ead4b9fc12c1ba71f732e0b2d467c1ba12de1e497042f21a9a6a264e2da1adffc7
SSDEEP 24576:Dzyq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:D5LNiXicJFFRGNzj3
TLSH
T1C8650247629530F9E17A4139C9620911F7B17C3647208AEF53642A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 dd92d2bdd23b8fb06256094a72d1521e27e7ff78d49963b0cc597273d004bd40
MD5 d62e1ee77f8a1ac3523cbb3085d43e00
SHA1 132ef58d688f7d38b7fa8eeb4e10396b33fece92
SHA512 29a25cc3ebee7a81d997401ed311f6b3d6e07f5fb478f4752693e99d2a86ce3c235a00f80c72b5f42d07b1733339d190eeebda8bfe8d867a2d591a6ff7efb997
SSDEEP 24576:dTDaLl3z0zDM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dTuLljhLNiXicJFFRGNzj3
TLSH
T1237502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 cc3e80f356ac315150bb95a1afaf6f2bf599a7bd473fe61d0e343682d9e43f53
MD5 e8f83f3fcd51f8ef24a026911f7fde97
SHA1 08f9ecccbc391eee9972420f87f76cf7287cdd73
SHA512 9f08cc9c33ab21ebd65b42a6edaec26e1a150ba48bc2ac2625081080a39b0ddacd5560899c122ea07f1031bfa60164cba5f401abd52804439907baf6b37ab7f8
SSDEEP 24576:q3vd9CHKy7GZI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Mvd9CHKyaCLNiXicJFFRGNzj3
TLSH
T11885CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 82b2b5728c9882ad01c95352c787db8da578ebc6e73e4e1f99176e250c29bb34
MD5 828b1ab036ce111d266ddcebf29a1f81
SHA1 43adb17530ccae7ce5e517c571c412a428a72ebd
SHA512 20a3b1ed22381d3cecdfdcd3e167f7cd56386977260720aa3c999402611f7e5b2ad4b99c1c31bf616bbf95d36437d8c1bbee22dc27a98793dd773bb4efe4c034
SSDEEP 12288:laiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:l8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D75523D2548955B1FABC0039C6764428F5881E2DEB5658E3E2483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 2cc929f5fa75aa3741ae1a01f988e2418938535b4e9f7cf3433b427116bcba1e
MD5 21c73bd56785530f8d0d6ae21676ccaa
SHA1 af68c34fa6026c08039b4e45fcf8921887e8c348
SHA512 8aee20f79587eb7104039d720b48d33961fc2e501ed4b60f87e7d63ddd644101e74e45521be9427e584452d936e5a3ab2779e926e53cf851fd6b4ee627f5dbde
SSDEEP 12288:b4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FA5523D2558955B1FABC003A86764424F5882E2DDB6619E3E3443D1EE27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 9a67bb06a5b1398c4c2c3474ab0bf8a8c91397e3822245bd98cf951a0019e8f6
MD5 ed0a2ee185eb57f039ff25020f895960
SHA1 5ee835c20efa5db3f18de25789d02f5c8d8eb283
SHA512 b35779faf7903694a83b81c4ffda3e1113c20cab47c9979f87aa6b35251845fa4ddb8542d24d83f147cbfc20fdeadd63f6edf3281a39dbbada91903d69b30a84
SSDEEP 12288:RFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:RJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1195523D2548955B1EAFC0039C6764428F5882E1DEB5658E3E2483D1EE23CFEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 2c61f085e2107be5b58efde36029810efed843b2f0d6c13cabfc60c5728c0db8
MD5 11498cc5569d1e810fd90c538686ec9b
SHA1 c46d68f62c91d80d7d5f6601048706e7fdaba4d4
SHA512 1896ba5b732b4ba20c2994935fe2ee6aec50bc025cb40df6dd07c25e9c8420f9509647b8acfd6f5dce55c7870eaab7fc9d9379d411a7c1f434a3a15f6f971d49
SSDEEP 12288:gPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:g7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C25523D3548955B1FABC003AC6764428F5881E1DEB5659E3E2483D1EA238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 a8128ea8e50601ba645e61a399f04ad9bd84ac73fce7bbd39c3432668ea14693
MD5 3d5561e38f9d341d89d7856f4764914e
SHA1 fded11da8a1b86b98d3a7bb86bea4df94450fe36
SHA512 b642947345ad582fe504c08674568a42c4dac974b7ddc058dd323680ab15df291cd6bef1aa330b848ebfced0e821515aae64c1d3ba389ac264b68a2428118feb
SSDEEP 12288:saiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17F5523D2548955B1F6BC0039C6764428F5881E2DEB5658E3E3483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 2ba3f27095038e6faa3c7cca123379142c8a302af0225bd78de526f424b3e4fb
MD5 ebafcae397f2c3d23a7ac7cbefabb245
SHA1 c79287c0d31676d9d572dd6b92107d0b84df18b7
SHA512 7c0067171105ba49240f5f15bc27726d34c5be237a485136f63b0b4467d0be82da37b511fef9707a5242f79fc500d5e85410012ddfcba059165f33e2060852e1
SSDEEP 12288:zXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14D5523D2548955B1EABC003AC6764424F5882E2DEB5659E3E3043D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 a228b8e04d790b7bd4175b24687106923fa9acb9a0f1a65d04a07ca989dbda2b
MD5 6d05a04771478c483b5397acbc7c00b1
SHA1 785ada7855396c692cda2c0cb03b70be559130ea
SHA512 ee5f674422170b9ef7e6632b711d2a2a661eb27e1a0834990e35e2f31416b0864c2edae4a7d9d683664e751499dfb838ed3263ddc10ceedf9ceb5f9a4c6de4ef
SSDEEP 12288:VRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Vd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C85523D2548955B1F6FC003AC6764428F5881E2DEB5658E3E2483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 c4f2e2a070ec59300e28b1025fc17073f6ea3647d94a6ee3c62fe301204f9916
MD5 d56c3654b688b82a67f4053d27b838c1
SHA1 203442a3f330144abb1ff7a16aa495e69721d50a
SHA512 31aad482a4646e5c5da146e1a3aa93fc0a39bf532890a33771730df787750c84e7e4387425848e459999c64f8803641549edd3bd89b557dc1b1178d347b70216
SSDEEP 12288:zSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:z0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1635523D2548955B1EABC003AC6754424F5882E2DEB5659E3E3043D1EE238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 1101122cc427c9a6f829bcb64e6bc953935a196e6dcf17c9567b623b0c873122
MD5 60e2cd496e0fd8051daba8a5b824dc63
SHA1 dc68df5156a035eb99b26130db243389ec24e936
SHA512 edbcd51cb5ab89b885ee66590d5a0f7edc3cf454ac0c068af28b68fc60fcdd0b510e70da80e0109082d3852f5e3ba80655e5124a3ea88111cce86013b6df91f8
SSDEEP 24576:qfwvUk9RX6wkyAIP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6MnYIPLNiXicJFFRGNzj3
TLSH
T15285DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9cc7f53fe7bca01c7cba56671d40bfad0d97d8a3a38899d4ee0c2b8547b599ed
MD5 ddf30fefe444b6ffc0e0155f8d27f7a3
SHA1 a15d5ca021b241b07134651a93eb82200c6396f6
SHA512 5e5278ae3cc8cf97656f2a89e2aadef3e831e00426a9398e6732e7074402dbd0f1dc1e8e58c88089c6427ed4af6199f5b3e37bc5358ac58047e6fe7e8db9c49f
SSDEEP 49152:EYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wLNiXicJFFRGN:zySzPI7wRGpj3
TLSH
T1E3066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 32a26bca86ffcaa438c3e0cf1594d0cbc8d5897e7a2abbfde628a4055dfb97d6
MD5 662dc20e57b2ab0415a4c230bcc15f5f
SHA1 8c615e02738d9b1be99d1d8eebd213d629272c4c
SHA512 60fc32a21b2516f83d2d39ae25ffe9c083f40432688e0fa4f4da9f9f125245406f03f795f72717e15a307509ef08e5709380d5f3aad96d2f6e83cf72b9d5ba1e
SSDEEP 24576:347Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:347JUQjTirIhCnDHUPfF/ALNiXicJFFS
TLSH
T1A265AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 858165306e31ddffbc0f73f37094a08389d41e12b60bcf79c28a321b89106a85
MD5 d77031c4ba2c2a91262f8b372a378e6d
SHA1 faa9378e8d7a2cbf0c82a0a0f2f7682b27886b18
SHA512 9463b59a37476126d5da9b1aab06a3e73d5191ede9bb0f3aa23395c302179d8c0f1c97e9ed402fa752fdc592d61d799065d1860c389921d5860acad1afedca6e
SSDEEP 12288:AbsffiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BB65F15AD28802E8D1AE5139C7564900F3637C2987E1D3CB92C0F93E1F7AAD59EE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 c73d9fcad313e7fa0d722194f70066bbd697992c67cfe358cb9d00ae1a1c4bcc
MD5 df6283360413e2689fe9261e1fefcf43
SHA1 bb466d09ae3e4893e5904329b46163cc475cfd2e
SHA512 11654d42006477a713ef2d10a75318529c0a92911768d48f875f16392ac81295bb6848cea14f203d86225dfb71e0c5917c7133e2f14938e053c6ef5a79055efa
SSDEEP 12288:AuJzOU3fivb3pOFbt888DHnjxZyjhOCVEywuZ/nttV:AuJiUPiLQB+jxZwhTVEyw4/nt/
TLSH
T1785538007626DB8FC6A940322E36D6CCA7707D15FE44AF1773C9873F9476658B6B2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 03049e8d9285a9fe5b14917ea41198840fb9a92c6b03eb832fd951c473b0531b
MD5 6d1c82f04d6bc4163750e4ed8bf3e7ef
SHA1 3a7f537bf5d551dce93147b6fef1c5552a0446e1
SHA512 5015ccb71910b445f5d9d815ad21071fb3b19e753d27933ddcb9fa1cef526e3b40921c074ffcadd2fffaa37b1c56570ae2b15521754856bfbe3fc8b10a804315
SSDEEP 12288:odg2hAR1NicHSf7cwWTR6DRvxrz5M37Tc8RKz7+r/EHKUccEV7cz:N8eDNyTcBRqu3Eqwz
TLSH
T12555190065A7EB4FC97A8037133286CDBBB46C0AB7853F0573458939987796EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 5e6357de7bfc04dce07cd13d5ea6df92db2f2276964138b51e745e1fc90dd738
MD5 dcd795e28334c70bc81819a088f510cf
SHA1 d86afee07d359a825d5525d190d5c093c12905af
SHA512 b70c333371c5f1994a780b0829a46d30d6863f13201317b414ee141a0f6925b2e2fddbd72fd6558596cc621dcd5dbd43ce9e35bb1daf35101eddfcad79097ce9
SSDEEP 12288:9z7niJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:FT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19B5523A3568859B1FAFD0039857A8434B54D7E2C9F1558E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 565a169507c9f152a352b171ecf15c791b62894a5ef10c5b2f66e3af8ec42b24
MD5 ec0625f51f77d402b420e8d0c0bc9462
SHA1 893ad944419d749d9e6bbb78e8332e5b173b4edd
SHA512 ce484ad3e02e04be19fecd9368697d4c0a32e803cfe2a44f24e1e12b433a91c417324caa37f2eff4a9860335b57ab38603da155189088416aa1ed35c654cd33a
SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bYh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Jgb4mBIBhGFWLNiXicJFFRGNzj3
TLSH
T1EF65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 8bc62496512379cfdeeef756edb576859c751c06e543e794cdbd3ad3e5e80e21
MD5 17a883edbbed07731ffe935bb23afe63
SHA1 5f19366a82be944a5fa214b51e29cd2c62756d0a
SHA512 f52a998d19d9d2e76b73f71f2d9fdd5abad553bfe12acb73847f0b2273b2bbe653db331b1dad6e6d4e9d813ff02577cb729b928f9346652024a3a03f5972da37
SSDEEP 24576:2G88u8FpJqH1bzria7/mG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:d7ZFPqVea7/pLNiXicJFFRGNzj3
TLSH
T14F95F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f6ce02217e017772c191aa1e5588e26238b481b3dd12b91744106cf9f28391a5
MD5 d8914b3a6b4dfdb28ecc9fda054b969a
SHA1 50f761b6a68c38fd407be917c9908ef743467ad9
SHA512 4355fa6baa4928cce5b3804ebe62f594ead86d10f8a65b17d42ab2aae70ee7fd90716f3ea5677430cd831458b9931c5742faae9e03a55a56b453b6ec5f27bed2
SSDEEP 24576:ePUr+NQC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eJQCLNiXicJFFRGNzj3
TLSH
T15075F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ea8a97cede65a7e520561920f4b1e6008eefcf98b8f66f46c8efbddc576568e5
MD5 1e8780b66b6726a0594e67a838ffbf83
SHA1 a7293e5b916003637824cdc06e5295a2ad3e07c4
SHA512 a29d3dc3ac283b58ce72085f2b8c87a4c49a48043504443858df53fa32d4cd96c39c4331ebc9acce652dfac48555b45563de3ff5aa15bdcd5ff3e046aa657e09
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjyLNiXicJFFRGNzj3:5G05lO43b37wRGpj3
TLSH
T1E1D5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 24c9900deaf1a406ebbbebe1d078f3c8384f03c9e4e86b658616009f3edfd051
MD5 911adfdbc62ed36a0d0689ce0e539ab8
SHA1 5623907f7566ba19dcb1da449466dc5ec98b0475
SHA512 eaeb65a031d9e5ec3e0b25f4d8607e596121d871dc204381652b3c436cc578f12f592917356c225dd3d527cee377b336660a79f63bba6338a7eb54fa055fe49d
SSDEEP 24576:Zfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnw/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ja5POZ3BJt2pasx2+mKLNiXicJFFRGNf
TLSH
T15665BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 50f15c8fe16cc255e845b28e3b901e5903ded913547bf56b8160bdbbbe39ec3f
MD5 ca4b3185433c5aa19cce00affe72f5aa
SHA1 ac419134150c25a2cf648794f57f485c54c0b4f5
SHA512 ec10aa8c599e68954ace20b60d7faf0ca98ca88898c20c632b5bd7cc841202fd957a8307950b7cd3286cbac300553c279f66a78e5e839ae4dbccaf5fdbc27159
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7Fk+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JNc/zEOVHFJLNiXicJFFRGNzj3
TLSH
T15D858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 598f8855e0ef5fc3310c4670159c77ee5081a485313d2fb2799a6aa59b8e99ce
MD5 a6e44908b975b03e9596f85e229b38dc
SHA1 a21e6fc725eba61ab10811cf5c79f0ed794e2297
SHA512 cce8b07698d8f02c763f62e93c6b3e41cd815c115b11f850a23dc772893d889b450bfee34ead5dd2c849f9dfee732bf6546788163ae5612e5639d19aa5abb2cd
SSDEEP 24576:eTkNvNnaFeYhJNtmZBm0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eTMwBtOm0LNiXicJFFRGNzj3
TLSH
T15555AF6EB6A846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 14611f830e51878f74f2af33ef3891249cf50844aaa8c29b9cb234843335c360
MD5 9b45ce034d2a50a775eb02d0c957988d
SHA1 991d143303c2ab48a2c5d6d1eb0f619a7a661175
SHA512 c704f1facece287811576d13aed240df3412315a439621b4961f2f1f6a24eeca67a6c9cf461c367d08b7987cc2288ef77834757b86c7c7a9558d8186a1686809
SSDEEP 24576:0D3FHshBIYQgAH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0DVHeBIAAHLNiXicJFFRGNzj3
TLSH
T10985E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-100-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/124-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/124-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/124-314-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/124-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/124-108-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1212-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1212-382-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1212-87-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1212-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1212-93-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1212-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2072-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2072-67-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2072-65-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/2072-308-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/2936-77-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/2936-82-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/2936-85-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2936-310-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/3088-286-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/3088-55-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3088-54-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/3088-61-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3152-22-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3152-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3152-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3152-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3152-15-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4336-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4336-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4336-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4336-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4488-47-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/4488-52-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/4488-50-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4488-39-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4488-45-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4904-8-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/4904-1-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/4904-7-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/4904-318-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/4904-322-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/4904-95-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/4904-0-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/5408-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5408-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5408-127-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5408-138-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5408-133-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5412-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5412-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5412-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5412-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5412-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6092-122-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/6092-120-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/6092-114-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/6092-313-0x0000000140000000-0x00000001402AF000-memory.dmp

Download