c5b2c393cc07defbb3095b13739ba6bb43acf4b143bc5ad16c1bfd9c975e6289

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 23:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.6MB
Sample261002-3l4bqaxzhy
SHA256 c5b2c393cc07defbb3095b13739ba6bb43acf4b143bc5ad16c1bfd9c975e6289
MD5 e809792c7ffaf047c6d4a79afe14476b
SHA1 d93bfdac1dd7adef4dd98411c9ae9a7e782c0505
SHA512 6db5454b8e844e5ee93cd7e2aff31cd38d3f47d827fb7500b931a7b94cf61ffa06b6afab48c857934d427ebaa6e969cc425d2fc138d39c74bffa7d546c3e361c
SSDEEP 24576:uPKqkoHgyeLThKIJJI1+DMp7CjWgNlPU51Ncv:kgpvY1+DMCjz7PU5u
TLSH
T12175AD5AA6A803E4C4B6D1388952E53AF9713C56433097DB17D1BF2B3F32AE1993B710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1836	elevation_service.exe
1840	elevation_service.exe
1148	maintenanceservice.exe
1048	OSE.EXE
4920	PerceptionSimulationService.exe
1640	perfhost.exe
4284	ReFsDedupSvc.exe
1408	SensorDataService.exe
1336	ssh-agent.exe
5516	AgentService.exe
2056	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
	\??\F:\	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
	\??\F:\	elevation_service.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\85e6543f7465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\java.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e2a05f8c652dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000c8ab2f8c652dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb18b139c752dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000682cd6f7c652dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000216e70f8c652dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1836	elevation_service.exe
1836	elevation_service.exe
1836	elevation_service.exe
1836	elevation_service.exe
1836	elevation_service.exe
1836	elevation_service.exe
1836	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe
1840	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6048	2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	5516	AgentService.exe
Token: SeBackupPrivilege	4284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4284	ReFsDedupSvc.exe
Token: 33	2056	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeDebugPrivilege	1836	elevation_service.exe
Token: SeDebugPrivilege	1840	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 200	2056	SearchIndexer.exe	99
PID 2056 wrote to memory of 4584	2056	SearchIndexer.exe	100
PID 2056 wrote to memory of 4800	2056	SearchIndexer.exe	101
PID 2056 wrote to memory of 2156	2056	SearchIndexer.exe	102
PID 2056 wrote to memory of 3004	2056	SearchIndexer.exe	107
PID 2056 wrote to memory of 6124	2056	SearchIndexer.exe	108
PID 2056 wrote to memory of 1092	2056	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1148

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1048

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4920

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1640

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4284

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1408

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1336

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5516

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4584
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4800
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2900 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2156
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3004
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2900 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 19e7150bbc5bee7a2aea17ba5e1436dd2469cc0fd1f98e115e54f8bcdba0c52e
MD5 f5d00326afa17af96e18d517fa58f0e3
SHA1 4d042eafae24744f4debd5c11a90de43cfecd4b0
SHA512 6e558e5af13e6f99ccd5c1d1a727fd69b93392db9a16ad9ef820ab47da5c4fde1649e140fdbb43ed2d5fd674a9b1a265e7bf7847533a8ad466eb220943d9dbf1
SSDEEP 49152:vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnDY1+DMCjz7PU5u:t3q6HjBD1+DMU72u
TLSH
T173D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a950021be2cb901f40b6cfa224126ac80de1c8b6be72bc6cb0067c4a903994c4
MD5 0238886d1dd9b7f7d534cadfb6e16867
SHA1 4e2f2a7cc8e89403d4a318bedc5b5a82e757285f
SHA512 c08b3e64241d76312507f929cf0e2c9957c0efed42b11919ff4d4fa5f72bb6226093314ef9535c4b45790a156dfb7e0208d2480442da439c8bb7d09677f0e954
SSDEEP 24576:vXYfDtczAuJJI1+DMp7CjWgNlPU51Ncv:atcFY1+DMCjz7PU5u
TLSH
T1AD05F129B7D409FDEC67823DCDA28501E673B89543A4E79B03A8D5260F336C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b89206f5bb7059a3a06d1a69c4eee200a922f750fbc2f143fca7d2780294ab55
MD5 f7d4e0e4225f5fdf6980194d10655d48
SHA1 90b2857bec1a6025934d3cfc23d5b4cc651c2a75
SHA512 ff289ddebcabcec48dd485c5ed7711924fd2efb4a962d61156118864e009b97a5fda37972ff03fc0410cacacd11febd9c7c61e277907eb5f62f4ee230d668ca0
SSDEEP 24576:o0Le5ji0hmxirMrJJI1+DMp7CjWgNlPU51Ncv:oPji0AcsY1+DMCjz7PU5u
TLSH
T17B359E16F6788335D073C0B9C5D2A68EE972308617308ACB4296D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6bab5165e43ab615456bc5fefe62227db7f4441c9bc8d6ca859a3f45e3bec123
MD5 46018bc50e4a35b3c24b845c8289b42f
SHA1 027e6fa89bc095b8da32562ada4944acebcf68b5
SHA512 32ef9b5866f6a0a54fc46576ea882e96465a6daf4353b2155a3bafd168008ebf2987d2fc0bf2e44f8d32950728cfc98035fc311f16fb38bd98dcfd180935cfce
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWE6q8wyu1JJI1+DMp7CjWgNlPU51Ncv:9/ezSC6vUzPvxHjyQY1+DMCjz7PU5u
TLSH
T158756D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fdc0a4a49b37bc0dedeca7f9c7c01426d9c2162a64651a1ee66e87ba3965ad8a
MD5 c37e3991efb1573aec2234ed2d469f44
SHA1 f0a4bc0f01a5e60a5e243c644a1a9200daf8d26a
SHA512 2c7ef66f17dffa661acdb54ba16136c443bd5e703a92336350b75a2baa7f75066bfac6f369e1c7fde880bf4beb5c2f8ab44f8900f2906835659f348a75b2eaa6
SSDEEP 24576:TVbqPb88hv/l+66JJI1+DMp7CjWgNlPU51Ncv:TVO88hXl+PY1+DMCjz7PU5u
TLSH
T1C3559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 9b1c3a6de3313a8e37227ab02e46076a6f5990a7ee6f3a3f5abdfd7acc43c1ff
MD5 310876bb38e922e3b04f90098d6e9dfd
SHA1 fc850309ade0af1854a62173f2d1ab2be18d10eb
SHA512 4d80970784762c8a852b9d1cc32a2958188877f43709d743ec0f12d49586759a03f0985a7d509190da4c95531d39b649c6ff5ead3ef602e3d35e6895176cf84b
SSDEEP 12288:CRnnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:CRnJJI1+DMp7CjWgNlPU51Ncv
TLSH
T14AC42396ABCC15CDDE7792372EB799C61443ADC231C87B7166BDF266493DC808363A02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 af01e5571b33c557d91600c121accf1c2dc14e7a9105961ac7864aaa8637a152
MD5 47e1c935b6408025490f1c2b65fd0230
SHA1 d774c6f4b71ff6a2f221a989294345df893bf706
SHA512 e11f48f53bcd45cf8e57e2d0c057ad83c1b877d3b14af95fce702e6cbf5d6a2e979c233d329dfcd7ec1b5f66e82fa5c8170a00418ff90ed0f02a2858fd65a9c8
SSDEEP 12288:aeBNUbTVO86UCnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:aJIUCJJI1+DMp7CjWgNlPU51Ncv
TLSH
T12105CF3BEE28FCD2C27A8DB95B918640A76278714B51A3CBD175C30ECE235D05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0ddd8d62909e27ff3f7a1edcfc8e400c659ff57096e0fc984a79915ac2d04315
MD5 48d6984a5635170aac1b048de617e28c
SHA1 3c03ea8522a57356084dc81f0d2a69906fd874a6
SHA512 364700ab507b4fdaea5fc7c446f1b634e608073d1cb4a2ecd16f2fcb97eb527cf67315e284811f5b5699ebdadaa396f62cd4010630298acfeaf73d4f07570493
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THO:pQvGAdlCEL8c/yRNw5Cu1+DMU72u
TLSH
T14A266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 71bb0e0688c8e7397c23b1f2880777b29c0b3185e8af5329994da865af879c87
MD5 4dcc3a0c828218aa0240ea685604a2b8
SHA1 241c5ffd5f9254b5bf44ac8bddbd66a0016342fc
SHA512 1274333e49d2191dc805acb686dc4060415d23438fc224132e7d1c0e421cdfccdcbca1bb437a91ac8055a5341290405c7984311a2fd00d8a41f4f597154a7dc8
SSDEEP 12288:PAwSfxL/2Dc34DLLmt0LDQewsAjcnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkL:YdewsAjcJJI1+DMp7CjWgNlPU51Ncv
TLSH
T1FB15E031FE74E436C67B0DB61B36C706146DB9604B912AC3E3F89A9E49346C22376E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 196311f81819d655f17d71cd61d25c5911d574a0f2eef7a2cd8ac405676cfa0a
MD5 07189a4cbc24949b7fde888adb3fba74
SHA1 e5c4a02e1f1aa383ce40b36493c9bed63b3b8a08
SHA512 a7238950aa445607e9c8ad7d734813a6649d074060e11206ac6207effb8a19606c000d3cf26ef6737dba06808e7b14f50af910be00447bad7c1cf407ccf3ad78
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHlcl72u:oUEtQevvqc2W1cpV2EI32lcVv
TLSH
T1CA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ad7ac9c07f3dc240517f6dca829d98cd7bb1505726a8d2b24332ec7ccef2f2ac
MD5 4075beb9156e95e07714e6aadbde7746
SHA1 eaf5072e32714d25035d2497bfec0aca6a3baede
SHA512 4d0e1d2bde3d3ce0be17993555b9b2d1f6cf33d34164c67c93a59ff42cf741973578cf180a18fa977c158a197614287db4a0068c4200ce7552bdd87973b4980e
SSDEEP 49152:dCbRquA/m2yL5zifFiV+XenmE3/z8Y1+DMCjz7PU5u:aoqHVjnmS1+DMU72u
TLSH
T137D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e5b632c2fc9d5e660fdd7665784ecb126bb5d7a5329f5f90ccb56bfd75171bd1
MD5 66b94d0de5c67c37039a161059d9e45f
SHA1 b03c336a9c289afdf9af97d7aefaa83c8834a706
SHA512 2fe264b1e3c0058c5f54f148f45e99513ddeec25bcc0cab94acdb3fd0366763cf9c57364bcdf039892d0d599afe13d73abeca47c624c20c1d9827760ef28d247
SSDEEP 24576:rAhGLJIFoiwtA5l7S53JJJI1+DMp7CjWgNlPU51Ncv:rAMyFoiq5ZY1+DMCjz7PU5u
TLSH
T13135AD81EBF915D4F5B3AA7899B68171AA77BCA65E31D20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 f53ec882f4440243f5c0c36d6003743778e5ce00cf83e218c47161f515869bab
MD5 5774a230fc9b000f5c982d6a6d5ba37c
SHA1 ac329ffd39d051ddecbd291fe05f2059c59c4416
SHA512 96894a0a09bf2a0fdd422c158719aa7505786a557c5e7aae2cc3d59aaa550b562a3cc37c062f36dd2dc29c92ab441cca4adec460056c95d4d81b98a088cec0be
SSDEEP 12288:gmw5HEjsChNVBFgl0WDm+CVnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLm:9wuoOWwJJI1+DMp7CjWgNlPU51Ncv
TLSH
T12205F14677E80CF9E96782398597C136F7F3B8022A25DB1F1360C65B5F372516E2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 be37b4d1d7df6c26a62de4da0d380d0fe40e29a81bbd115292f512b094820ecc
MD5 94002392f8f6583fad0b1a73921a111e
SHA1 f7ea57778469a95b0c96b18d68dbe2b46b505051
SHA512 610b7cd8d7f2211fdd3ea430d9377fe2ab8aced5f135030ae835d16227663bec2934294905c22eb6d12f9762e41130984ba290410bff683d11fdc359932513a0
SSDEEP 12288:ZBZ1IyMnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:3ZuzJJI1+DMp7CjWgNlPU51Ncv
TLSH
T12AE4129A37D820FDE563923E8DF2464593A37893336553DF1268926A0F37EC10E36722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d827bf648ea350f55203c2e70c6e674cf4edfe80e1e415559aad5d4c3e94dd12
MD5 558f876b8b8a9df2d48e9b9d9908b863
SHA1 f292143d89cdaff21bd5ee74042b7163a5fffe15
SHA512 28ddea727de4c0a56279d5bfc19a61bf9a7834b27c32968f6ee5f459f6b097931ab8c86978c6e9d0954789fbe7fabb9aed8750e2b15be8a7428c8e9a736766b0
SSDEEP 98304:vQRQyi36YOcPQLvw2gAf+PN3f1+DMU72u:eQyiKayX+PNvcl72u
TLSH
T1E2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5f1059b4b41bf0429381947e0c9bb75387229aafe6c70b9c984c3e6963d8570c
MD5 c40b166d4c9894aad7be1e78235591b8
SHA1 a0147130c3a9de888ee96dd2b70619ce4f2d4bf8
SHA512 a2b1d844d8f0e625d38e9ca92ac63408fcb40dfe36b3ec38dc1901529419760a302319ca5d75827e54d53f51180eed02f6f111f9251f60a1b22ea9986344fc7d
SSDEEP 98304:wQRQyi36YOcPQLvw2gAf+PN3f1+DMU72u:nQyiKayX+PNvcl72u
TLSH
T1B9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9137f6e5605e4a76b9ad76ff0a3e6ea2bd32c822e2010dee1636c25601f66ed2
MD5 3fecfb889e44c110e20a59abb469c02c
SHA1 8b4081e8d90ea0641c4167c792efc9661b2693a0
SHA512 beb93390c39a23278de37c5775bfc28fbe42530abca3afb10b3799b7b8a3239ec2aa639c23c28326130461b857fe6ea06d3bc1807bfd20a26f89a4c4dd2aff4d
SSDEEP 49152:T68Qg55nhheWu7PNU3/sY1+DMCjz7PU5u:NthWRc/t1+DMU72u
TLSH
T10CB55A33B2F60099C44DE1769F4A872196D27C718FE0E3DB8515721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fefe404febd1a8c2a0866b41df92d1cb2420cebce5219984df628a4a55e3fde7
MD5 0d82c7903c936995929a3aa7d8a08de5
SHA1 fe9cbe9d90baa16b905f0420eafe6744948b3760
SHA512 fc735fa66b8868620b387ba69992d90c412a5b911186e8d3910d38c097ed8b515c586bca697063b8c21c617dffd38785948aa4672aca05fe0459d1b3551ad06b
SSDEEP 98304:cy5112gYy5azzVvL69nLKnhZY1+DMU72u:dLIHmWh6cl72u
TLSH
T12D167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b9b432fafa8e5ecb9546287cbc258170805110bbb2b80b987d349784f4f1a259
MD5 29e9d00f1df685970dccb74a13d82e79
SHA1 4a76ad10b2306a5f74680a3cd9fc90a78f696342
SHA512 6652083853b164ff160118cf4cc3f8e755f2db131c18725bdb3b8eb32536e27b991bdb4c3a615e115ad162be8d2a150543905e8701b004cdb77c1507cf4c3435
SSDEEP 49152:eB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl+Y1+DMCjz7PU5u:Mu6JmVxd2d31+DMU72u
TLSH
T191D59D13F1DA01E8D06ED479974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6d87065b8d596b72dc1b76b5568dd76603b616f6037e6c0afb5245d080842bd2
MD5 2270a76300b3b858988db980b800f134
SHA1 643b2564139b8b32c84c780452db1175d1f8e67f
SHA512 968d2289cf60424c0efabe35fda0fc30e85f06e26677fbfad163d485c90108753841031db8ceb7ffbbd670aba8e4d651a149022bb8ff69b27a9f5b12bb7b12df
SSDEEP 49152:J1hpsNoJpF1A6UU44CwH7R4xiY1+DMCjz7PU5u:JmifPbRS1+DMU72u
TLSH
T14BB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6df9a98e5445d1fca7584d2f1934c03a29b1686a8e32c279efc7bc1274777153
MD5 bd1153b2bbe3f85c3eed8739b39e2f06
SHA1 86359a0c23f28557f63d0602c278e807bbb5894b
SHA512 476670330c05754e9b646a5925e0b37b1447202b7e39a022032ac3a41d411cefe2236c2a48185df6fe8b7d5811cbdf3dc5afc951728f2c1d2c9fb34676715e34
SSDEEP 49152:USuZQIY0Be2KRRVtOnks6NMHqzY1+DMCjz7PU5u:G5dKTi6101+DMU72u
TLSH
T15AC5BF13F2E901E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e3f551ff98cb96d2b0e8d073d2925fb6eed2f606d50081fdb523dbfadece6c38
MD5 d1cf7fb01dc0539e62b135d248e0c2f6
SHA1 5edf113463ff431b3f9e418cab93bb2d73b97206
SHA512 40c9b6280428e0b9df2c233af48180f1b5a1a425bc136c2c18bdab9c3cd11d813a2b44849c99e07c837a0d2557823a4ca02d1c97d3cd5f9f33187aaa1b6e2320
SSDEEP 49152:mhtSn8EApI0figngiDn0AP5wuY1+DMCjz7PU5u:nX2iyph21+DMU72u
TLSH
T13495BE13F2D900E8D05ED179C7568632E962BC160B34BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 354acb4f8e138f452b659c041e0ab4a7d4c3e6b2090fb61b1a012e20bf089b54
MD5 2a830b07d1ae21f153335ba6bb0f47c7
SHA1 3a1d74fc632358271a56eb56a38c5e83c370cc39
SHA512 cec660b37012c584b2ee573c71593fde106faa1a15272c94f248c682471f535b640a842142043cb7a435501ca02ec373110a0468e04335a967883c7dfb6f0892
SSDEEP 12288:9PnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:9PJJI1+DMp7CjWgNlPU51Ncv
TLSH
T193C42356BACD19CDE927D23B5EA356C61483BEC772C9377136BDF1264A3AC800363A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 3f18a0b7f8cb3cd220b0b869c59e4447f3a0f80997cb9b96fc0d016df311791a
MD5 417dd0c75cfe5444d74c53629120b520
SHA1 2b42d77c7d5bf7a73143dbdfafcea90a7e41a450
SHA512 915bb479d2d3693239cefe96b1705eb732b91d54e1e1b66241281a9e965d23e16aa3e280d65de1a14ae068e2c96439a524ccc7262044ff77db7b279ca2cfce60
SSDEEP 12288:7InJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:7IJJI1+DMp7CjWgNlPU51Ncv
TLSH
T131C42366BACD09CDE927D2371EA396C61443BEC732C9377576BDF1264A3AC800363A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 13762e7ded13a1a2da61311a03213b4d491b8838b329c558ab59318358c005e9
MD5 9c395216ed6a9072c5040676a64d1f15
SHA1 9f1595b9e13b4c2a92ea3b05acd69db76a560aba
SHA512 959a8024e3cd30b6ec8c521b120f013970404a475df63cf093ae0e2c4a7f4e95f9e3f5b49d1266995ee179d6200be3ae5ba0fe4d3a356f20f6a54b49a5e715db
SSDEEP 12288:CKnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:CKJJI1+DMp7CjWgNlPU51Ncv
TLSH
T1D5C42366BACD19CDD827D23B1EA356C61483BDC772C9377576BEF1264A3AC800363A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 910db420a0cf929d36e66ffbba32f12bdc3b007520edc951054cd8532eb402cc
MD5 52e3608cc6f08bd1331e2dbfb50261a5
SHA1 a0ad5e6fe6ebbb961111adecd45b44abbbbeeb2c
SHA512 fd5542058eeceb52d992c8369840ac2554b51d6be17d9690e17014845dc08423f7b5a4586d0ac77c8fc397ed234c363ab8d994e410223163c83a7498ba2910a7
SSDEEP 12288:gVpnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:SJJI1+DMp7CjWgNlPU51Ncv
TLSH
T188D422567BDD01CDD837D23B8EB285822193BCC6739577BB6669E12A0E36EC01633B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 271bdd7cfe93f11e69c54890f1d4bb229b2add69612b4622d66b0d003895fc10
MD5 8d6087197cd1f896a8e1a8368eed60c7
SHA1 feec71214f2b24da257a9cf84245762f2a84f179
SHA512 14cdd65e3ee4968d1aa0f31c69e8bdf6bff0b1ea4a069e8e8040ee42287df0c2b1632121ee63e48424c10f5d2c7cfd61ddd5ca2902ef14a6f6a997d3f8b8cb93
SSDEEP 12288:yBnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:yBJJI1+DMp7CjWgNlPU51Ncv
TLSH
T17AC42356BACD198DD827D23B1EA356C61483BEC732C9377576BDF1264A3EC800363A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c489993afa9dab7fea9001300839218f3e3a768fd6d45b8c3d553588e2064839
MD5 70224903819a1dd1f041bc28013a7643
SHA1 bfa4566cc59960b8978262ebfd2e4c2a64ae4059
SHA512 0c861f830b65e14b98230a96a8d2fc026c883c8bd552b73bca5d6bddaec90296d136677ea9db1658000e5ef1ad52dda8d16a15259cb12471bc3a9355fc9907d3
SSDEEP 12288:lknJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:lkJJI1+DMp7CjWgNlPU51Ncv
TLSH
T172C42366BACD19CDD927D23B1EA396C61443BEC732C9377536BDF1264A3AC800363A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 9104a60d6163903ad5b284268a723ee4e453102e8be9b7047dfe4c86f274f6ed
MD5 2a4af9599d84a28587cf76125e0a2e3b
SHA1 924149a00d87cd8d4d912de711494dc03ab828d8
SHA512 e9cffcc0b3bc95fd8c23badda78ecd48f26f45ee639a3b4c661342d946c79caedfaf66c4964a5677afb5e956d107b37e562e7fed8f79d2cc0b4de20852b05c25
SSDEEP 12288:TAnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:TAJJI1+DMp7CjWgNlPU51Ncv
TLSH
T10FC42366FACD098DD827D23B1EA296C51483BEC772C93771767DF1264A3EC800363A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 2c8bd9788cc65c27e0fab23a730d1274e45f02862350c125b6f8eb0d74a284ca
MD5 7c76e3f8939c7bd1d9b9aae789cf6827
SHA1 41af5226573c3c0cfe2c28ae1dd74326773954ca
SHA512 0fedcc7a46d72cbb1637bd9b5db4f30586bdde0908ed2f51803de6e489d344ecdb941ff9f0da798baabe8e1aaf59dc955e0d7f7957b1e4429ebb34930615e016
SSDEEP 24576:sZMSzFVSOoJJI1+DMp7CjWgNlPU51Ncv:sZMSzfUY1+DMCjz7PU5u
TLSH
T11E0501A5B39018F8EC67823ECD668906D2B27C5A17A0C61F13B872275F337911D3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 cafd078ee6fa953e3ec763ef97dc241ebf7b96fa06a520b6653b101c965df344
MD5 fe2e2609e0b7ca628d30b8f6cbacae17
SHA1 c7ea1523402cbcbaa545eaf0ee3ed9e1e4ab4db2
SHA512 d9a2fe1291207135742e00b9ffd5994d43f43464bee4dfbec19285bff7dc1808d6ee11563a3ca37294dd4a4750c75c279b3f5c32d3bdf0255036ce43fa45ba13
SSDEEP 12288:0jnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:0jJJI1+DMp7CjWgNlPU51Ncv
TLSH
T1E7C42356BACD198DE927D23B1EA356C51483BEC732C9377166BEF1264A3AC800363A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 6a7b790216fca95fb29509927e4d9d67cdd4d6125f983e65d2576c95debcec32
MD5 b6ae051c704d973844259cf47c03c0eb
SHA1 602f896bc81c7efcf1fb329d355a44be0f823942
SHA512 288be71e6a26cbffed7ebac9bbed9a594e574a6d45442966c719c3f3d024612aa33961eb60de6041a63197d81d51e5590fada7dc2a4e10d4428721817412630d
SSDEEP 12288:tXnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:tXJJI1+DMp7CjWgNlPU51Ncv
TLSH
T15BC42367BACD09CDE927D23B1EA296C51443BEC772C93771767DE1264A3EC800363A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 43f77fe53ccfbff13fb75444e9647f2d8e048f09376b5898a384545d94f2010f
MD5 2d94bee0fa6b28c788a7db31d639ab2c
SHA1 a0fe0d0b59cae8a073b096f3c9760a23de658381
SHA512 af8970e97bc6375f2c2d8e9e1c928dca532138c4f14042858b6eae40b770ffcc1245937509c8072bba7e39c93474ed307147f5a3a9aed6eb991f2a4b2be10a13
SSDEEP 12288:AyPz5L8MnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:xzyMJJI1+DMp7CjWgNlPU51Ncv
TLSH
T167F4025777A530FDD53782398DA21A42B372B87217549BAF13A482761F37AC05E3BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 3399ca9df694173761aa03cd1614071da8a41a1a8aa3ab96537ad7f03af133f0
MD5 2f2ce0d29115d05d41052ab02b8da2d8
SHA1 4748568afccd5593178e339809b1295a14e309cc
SHA512 f88a3bcfcd271623ce1087d640c173a8f738f6cf86f1d32e5e2afceba6eb8719d31da60dff5759d30009ffba7c1c300c6a2eab707a14fbbf50c28f3a99f5a616
SSDEEP 12288:/jnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:/jJJI1+DMp7CjWgNlPU51Ncv
TLSH
T135C42357BACD19CDE927D23B1EA356C51483BEC732C9377166BEF1264A3AC800363A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 2da87b93a5ecd2ef0b6735996cd4fc7fcb320e19ce464da6445c8b5b36251068
MD5 ab41a38869debfb344c4e360fed4da92
SHA1 77aeb1a9d36374b3ac2f43a1c72e3a6a854bd284
SHA512 babcfee42ec95611bc15d65889a090c1619d105ef47cd747b40b6e23374e2c58733cfc26a92920e990aca893bb414ee55735335c106ebfe9a3f6d4f6db117bfc
SSDEEP 12288:mjnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:mjJJI1+DMp7CjWgNlPU51Ncv
TLSH
T183C42356BACD19CDE926D23B1EA256C51483BEC732C9377176BEF1264A3AC800363A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 0cc6edc9361310e6707cd945850a4630fcdc4c7c91b7746577f98e77f1de6e0a
MD5 1eac54d4be01a7952a28c1e5f85306ce
SHA1 3a54d1adaa0bbc14ef00868f8b4bb73cebda709d
SHA512 406492dfdd956d019ebefc650e5e46c1cb5d385894fe3682dca45633e3374e69e08dc8ca1d1aee3f31eee53f325952186f0f8680282a88233143878e0882dc0d
SSDEEP 12288:jyPz5L8MnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:OzyMJJI1+DMp7CjWgNlPU51Ncv
TLSH
T145F4025777A530FDD53782398DA21A42B372B87217549BAF13A482761F37AC05E3BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 6c80d3295b088c676feaff9b89da3e98326444dd21ee3f71a8da24f569ca6b18
MD5 40fd8b4d1c37d61a2d37e6d3bd4af4a3
SHA1 0a31f1c4b21a482952ad635e1e7c8a76764a3af4
SHA512 5bc8a18ae3d56ff9da39318bce206dadf5633ffa9eeffd445232ff64d4cd57bceb3871796860db88d7a0752c34fa20305b125d6cd09d3bae0cdf7fca20970567
SSDEEP 24576:aTHaLl3z0zDaJJI1+DMp7CjWgNlPU51Ncv:aT6Llj1Y1+DMCjz7PU5u
TLSH
T1270501A5B39018F8EC67823ECD668946D2B27C5A17A0C61F13B876274F337901D3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 5bf133dbecd1c4ffee42ed76aab769befb51a9e5595372eb8e894e051b09aaa4
MD5 a5cb19f9cd0408e7d9f8cfb5f0d62cef
SHA1 893ce4f89b9650341716cd39f2eea1b267c35b7e
SHA512 748bf17f810b14391cbdd935b26f0865e8fd236aafe51d7ac3d628f8f8504655adfbce6c0b691e4d57256244f514bc32c39b3b783574ca9d7c76f760c95a8fc2
SSDEEP 24576:137d9CHKy7GZ2JJI1+DMp7CjWgNlPU51Ncv:V7d9CHKyaUY1+DMCjz7PU5u
TLSH
T17F25CF90F3E414E8F0B7DA358D764501DAB67C9A1B61DE8F03A8651A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 549e808148d058d6197bba8b57873bbc78ff2ebb5bb86e1aa92ad2995176a2fd
MD5 bba7660f6e8f03f7943001a50be25743
SHA1 31a4737a7a67347b7555abf897d0e39279f47be5
SHA512 f9e397ad57296309a67383f2f2013d43797b6d398eac8e49a3faac7a13f9e0fbc255f53a954e39528587051e9c5995894de1007f4fe507feff674b1ab2b02782
SSDEEP 12288:HqnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:HqJJI1+DMp7CjWgNlPU51Ncv
TLSH
T1B6C42366BACD19CDD827D23B1EA756C61483BDC732C9377176BDF1264A3AC800363A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 38920ff2a038edc3e188f85f79f0bd0455107ff5d283d01bf984dbf0e99873b2
MD5 3e53cc56a3a1acb28c102dfdd389f2b6
SHA1 ee4f7c66f01f9b2dbe8eee86f05587672f6c1e27
SHA512 0ce0d8699bd0add4f5b0b0904af4bb09afe5e7b8d07a39768777492d8a828800dc499bf83ffeb6bc61cdf175fc30ffe301545853450cb0b81bcb4f43ed2fe7cf
SSDEEP 12288:dsnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:dsJJI1+DMp7CjWgNlPU51Ncv
TLSH
T191C42366BACD09CDE827D27B1EA796C51443BEC772C9377176BDE1264A3EC800363A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 a9eee744cf6b052f678eb7c854e1ff9806ae67650dbcbf9d8fe4ef76dbf152ce
MD5 5756a612beee07df93e6e7d28832c53f
SHA1 93a475d1183feecb21ba74ae48332769070a9f4f
SHA512 f4e488ce2524d6328fa217aa5fc1927b2a32e02b6fce02a75439bb31bb8285015e2fc8358ff0c7b394e93d8be740bb94c33384a944a603b25321938416ecf543
SSDEEP 12288:otnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:otJJI1+DMp7CjWgNlPU51Ncv
TLSH
T186C42366BACD198DD826D23B1EA756C51483BEC732C9377176BEF1264A3EC800363A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 214d718e9c5c3b7f9b35573ebfeadefb95b84c4e5dd7eedf3c86381783dcd20e
MD5 f20731ef5a044b83b79e613c820a3be7
SHA1 559fedd2644dbac7e69b587dff1d8bffc2794f80
SHA512 c57f2c472ee763859a7531532ebefa3e4c8b84acf0fc80c14f0736c61cf2af8fdb1aca833fbfcbe4045188ed99dba61b57221579459d320e865f252eabdac3f6
SSDEEP 12288:6jnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:6jJJI1+DMp7CjWgNlPU51Ncv
TLSH
T191C42366BACD198DE927D23B1EA356C51483BDC732C9377176BDF1264A3EC800363A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 50a6e119abd71a84c6a2abcc13e6a7a299d036e096c01fd15e582df17908f44f
MD5 8c78198ab2022e2721628ac0753b0aca
SHA1 46b7fb650f19b0b4597ca7e5c6a23d9d0065650d
SHA512 701af61680c8cb8dd04f43b588c24695c252db9308a66553beed9c88a4fcf5056dd95105671228dba5c6b4b31d1879d61b3b41b0d5f5159f1f3cf462220982d2
SSDEEP 12288:3qnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:3qJJI1+DMp7CjWgNlPU51Ncv
TLSH
T1BDC42366BACD19CDD827D23B1EA756C61483BDC732C9377576BEF1264A3AC800363A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 bde78c54c5112806ab2d4c2ddf0795ffd3e2dad1bdb773312c3a6ecf5abe1af7
MD5 af1b470c2269c8945fd13658277a6bf8
SHA1 2b256d044d6d7e2c454f83bbcccc43a2b61fc626
SHA512 f9badbfda5310eaed70057eeb2702e8080c8d68ab451e0fc9245c571f5eda5f648ed123306e28c02c9b05758211fa02cb86851c1252219e63584df59f163d2ee
SSDEEP 12288:V7nJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:V7JJI1+DMp7CjWgNlPU51Ncv
TLSH
T116C42366BACD09CDD827D27B1EA356C61487BEC732C93771767EF1264A3AC800363A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 61d488bbeb97ab63020b5858b434f8ef7b8bcc10c50fb89db5568111dff0b902
MD5 98a980b96dd9b35ae1fd733d5e36b2fe
SHA1 928c4dc98eadc241c807d1d163f94e70baadab20
SHA512 43bcbaf0f1318879080658b32321f3353f4f97dfb4dad3a93483221a6c1a7f1e8219025909b2b9abac4d9aee53370f776d295f9028f95aed8359c9f43a4da9c5
SSDEEP 12288:3BnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:3BJJI1+DMp7CjWgNlPU51Ncv
TLSH
T17FC42366BACD158DE827D23B1EA356C61483BDC732C9377576BEF1264A3EC800363A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 7347264f19a32cc547b72316d63bb0eb3b9aa24589c6fbfa7e7c04c30cb93ddf
MD5 863cc6ad3f64e10a5bfbe035e850abfc
SHA1 6fcbac8b744d9ccccce6aae593d553d33f1d9996
SHA512 77841489e9b34a5cf24723f1d160db0ca59ce45472c38f48506197e287ee6e1cc7ca7333b504394498c80f670cea427d0a819382eda738b89f8375356fb5e377
SSDEEP 12288:eynJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:eyJJI1+DMp7CjWgNlPU51Ncv
TLSH
T112C42356BACD09CDD826D27B1EA396C51487BEC772C93771767EF1264A3EC800363A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 cbb4fcd835bba6bcb6cfdaa0f9e2a4fc869e82a6926ca6f27f9760faff30df6a
MD5 abdb4f538c2eb6c67bead192b471f0c0
SHA1 6da7bbaf311081c4cdfb4565334a57a8cfed7202
SHA512 eccdf45f6b6b075b3dee4637b79df5426190a17fb77b705248f94a5a3298661f86a0b768f23f3dcd94af42f742ebbd2122f32a9c0d07fe083b4d14cd9598c76f
SSDEEP 12288:kBnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:kBJJI1+DMp7CjWgNlPU51Ncv
TLSH
T1E2C42366BACD19CDD826D23B1EA356C61483BDC732C9377576BEF1264A3EC800363A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 8481d35b4fc4fce10e945ced55296a4e489999a3d2a753d7461ad737809f4600
MD5 9b674493962b6cc9e500fcab0449011c
SHA1 2f8c9acbb1a55e9644180f74b25d1f04bbdd4fae
SHA512 0a119be974b5e4aecf461ac4e2f3bc9a76e97324b96e7c006ebbbe554c4027baf38a461d391b4f991257161432010791308414d10bdec17b206fa51e06a9bba4
SSDEEP 24576:bfwvok9RX6wkyAIHJJI1+DMp7CjWgNlPU51Ncv:9MnYIHY1+DMCjz7PU5u
TLSH
T1F835DF29EBDC04E5E177923C99B3460AF6B278591B31C6CF129A536D0E37ED05E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8eaeb7316782fbec46c2029310179894316d0050e94643274f315fa70a230af6
MD5 85f0ead2299bba47e046580b684de5a6
SHA1 fa8d2ca55e0659423a22cde1b2354e6d460cbff1
SHA512 55817e68db057da27d35b8c220f72c9fa5f0d5142c2a8c078dd05cef7858249be3a64ccb15b26652260c45e133ca7df16ac2e3db4835ca874b30a6242f5f993f
SSDEEP 49152:2YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0OY1+DMCjz7PUw:oySzP/1+DMU72u
TLSH
T1F3066C56A1A801D9C1B9C1B98F1BCC1BFA7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d1dbef9a2e3d3d3053fa8ed3205f5b49ff654471fced8b74f3cb744dfeb125ab
MD5 3e2707697bdca2dbab66d81e067a1a93
SHA1 99a0c5af204132a2be835b21e26ea0f3b054e34d
SHA512 f587ef8bd91f49830a6d9c3cc671d9ec9e70617afe697d9f83c0aac8da9764b0ced8d1365d72ce27a226424e43cc2aaa671094587e40164f766477560dbfcb78
SSDEEP 24576:l47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYYJJI1+DMp7CjWgNlPU51Ncv:l47JUQj1irIhCnDHUPfF/+Y1+DMCjz7v
TLSH
T1D365AE1EA3EC01E5E1BAD27885154A5AEA71742E1B31DACF2270837D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 2fb202d548084ad611f1f3b940a7f03cc80a485b8fbcaf85dd3544b60622bb2a
MD5 38717ad936296003cc2d5cab7e846d67
SHA1 17f121ce0180c00cb6e549e33ab382ab4b2124d6
SHA512 3a900c41b27f3c54e5526c97369fbeea2f2bed6928ebf14e5597769cbc0fa826915648d6571a4392c23c8869ab6dd1be95fcb8e6da58a9bac80b0246b704bf14
SSDEEP 12288:tNsfznJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:CzJJI1+DMp7CjWgNlPU51Ncv
TLSH
T127E4F15AD29802D8C46EA23ACB564A41B3637C5653E1E3DB53D4F53E0F369C05EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 43e0f903c09c29ab1cbef0bc9f7ed2bc66b3c3f296aabbd717793e4e2b3d1c39
MD5 b27789e3887ac0725d5e71ace28cdb9e
SHA1 314767f356c76a5cd4d2faff24a02920a3599b1d
SHA512 e23e6c12a6705fe9e860426c51c3d30736774c3147b69b05790fe539fe431c01b12f6a29031fd662a93c4ddfc9faa9f103bfe25a9fb0878715286a6cdc2f9144
SSDEEP 12288:yJE2wXtU3fPi32rIl4zyr8WMLQcoSPsiF0Qi8wznwN:yJEBdUP3Il4z+4LQco6siF0QNwznwN
TLSH
T19125F6017666DB4FCA6940322E33C5CCAB707D01EE05AB0773C9873FD576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 90356633c9b37a873450e4fa8c705d10f8cd3d31e376d47d305ed715fe35e8dd
MD5 9e1442fd543420e84ab011cb468be5ef
SHA1 17366225341280c85488bfd3f9f4a92b493a089a
SHA512 ddea55c994d2f6c4a44af2be0fff69b1ad5ae663c56e247d9849dc34a9e27071b3e6325943dca58addb0f3e2cc314792211367552195d5e8218b6ea61e135c4a
SSDEEP 6144:aj9cl5h765eKPJArDl/E/BAzQytMx/4A0sF1n+2F2GQytMxlIMzm6sPP:aj9cl5hMhSZEr2KPP
TLSH
T15045E9415137E38FC1BB6132072A9F8C7BA4EC07B6496F26B3C9453AD82A75160B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 593f9ebee17273db5a59a47cff84bff2f1cf8a2ed856e11fddafe1ccbde3bf85
MD5 9aa9f27512dc143f88adcc72e4bed6b3
SHA1 2981c51b6b1e93679a9fc81e73c45322b313c59e
SHA512 050b596361d5cdc7d41070d528b2dc61c69b7e56f5aafafffe9ea3a1bde54d83f6d30d3a0b55d04bae7cf1fcb608cacc4d9571ffebaa28ea06a01d7f661cec8e
SSDEEP 12288:rz7LnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:rLJJI1+DMp7CjWgNlPU51Ncv
TLSH
T130D42362ABCC198DEC3B92361DAB95512407BE96378476F3B56DF2664939CC00F73B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 df47854f4d1d00c812fce11947bbc2f4ad32e879d5eb27c61d5bf76f84f352d3
MD5 eacd870e9aa544559d2b2d24aeb49b20
SHA1 5430d589c71c93bbc50afa5d843bd7b677058030
SHA512 b45c683cbd4ebc672d36de96c40e3b491ec13012ea4b66dceff424aca358c15dbce915d9174d5e67267f447883b23548142832ae83fab93c5a5febdb1ee69004
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bY1JJI1+DMp7CjWgNlPU51Ncv:vgb4mBIBhGFYY1+DMCjz7PU5u
TLSH
T106659E1E22EC02F5E0FAD2B89DAA4417D6B378161731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 40a46719e38232077f9bc691213fcb798f6ccc94b735525d8fdecf606b4c295d
MD5 97cd6c1e37dec6206aea1a426847a04f
SHA1 55030f84c30ba333baeaf63f10b5592317830b56
SHA512 ea8406fda1384b40901e040c204b8ae83ae94831a899a7bc1d06e43ce47466de76e5ffd15df2d18ccc51245bc63617fe1d151f7afcc832a1d63c19634b672d8a
SSDEEP 24576:gG88u8FpJqH1bzria7/moJJI1+DMp7CjWgNlPU51Ncv:z7ZFPqVea7/NY1+DMCjz7PU5u
TLSH
T15235F16577E501F4D47BD1388A8246A3F6B2B8251364EBDF07AC8A511F23AD10B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 20ff22a1628cd8a1c61dbdb2973ca5e9b53b9d12947622f881e63ab788956a3a
MD5 fe9c6655131a014b7f00ff6d63c641f8
SHA1 94f0279598654181073bd7f2b4eb38e1dac1685b
SHA512 7c5f1717596479e97f704cc9fcc22f142cdf39b7d9b60467f25559a82403a127736c0de611c5c59a272edc713c82a6004eef46b9bf8a1b31d452d01ff4c1b5fa
SSDEEP 12288:zHvUrBFrEjwaQUnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+G:zPUr+NQUJJI1+DMp7CjWgNlPU51Ncv
TLSH
T19505E12F66EC18E9E676E17D89828709F772B4521351A2DF02E0C17E4F27DD86D3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9c1a4890b3c06454c707b728fbfc957a7bd071d387515b6ebd3c2363c9533bd9
MD5 afb22ba53d89b8ce7067f246abe73a6a
SHA1 120926d6c4575ec6f8ddf0825238b4820cb88695
SHA512 8d43b97657da63538a7107146e9c1383be41056ee84cdc14066c1da39046f5ee9a473d98cedf76d25798c3e5f3e9585717db1de9e898f5eaddc35214d63724aa
SSDEEP 49152:UBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkY1+DMCjz7PU5u:3G05lO43bA1+DMU72u
TLSH
T139D5C06E62EC11F9D0BBD17CDAC64A0BEBB23815032556CF02A486A91F27FF4567E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 530453976c2249547f5ab7f8c673ff141a8b951c31e360f5e44df1fd0c213066
MD5 62f955e1eb341e100137717e11073324
SHA1 0cbd5354cec614fdc951eab41ebb573147510e9e
SHA512 45346b3fd85715443cd51368102fbe28ac02453d796a89c6625c6ac08815f2cd5cfc2ce7742a0e5405f8c907e82fae35d0d163431bed4bdd9f8fd3abcfca441a
SSDEEP 24576:afa5POZ3dpFWVM50JicR2hG0lasx2+47eidnOJJI1+DMp7CjWgNlPU51Ncv:ya5POZ3+Jt2pasx2+msY1+DMCjz7PU5u
TLSH
T17665BF5EA6FC01D5D579D17DC583861AF5B2342253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 064102c0b37105df808f5a4a01e0b6d3eacc3b1191f7a830be69ba727f3fe44e
MD5 3255bce19b0c6e8eba496f9b440f68ec
SHA1 2a3395342d470f0acc2ccf288bcc0b4b2b4174fb
SHA512 0ca78113f4f3e64d60f708d7d09fb2c5240a8dda19670d130fcb88404640a088ac9f5e5a9d330da463698401fbb8d492afb745376254db0522eaf81d5628da88
SSDEEP 24576:jNcwHdjbyQ4nLC18lb/EOjowL7FkQJJI1+DMp7CjWgNlPU51Ncv:jNc/zEOVHFtY1+DMCjz7PU5u
TLSH
T1BB857B2623E901E4F5BBE1BE89779546FA71786513309ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cea32d5aa67ea16f09f74929b6a47f1a531f1d679f8d891c7000354581a81de3
MD5 285e1d981dbc7baba45bc6be81da1e7b
SHA1 4d149f38bc1467514d1d0e02ae8324c96dfba102
SHA512 2132e00f79e66cdcfc9d0abaa8eb9eae0fb05cbdcc78ad85f2018f9f92bb45dcc07b26af0af610478b88da8aed9c384fac3920e55725effc87134dfb82686cc1
SSDEEP 24576:18kNvNnaFeYhJNtmZBmyJJI1+DMp7CjWgNlPU51Ncv:18MwBtOmyY1+DMCjz7PU5u
TLSH
T16055AF6EBAF806E4D1FEC6B58D238512E6727461173293CB5290C13F0E279D89E76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 1a086201a8a8bde20b16f3de4d50b6eb17f8310cfed4dc42359edf7edd57fcc7
MD5 dc5ee17273fb4a261044f415b7f5a9a6
SHA1 ec4df490a8b6bd1746ae75436d5a3ec7587eaada
SHA512 3bd5b6ab238ae4ca77563e99898eb93a61f6e00465750e45a829943b75013c5920abb36e458c94e4149b125df39772a3e42490e3e8459e5d5eae2b49cab343c6
SSDEEP 24576:VD3FHshBIYQgAvJJI1+DMp7CjWgNlPU51Ncv:VDVHeBIAAvY1+DMCjz7PU5u
TLSH
T17B25E17EE79C04E4D47BD17CDA638A06E67238A9032166DB12D4C1B65F2BED42D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1048-306-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1048-51-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1048-50-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1048-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1148-57-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1148-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1148-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1148-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1148-59-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1336-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1336-120-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1336-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1336-367-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1408-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1408-100-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1408-107-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1408-364-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1408-366-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1640-79-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/1640-308-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1640-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1640-83-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/1836-15-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/1836-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1836-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1836-21-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/1840-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1840-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1840-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1840-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1840-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2056-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2056-368-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2056-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2056-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4284-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4284-380-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4284-363-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4284-88-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4284-94-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4284-381-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4920-67-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4920-73-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4920-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4920-307-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5516-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5516-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5516-132-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5516-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5516-126-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6048-64-0x0000000140000000-0x000000014019F000-memory.dmp

Download

memory/6048-8-0x0000000140000000-0x000000014019F000-memory.dmp

Download

memory/6048-315-0x0000000140000000-0x000000014019F000-memory.dmp

Download

memory/6048-309-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/6048-0-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/6048-9-0x0000000000820000-0x0000000000880000-memory.dmp

Download