b849c83e9248ba8af5f16a641a8e2b4af8f3396e5bf1ace8e1be38ae3b6368df

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
Size 1.5MB
Sample261020-twelnsstdw
SHA256 b849c83e9248ba8af5f16a641a8e2b4af8f3396e5bf1ace8e1be38ae3b6368df
MD5 744fc54f088116cfd9c9e719e6d7302c
SHA1 0891cf7c13b678b7dcbb693ddced18fca51c29bb
SHA512 2055f2faeb4a47e48ef5e814331880c40cd3a476b0daad95906e1fe58492c0621ffad52decdc011d65a3f46f9cc53628fb58ca7f04b55657e24c3d69d57c6bdc
SSDEEP 24576:WadzG6OBuY4j0DYmRCKMNC+ABUgo+AAkPsl0:Wz3cJYDJwKbhldABPsl0
TLSH
T1F865D05AB3A84CF5ED6B913D88428206E7B2BC160B61E7DF1365076E2F336E06D39750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
468	elevation_service.exe
2844	elevation_service.exe
5684	maintenanceservice.exe
1216	OSE.EXE
4576	PerceptionSimulationService.exe
3292	perfhost.exe
3256	ReFsDedupSvc.exe
3616	SensorDataService.exe
2316	ssh-agent.exe
3428	AgentService.exe
4500	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\87f1db06227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001769677caf60dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
468	elevation_service.exe
468	elevation_service.exe
468	elevation_service.exe
468	elevation_service.exe
468	elevation_service.exe
468	elevation_service.exe
468	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	3256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3256	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3428	AgentService.exe
Token: 33	4500	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4500	SearchIndexer.exe
Token: SeDebugPrivilege	5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5104	2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	468	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 472	4500	SearchIndexer.exe	100
PID 4500 wrote to memory of 756	4500	SearchIndexer.exe	102
PID 4500 wrote to memory of 6068	4500	SearchIndexer.exe	103
PID 4500 wrote to memory of 3300	4500	SearchIndexer.exe	104
PID 4500 wrote to memory of 932	4500	SearchIndexer.exe	106
PID 4500 wrote to memory of 936	4500	SearchIndexer.exe	107
PID 4500 wrote to memory of 3592	4500	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-19_744fc54f088116cfd9c9e719e6d7302c_cobalt-strike_icedid_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2844

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5684

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1216

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4576

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3292

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3256

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3616

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2316

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3428

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3300
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1ad3f81b4d9f47098e2f2d9aca86807bfd27151cae460fe9ccd5ffbdddacf4ea
MD5 89c394bcdb1cb4417f5a1eba25c075a9
SHA1 78e3b1e689ff2f1c1fb0f310306e37f740b99e74
SHA512 37d122dd29f9715d7af46b0c358fac919aa9ecaca55ed4dbc9bc9aa53d0873d304074dede7abc676db86149ba51597a9604f4576586ee209abc913dec4ae2709
SSDEEP 49152:Yb+632BuPkFKRrdE6ohrstBhuXjfS4LWxn3YDJwKbhldABPsl0:y3q60jBcgJnHKPsS
TLSH
T1B5D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 6636daa68813402c83b80963270a96ab904d39c0989a1050440e2a15ca8a1441
MD5 2eee8c10f0127631bf63e5e4fc6c191d
SHA1 99694f443ae2d9063d173a368b29d5179350cd1e
SHA512 8ffb6d47359f0dc71bc18ab47e6c31a7f391e68c68a4780c63b22b73586f6248d15703fb921616dc2f41b7a2ca87f792961dbb22906c8a2d20e2988a1945b3af
SSDEEP 24576:yXYfDtczAP4j0DYmRCKMNC+ABUgo+AAkPsl0:ZtchYDJwKbhldABPsl0
TLSH
T1D165012873E408F8ED67827CC9A18512EB73BC554760E79B03A49A261F336D86D3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ea0ebd2dc0b5a7f504cd2d830ff467028ec246b00cc63e1cef5e6e5dbfddeaa0
MD5 14afe8246ca12d0cc090de4658d2495f
SHA1 dc870729d550a26a882185594f0799b1ccbedd46
SHA512 0d94b0d45a42bec43fe1dafa7308c3f8fbf6f975b85ab7cce3cee4849c8a346aa33b96c7cdcf2f64e3853d98179b8bb7058e0e399313b8e05b4c8a8bf318590e
SSDEEP 24576:k0Le5ji0hmxNrM24j0DYmRCKMNC+ABUgo+AAkPsl0:kPji0A7mYDJwKbhldABPsl0
TLSH
T19885AE25F6748771D073C0B9C5D2A68EEE7130865B308ACB4286D77C3E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7c798fb9ac4f73a50e45f2211aff51fce03aaf2444faea57daf9f057e1641dfe
MD5 29ad5622b6cb5f826f6db504215489e5
SHA1 d72a68e23b9ee60f1d6f38c1074a0e65f77999f2
SHA512 6aee83f64d74b6649813f5b22933991fafeb2443b6dade3574a763ec52a710dfaee8f88f2fb5e34f58c73c171e277d091974cc734c9fa9e1cf30413121534a20
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWr6q8wyuQ4j0DYmRCKMNC+ABUgo+AAkPsl0:1/ezSC6vUzPviHjyKYDJwKbhldABPsl0
TLSH
T16C756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6c7d6e5c877723334b7b4490a0243df35a3fb1aebd86fe96370e3ede0ae744bf
MD5 55f87553b4d19905dd5e8110c9414a8c
SHA1 55a8694c00bde6b2bc119c4a101ed1058bfc9cf4
SHA512 0967445406c54689759013935e3314701f49873ef3490c2ee34af6ef68b494cb0c39f964c61d782abdb37c9a2441e47bf8f9610a0d55f5f76849d2ec12797f5d
SSDEEP 24576:wVbqPb88hv/l+bj4j0DYmRCKMNC+ABUgo+AAkPsl0:wVO88hXl+4YDJwKbhldABPsl0
TLSH
T18D55AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e22744ea1082be09e0a6e9c1a3598a92494aff0ff320b509b6d9e0d72be364dc
MD5 a5cb3f453a0694e0e156a1b282e70484
SHA1 e36952c5a161c447508f3871ecdf79961a76f66b
SHA512 6b43c27838180e262bdf67375a60ad89f18617efa9142ad4052e8f42e19aeb8285cd55c1a1955adee232c1fd583f66a280c48530f4290a3ebdaabbbc26d56687
SSDEEP 12288:Yjtc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:Yj64j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T183452310A798ACD0DF5E2BB0B3F48A537ABDDD1E55086C27DB1AF72B2438464B032E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1f2bda480041d39aa4ba841c4cc3bc037729d3b058639826e290e4a78686d8f7
MD5 5d617d79cfdc9e63a1af8c0a94fb071c
SHA1 831a33b2b13d07b51c32354bb4e6a3d45296b08e
SHA512 00bfb52b38576a3f1d1995d01633749edeb1bb9f63681ea1a62391fa461223201d23f32bd96ce9fe7ed4e4f7310441bc1734ba44607241d0ca177c832a9f464d
SSDEEP 12288:LeBNUbTVO86Uic4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:LJIUL4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T19F65CF3BAE28FCE1C67E5DB857918600E7B278314B11A3CBD165C30E9E235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 72d5840d46dc2633752220a5b15d8473e9ceab368c8c10f1a8074b8a32afdf53
MD5 fd0ec2e48defc248b87310c5ed1733ac
SHA1 06e7eaae8310ffb118c3e45b2aa819af8dffc4cb
SHA512 c934a4e5f366ffab3f53d0a5b44ebde25374c149683cc3fa1acbb66718471082a2efbaf1d102fa46d76aed69259b37792b85d16c521c7140db837e002396ff9b
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH0:YQvGAdlCEL8c/RRNw5CBgJnHKPsS
TLSH
T1E1267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 33165c5e3fce47fc8b07dc245addc979b9fc5779c4ae52a3b3ccaa7babdae68e
MD5 db91f7e2e3aafea275d6e7f338b3e304
SHA1 4d4388320790753c0b3485ea1206eac21804c78a
SHA512 ccbbd857ba03cece9dc29d55b79bf3786f96971e8b42848feecdbb1020c7e0bd2e1a6679119f302f7adad99001b3b5cb0f89296609917d704300f064ed5878b1
SSDEEP 24576:6SewsAj94j0DYmRCKMNC+ABUgo+AAkPsl0:1ljWYDJwKbhldABPsl0
TLSH
T17375E031FA74E432C7BF0DB22B35C716687DB9204B5119C3E3A89A9E59342D22376E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b98525b514055ef7704114415c1ced112bf4999f5e560310e1b0a01609cd54f4
MD5 1da141d4a5cf0e6fa6c7fa669a7e8e4e
SHA1 005e4eb8aa5f787697289ee726c351cb844e08d1
SHA512 287d5bb79a3daa67c7bcab7be938bfe69045509880e25ad3dbd88a19bdc09a87d93c1324ffdcc95c6815f29d91c0a48bb9c494c4d067bb6837457c98edd9bb18
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHNF8:UUEtQevvqc2W1cpV2RI32n8
TLSH
T16C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1381743c061cf2ea8f6954b7398234ab88bf19300784665e89132bb5ea719363
MD5 a3dc6b049f6b0a4ece55dfd78e858c1e
SHA1 a99c425c4f54a31e139fdd94fe2c2d8d3a055320
SHA512 fb91e861da0e996c0e4a52973784e458f0756eabfa769b0682a5d9a6fd42507f120ac4ee03a6073905000e9519cb19c58e58645ca6055adebcd1d9c5aac50f6f
SSDEEP 49152:tCbRquA/m2yL5zLfFiV+XenmE3/z2YDJwKbhldABPsl0:Koq2Vjnm1gJnHKPsS
TLSH
T174D58E0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 20563e98d70fe82e9bad00d01cd2be7bd26b59dd20e6130098f592860fdf6c5b
MD5 47f5ce5aa22afebe5f58ff2a0650b70a
SHA1 6e9196d347093dfe99760e07059f4a4ffccd69bc
SHA512 7a3675808aa4a0aaa3ed830226d0c897136f9014e1d879e405e2492c9840e0cdef82c8759f348e4922e32eedc62116821a79901d60278539cd1d226de892405b
SSDEEP 24576:nAhGL2IFoiwtA5l7S53M4j0DYmRCKMNC+ABUgo+AAkPsl0:nAM1Foiq5lYDJwKbhldABPsl0
TLSH
T1BF359E80E7F955D4F5B3AAB899B58171EA76BCAA5E30C20F2150D21F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5a0276c26b3d026c6bdff729c335336f28f9d35757e5b6d19c49838a6b973c34
MD5 1883f36b1b811460b0727c0994fe310a
SHA1 4c728eccd50a026fb68b55aac849f5691861036a
SHA512 a6c9474ade7ee03166e4c0590cc7617cb5f4b593ce24014de27a59d481c17281366b46564476e081a97bdee4ab58239e2a5a4349d4155f64084d17a411ad9fb3
SSDEEP 24576:3wuXOW54j0DYmRCKMNC+ABUgo+AAkPsl0:3wsOJYDJwKbhldABPsl0
TLSH
T17B65F14576A41CF8E96752388697C132F7F2BC062A24DB1F5760C75B6F37221BD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 303f3eeb92d5ec745e722b202024af95c164131fabc7f3bf64baa750e27a66c5
MD5 829d6e1dc5f0c6d4777130e5b939b9c2
SHA1 02f2053d321c53d6268152afa0c7c440d9ae4d14
SHA512 1a3b14b9c3aeb567e41de9297a7f85c1866d8b1bd7926a05a9ef94e9bba0459f5bf5429e97e1a0ae57418bd192ee92ad27e4179aeac334cc93533489c587cdcc
SSDEEP 12288:G/Z1IyMc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:aZue4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T1B555121533E434F4DAA75278DAE04642E7B6B82B233543CF5629936B2E33AD12D35B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 dd93ac987590164a01b31301bd7e3f35508e1580b2abe666ca37e07571aeca10
MD5 141cd457497b8e03ab575570fe60323f
SHA1 b6374a1fbcc7aa30b8906da3f885ed37210ce3ae
SHA512 45907945acf4098cb47537aa596c726f11b4c253fd6b223eb9594149518ec1c27302c407d431a5f698852caf06f3b75902cba302dfbd54d8fa20535ef8c3c9eb
SSDEEP 98304:3QRQyi36YOcPhLvw2gAf+PN3ogJnHKPsS:mQyiKahX+PNPF8
TLSH
T112667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0e3364005523205ccf71784fdd63ff3d0fa685408090b749a0c384e08307c458
MD5 03598117908e46ef54a0bbe64dc405f4
SHA1 0b0bb1746b2d1bfdd65dde8f71b19137b7553a71
SHA512 57ec54e096ffdf7475979469f4715af5802e0adabb19afb0522479b4ceae804c495585ee7af46c0a30fb5243c9d987112e22b6fb17d9a60febbfd5960db6f661
SSDEEP 98304:IQRQyi36YOcPhLvw2gAf+PN3ogJnHKPsS:fQyiKahX+PNPF8
TLSH
T119667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 14851938e705e01732ed59efd72da755bef4c5568c23a18a5f753659c0749f20
MD5 2134d2cae04eed69eb929e4b828d3032
SHA1 3742b0775c00417f437246392ac960ab502b1dd9
SHA512 1c16f464f8d6e23b26ec30f04fc56e5209b81d3ca5efe3af5245c6b2a9dcc792a88fdd39252bd469094ceb6614101f7578a7eb1e54adcd51d14e7a827abcbdba
SSDEEP 49152:268Qg55nhceWu7PNU3/mYDJwKbhldABPsl0:UthLRc/mgJnHKPsS
TLSH
T116B55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a3e23ee7ffabbec8feddc4dab262faad3910791d71b48f44c86e4153bbf6d8c4
MD5 4ff8265b1fa0130e03e269caa714fd70
SHA1 51dd617661fade3a3d2be24c09803c3933f50c14
SHA512 addd1fcc27e47e9d3859edb141dad73d6cbe51c1d0102c7b33577d5882742e2ffda56bc8f8be4a4cb18af13520f79ee3867672c2d708cad774cc6ea034111b15
SSDEEP 98304:Dy5112gYy5azzVva69nLKnhZLgJnHKPsS:eLIHjWh+F8
TLSH
T112167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5d5f6b6edfca558f3ed1e46f5298eeb19d09b2099daab7f468e0de56a4a6f6fe
MD5 10b36b39eed951de3f3c426274bef890
SHA1 d7f2314d92ec04ddce66125e52aec70987854bfe
SHA512 ddfb22f788576d5dc653a280fc41e8876f9fed71642ac5967997f537e43581817e5516a766985a08534498e1ee752ce118d5401c27c693369c56e53b9acfcc21
SSDEEP 49152:rB+taZ3usBWOBr4tEG20bqx0z+n217aau1glgYDJwKbhldABPsl0:9u6JmUxd2dggJnHKPsS
TLSH
T1F9D59D13F1DA01E8D05ED578974A9233FA62BC490B34B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8b9254f96359b23585ab146d017962a84428544c03fb62364232a1ae60230a42
MD5 512780ce51c4994237f8c6367cfe53a4
SHA1 0ec7941fcaf0b85c96ee3860292d1628a2443aea
SHA512 e943cf48a67d3e0e43512e5280e2e6ab8fda61fccf3ca28d8adb96625bbce74490d39158ba2095bf3929a7dba2b1cfa826d4e36fe41e785c082cbf51604759f8
SSDEEP 49152:w1hpsNoJpF1A6BU44CwH7R4xEYDJwKbhldABPsl0:wmifPkR1gJnHKPsS
TLSH
T1BAB5AE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 16cf234e141452c64b135b9352fa332a8eda47fcaa5c054d3e573c136b073677
MD5 4a7ffb8708611d5c7ba0f845a70ba452
SHA1 cc95071d447fcf1b71f8530ef964541667aca5fd
SHA512 4c23b4dff0aee4f68898d69281eb162e0e7219605d95859493d9769f9d39c91d5cb90ba1585afc9ac5c70c6127152db5a339080ce97cf133053e35551f81ca5f
SSDEEP 49152:aSuZQIY0Be2KNRVtOnks6NMHqnYDJwKbhldABPsl0:E5dKvi61ngJnHKPsS
TLSH
T1ECC5BE13F2E940E8E0BEE67487659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f85997f18b658d8bb6a585487acbb29b75b744c2147b934c79dd410a6652df74
MD5 9cddd3a5d1a5316d0556954368f4d850
SHA1 6d911bd2479545a9ebfa318b71d9f3428bed6d3c
SHA512 c4776a4e8c1b92c83f38bed83796011a011c1d8787778ffdfe215ce027352556a05524938775a41de4fd2bb55be07aad7ce014ffdcac3311c4d4b4cae98ff1d9
SSDEEP 49152:YhtSn8EApI0figXgiDn0AP5wQYDJwKbhldABPsl0:JX2iyphpgJnHKPsS
TLSH
T17095BE13F2D900E8D05ED174C7568632EA62BC160B34BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d25d695e2d34c36d8b003f63d27f3aba4c05af9e674a817432e86064cc9668b4
MD5 c3557134f71b7db466fd08aaf78b6832
SHA1 04957cfc4f9b44bf243c7328840314022614f31f
SHA512 cacfdc7f3a1a289164c8649583eda4e744f2e65a4e10741a96247b5f4da42ac2c692d0ae88e38d5a4ab1823bfc43854ea99aca21aab1624d085e8f153609423e
SSDEEP 12288:Flc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:FC4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T15B45231476A99CD0DE0A67F0E3E04683BAEDDD1F76086967EB5EF32B24398643031D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 dae074f10550d0ad7024572c5e62d3959c9bc79014036c19ad48fde38c4866d6
MD5 4991b4b137b7fa6a07cb23602ecd9eb0
SHA1 9635b51abd898e368d9defc3115e7a7c653ea0da
SHA512 67da6b2a359e92859bf5c279201ebe925d6923925d39a2d1f2ef91d46f563067b87ba2c9e29bf308ae82b5ca447e6d5eedfaf73114a9ae419dbbfd925b26d131
SSDEEP 12288:Ooc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:OR4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T13345231075A99CD0DE0A67F0A3A04683BAFDDE1F76046967EB5EF72B24398643032D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5b363b442e16d61835399b8d723ef473f678deb33008adde36bc257496176051
MD5 a0a6c66e95251ffe406d20e30b50515e
SHA1 9731b714685d9ab41d59d282eae8f363b159dbc5
SHA512 b1fa01c76d0a4d4991ce68e7d9ee892e3fd673f7a0e0cbbfef529e65c511e34c2b8821c59388c4a1033253188d976b60a922b4aaa63fae44ed452bc901cad3e3
SSDEEP 12288:j6c4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:jz4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T1E245231075A99CD0DE0A27F0A3A04693BAFDDD1F76046967EB5FF32B24398643032D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 52ecdf150418d485ec9447209877016b6c266cde09b82195e11f41511ea6359a
MD5 bbd4b71d004bc0ee5b30c011494e3e52
SHA1 e909b26767c86da9a2539742e06c7b667118ecb5
SHA512 8b188ee9d213acaa8f84f6094b6ec61e0ae39906457db1c23cf796f52110c861530ecd5e6e5b96882442095cef85a6bcc547a35c1f53d3bcf5e3de6e9bd83c96
SSDEEP 12288:yVXc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:54j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T11A45231037A858D0DD5AA7B0D7A08653F7FDFD1EA7246AAFDB06A62B1C316A03431F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a7cecac549feddc0cd8a5166d2db1d8caa621a951e31117ca4db0bce89cf712f
MD5 78e647eec7f325e50172a6e2bad2ffe6
SHA1 d409eefc07c95603a869eff3864addf995ea9317
SHA512 62cd2dc64754d25d1d817a8ef568629a62cb81c91515a3b4ee739491fa2c301168b45bd6fba99099df0bd075abf51b3bdbf9b13804e246c97a7106512e48900f
SSDEEP 12288:vfc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:vE4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T1E545231075A99CD0DE0E27F0A3A04693BAFDDD1F76086967EB5EF32B24398643432D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3f650702279bf549a0c9630d1f84034c7a4cf0c24d23705a2ee2bae827aa712f
MD5 ff8eb1ee4f23fda18b080c3531270d83
SHA1 de5381637f9c8d9248a0ddf3d77a710947925ea1
SHA512 3954e40b29cb5aafcbfc5817ad5e2d816d6a935a0300e53ec3aa65b3a1b0559e16b037fff5a83fd144b978b10cabb1c6ba6285d451c0ed43aa061c087b01e1fa
SSDEEP 12288:30c4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:3l4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T14945231076A95CD0DE0E67F0A3A04683BABDDE1F76046967EB5EF72B24398643031D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 56b3aeb8e8f1b436fc05801fe956bd2b38c4d60b56f8603fa10a939f24ab0a62
MD5 8d78f01a0d4be42c45eceec89d10b197
SHA1 222425804b27b38c8ae817395e8e44d6e762138b
SHA512 a44e6bead3f454d6a7aa54dd735714e4c5f830ee5b7dda0ef4ee68d7de9c81950fa44ba405fef2db65dc8cc175f0b88fd4bf333effa48308e04184f11bd88366
SSDEEP 12288:BQc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:BJ4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T1124523147A995CD0DE0A27F0A3A04693BAFDDE1F66086967EB1EF72B24398643031D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 21648f1f16c3c8b7ae634aeeb53d73ebded76e70f3708e5df396b605e15dfece
MD5 38fc902676e243d327cece125d946cea
SHA1 456eb424a1752974affb12054a0c7c991407c454
SHA512 eb52df900f6d6b17e4f321c580b39d53ddf2b0c2e26e9acaab8f2761aa8d5de63e8f85d0ac1bd48a61d50fc6c7c521b5639f69560386ec520616d701c0069886
SSDEEP 24576:yZMMzFVSOx4j0DYmRCKMNC+ABUgo+AAkPsl0:yZMMzfeYDJwKbhldABPsl0
TLSH
T12065F154B3901CF4DD67827EC9658906E6B2BC1A1760CA1F57A8362B1F333A12C3EF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 66434495e685a5fb3968d788d87cf2515fab0b2c35bd14c7c267d4bd85a59110
MD5 08b44a140612efdf2177d43ad75bdd45
SHA1 5c13e769f2016111f3f44072fd54f27326ac8352
SHA512 807f6dc8ca4a7917bf893492504697456f6821491285bf386e187b1f888fc3092cd2e6f9799d11c6258425b3014144f0b10ca4f5c0217952d50c1fe63b3a9b4b
SSDEEP 12288:sZc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:sO4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T1E245231476A99CD0DE0A27F0A3A04683BAFDDD1F76046967EB5FF72B24398643032D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a98cbc136a08f9dbd984403a138c31237bfef6b876d0e1cfff387f16724f2c22
MD5 74ffbb66712f3c5732fab3b266f48348
SHA1 9a72ff1dde712ec7868bd9c044292a31da16832d
SHA512 29f70c33e383d9768e468d5e91d55a49fa5f027ed7b6de5011e01d4989d03c2cb78e3a4e621ffccca493df5c1a00c024217b9bd61f34adc887dbcf5715a15065
SSDEEP 12288:N9c4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:Nq4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T10D45231476A99CD0DE0A27F0A3A04693BAFCDE1F76046967EB1EF72B24398643431D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0afe56cbe64127ac6289dab0cc06984733de8ae439a231c6bf1ce40bdba657f4
MD5 bfeaaf01733f51c33adb792f181c2d19
SHA1 2f7f690d1903aebdef9a5b0bef4bc097c8a68a02
SHA512 a50f050653925a7ee2e84384c85a5c81f22930d112418c4856ca915c65d41c8df89fc015b8e5ff27b73e43149a1dd9519b9c57f5f0008a5c14cfcd8f1cc8508f
SSDEEP 12288:0yPz5L8Mc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:tzyt4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T12355120773A530F8D5279274C9A10A02F7B5BC3A17209EAF5764573B2E376A06D3AF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3dbf13e9a7d78b99035f24a3f556d7a20589e870bd0f324243e493fc23ca393b
MD5 6aa369479c7d91fced408141e71533b8
SHA1 f5049b31fcda50e081749dd535ed2bc453af14e5
SHA512 786cf4ee9b5bd1ecc082a4dba05dc0f7f5f5e320138578b06e4ed70f51caa17cb346d299af2943606f68ee182ffff705fc368f70fcd297aac4c0e4d14ac38720
SSDEEP 12288:GZc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:GO4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T18645231475A99CD0DE0A27F0A3A04683BAFCDD1F76046967EB5FF72B24398643032D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b8914cf8eb6b0a3a191083d8064cb9ea4f2adfeef32f1be42e7c2a50ebbbe687
MD5 c2e087a176c4e321b49c1240b3383817
SHA1 1b14c961747ebff491d70736918e29e8c1db5e00
SHA512 2896c5d7a5c893ee520c830a81d888cbcc1c238f0e4cf2c9b01d6f4b63d3c72fa8fdb312c13c8d1215cf4589a3eebffed9394672ef17728d3dbb3ad5fccbee7c
SSDEEP 12288:CZc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:CO4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T15245231476A96CD0DE0A27F0A3A04683BAFCDD1F76046967EB1FF72B24398643032D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a8957db2568d5057d672181a3d8bf7590b322ef0e69a59d7e1ccca73d983828a
MD5 f031c5903aa9313804d3713d87f5df1f
SHA1 933d86680f0151299a4b636a49cac201f8805543
SHA512 26b6ad49ba405e2a959f03b2db1ea332cf98c86d1b153364e90306ed4ced927439edd4b04495d5334d7c2cd74723cfcf241aa08c0cd6319a76be6fc619ce25e7
SSDEEP 12288:byPz5L8Mc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:Wzyt4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T14D55120773A530F8D5279274C9A10A02F7B5BC3A07209EAF5764577B2E376A06D3AF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 18881373a3e7e44cce8a2c983b5d32d833f18423121125b83c3c50b6f20490ca
MD5 bfc6312f102ba597bb2759dad8e75fa3
SHA1 70387b028fbe9d4d4419b83474d9909374b777bf
SHA512 59b6ea6def7e0c4add8bf033e5532132b02eb7620c0d0aa36b17d066b7868d187cb4021501f83475b3919029e9eddb30e83759582b22fa27bda11fba62091b7d
SSDEEP 24576:3T9aLl3z0zDD4j0DYmRCKMNC+ABUgo+AAkPsl0:3TQLljRYDJwKbhldABPsl0
TLSH
T1CF65F154B3901CF8DC67827EC9658906D6B2BC1A0760CA1F57A8366B5F333A12C3EF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 885159d6c7a17e8ffad0d7ebb3520d47023531961d9584a41de4d2708378083c
MD5 e601d901d0fd0ac158012f7d7f93f528
SHA1 84a4c9acafa48baf092510ab2c587cf9ae78e868
SHA512 d30c64636df874c6b741dedbba848531166a6d7b689862704ce7e8ba8144499acbca6694a5fcf537463b4399fd8352ea01655d210cc284a8a1c1b5d09145a006
SSDEEP 24576:73td9CHKy7GZ34j0DYmRCKMNC+ABUgo+AAkPsl0:btd9CHKyaeYDJwKbhldABPsl0
TLSH
T1E975CF90F3E414E4F0B79A35C9764512DAB67C5A1B30DE8F03A8661A1F33AD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d8359fe41514d123b5c7464df07434d872d3907c26130d2b19e76366f74ff171
MD5 ff127733f8d62b69d1863547a34888f5
SHA1 e37a930c84475e77e5bf3603eb0666debee21107
SHA512 ec5822eff5a1a11646b81919b49533015b3d52205c37ac3f21caf4527062eb85e3dbc50e1ba4dd0ed6fa82ba974f8b11ad0cf11804dd170c80a47b70e1e88e08
SSDEEP 12288:wac4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:wT4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T17D45231475A99CD0DE0E27F0A3A04693BAFDDD1F76086867EB5EF72B24398643032D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 eae196c8b679bdef1da473f62deef3ae32638f0114f9534662736bfecfaaa685
MD5 5e7794075bb609bf8aca3c92a8a83940
SHA1 4a7b2b76e2d2f4e2174bfb0100d3d731884dd17d
SHA512 df3f4ea80e46402b8ace512a84b2b5072cf1e8aee66a507cf7cd1275e1e48b34105351274edd57ce8c2bc76838ce53b95a42833b6dc7121a2d6a59e0064bdf50
SSDEEP 12288:qsc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:qN4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T1A245231476A89CE0DE0E27F0A3E04683BAFCDE1F65046967EB5EF72B24398643431D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 99f6c2fb0267063e215a48392593bbcdbb256fc768a1500f53a4c351eb2be1d1
MD5 8efa53e0151f6bdad148fbdff0991c26
SHA1 2de7892d25d0fb39e46f68f4210d5fa4076f4abd
SHA512 adb4d3832777b0af7b2645b770cd9f769ac5024aa223159ffb32cc9758ea10fba769b8f6070e8d0b0d811ef5cc2114dc43b8f948bf30fbba0630d610835a4fee
SSDEEP 12288:brc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:bo4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T11545231075A99CD0DE0A27F0A3A04693BAFCEE1F76046967EB5FF72B24398643031D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 fb6e492fa8623f7f91f4837df594241ecfa4bf74033a94b9651304dacf0a84b6
MD5 b5982996e9363d12b0a6bef2837eb26c
SHA1 c57412e8057fcddc22845238407b228796e61a3f
SHA512 172944c0e1f9a87790b9435e9a4a453f1abb5e5a235341e69efa9ef3d884f9b36642ed7c4baa0c3b54c1a2403aaf7885d9f40962258771bfe74022b555534ea8
SSDEEP 12288:CZc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:CO4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T17C45231476A95CD0DE0A27F0A3A04683BAFDDD1F76046967EB5FF72B24398643032D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1a8c71807396af5db9d29a755b088a59a830aad169f3ebbf2ce5fa90f05b76a9
MD5 51e8416895651437d03281d7fdd2841b
SHA1 935f4370fab579c9978e709079f8e43c45d2e295
SHA512 42b36a355eb2dc5015aaa415cf00628b1a4929ce84bd1c7b01bd66c67ac98ad78f305e87af6e5b9ea8526586b6ba1684cc5fb2f3b7f71a6f885acdd20c01e3bb
SSDEEP 12288:8ac4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:8T4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T19245231475A99CD0DE0E27F0A3A04693BAFDDD1F76086867EB5EF32B24398643432D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 b530ac4f5e9e6a9ceb2fe91cbb802d93955cde8d56b0cceb4286602df05a7498
MD5 3f404461f5f44d27a3a55871c07da7c0
SHA1 aebcdfc63b9607d462945be88b1ca296b04e75c7
SHA512 286b452bb0954d5c492d816b221887116fbdf1bfb934ae8707f89ca5a1dcb46e2364382cb843578cdda60ecaefdabba4e16f5999495b1a59ce9b89e9072df298
SSDEEP 12288:qBc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:qG4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T1014523147AA95CD0DE0A27F0A3E04693BAFCDE1F75086967EB1EF72B24398643032D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 b74c2b9b92902c8c7fd4a272a23886eeeab24dc30328ceed04e47986a1cc0b5c
MD5 034bbf4d53f70f29b71e2cbdc7a38d86
SHA1 0d0ace80e4069b921e723d1368a24931a5a2b84f
SHA512 ff815b66cdeb4e0ce50729ed3a4976eece2b3ed3fd55385d4f5d18275cb1f45aa6f39519378b04c087281949ade73940dd9fb6c0c805a267c0f46efd5e27bd11
SSDEEP 12288:Yfc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:YE4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T12B45231075A99CD0DE0E27F0A3A04693BAFDDD1F76086967EB5EF72B24398643032D94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ba05e817d9c90e65673eee4e9daa180b014516f90ce34fa1349bde0d98f4c770
MD5 7b19e70f3a6ab4a10ebd9fbe6436e0dd
SHA1 a1e6d77d513ce7052ef8a0f0cd90c871b9a3d4d9
SHA512 db60966b21eb4a989ac6ece1f3ce652356964fdd8f1fe335938cb48b198177ff1b4441ee155aa871d4bd68f48ddaddbd021c0338c03ff63d010a1b099f84daf2
SSDEEP 24576:5fwvok9RX6wkyAIa4j0DYmRCKMNC+ABUgo+AAkPsl0:XMnYIrYDJwKbhldABPsl0
TLSH
T18B85D029EBDC48E5E177923C99B3460AF6B178291B31C6CF025A536E0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a935d2084fdbd75b10837e3b3f5d2471a44c36bcb45c8e33c009653ab80a6acc
MD5 a726e9caf27fa430ed2f92a6ea842c66
SHA1 e54f84a7063356e4d172eb132e8fb5a95aa293cd
SHA512 09a855f06a4716db599471873bb7a949efd39b70285a455cc922a8bb5757df02b189d880d44b1cff999056de0da402ece15cd20b64ad2479a181f7227a2f1996
SSDEEP 49152:gYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wYDJwKbhldAB3:4ySzPIgJnHKPsS
TLSH
T1E6066C56A1A801D5C1B9C1B98B1BCC17FBB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8a194dcd260ffb5718b8ffcd8406f59a5e04392934d92842d07b863473ef8397
MD5 3991e47188cbd023544cb4ea044ed39e
SHA1 263a0ca0839cb3cfc2ef349f8aa81a990f0aa928
SHA512 8129c48937e410cb1d3c7511ade46f83c492666273a9f60f5af6518e409bd31ad006b2ba0cd4b04b02c096016de13731213a671c25d44e478641e19f82b29cbd
SSDEEP 24576:i47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYh4j0DYmRCKMNC+ABUgo+AAkPsl0:i47JUQj4irIhCnDHUPfF/gYDJwKbhldc
TLSH
T13E65AD1DA3EC01E5E1BA927885154A5AEA71782E1B31CACF2270837D6F23ED45F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ef143b64bcfa8e8847717ad064e66b7d31d38d79c575e588ae5cb2b3a9508bba
MD5 062e3d9c654482301e41847d2b8c1d38
SHA1 8d0bad69f282ef1296936a52eaebf70bd07d1123
SHA512 3c2b49edc4ac92732f5a02e0f20d175126f02e4b97620b98b245135e8174e8a31248d8c92cdf076997ba71881f65e1f3a7bfcfaca60a4300812702fce79e3c77
SSDEEP 12288:qGsfJc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:Ge4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T18755F119E29811E8C46E6275C7914A42B7777C2A93E0D3CB97C0F63E1F365906DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 c1b0432f0f78f0f3d68459c31dd4f65ea6f2a62b8373070673292bc495bad6a5
MD5 00100633e702785ebb694a1abed66a04
SHA1 e0c4126baca7c974b5c8cb93747b4f84167134e1
SHA512 b34381475a7fbbfcab83d15369ca3dbc2b381fab2cc0f2e65252afcaa5054717b621de97f06c18817f2551116d8ef58e99be4514938bc0aeaed00c682d84e52e
SSDEEP 3:OlH/luU+6Atzzmotd6FJll/bl3y8jK63mCllltGlslslslslslsl67Zt:K8U7AtvmyyDVKcmCtEEEEEEEcT
TLSH
T1038192940B981A60C991A47F08294F4C2322D248A4C0979B810830828C10E66DE93F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a14ac5860c768087f1b34418643fd546f5830ec884db9497ffb5235f48ba1281
MD5 accbc50ab49013b698fc8da05aacb8b2
SHA1 be8f3f05182bd4662883d7b18100d5d15f0df4fe
SHA512 184870395d28159ac3613e9250d93cbb252b1dfe7a6fb754595e87131727d8b49a261332fde921e5fa14da49331537db4af8ebf8ed889a3fd5be0af7628843c6
SSDEEP 12288:eF7xc4j0W+1gdmRCK74Nef+ACaHJUgo/mAgteYIbzsJJANq0B:qW4j0DYmRCKMNC+ABUgo+AAkPsl0
TLSH
T139452310A798ACD0DD6E27F063A48623766DFD2E5B0498D7FB0AB36B24358E07C31E55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 17afe8976c1227b96a1d143a69506b2d9265a83b7a4c936358cf26ffccdbd66c
MD5 7a01b56c21fce74afa84fd01d98888c9
SHA1 8b7ac54ed659c1d716a2b3480c968c277a3c6b22
SHA512 d5ba0f0c86de0f63ab2e7c661a4416ac1104d0d40826d560399a13d3b51e27bccee5eed624b18a6de2d05575944b1de3353b59431bc25e0eb4d0dc99be85362e
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bYQ4j0DYmRCKMNC+ABUgo+AAkPsl0:Lgb4mBIBhGFCYDJwKbhldABPsl0
TLSH
T18E659E1E22EC02F5E0FAE2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 ed1936e04f1a3cea1b78dd7f28cab974674d6bb9ddd8cd1c50607162147b65a4
MD5 d48c5100f4bb82c7bd2818ab4deaf010
SHA1 cf62e8b415b433e2762a3ad06d1884b33e93e52f
SHA512 ed5b1e0c3fe00360b62c858742662f0f4c8b75ffb119bf85f63cde3f80156a69f51020d3f7fcc034f14495ba500c576da15fec83abf90ef6eccc86c43a51b5ef
SSDEEP 24576:NG88u8FpJqH1Wzria7/mx4j0DYmRCKMNC+ABUgo+AAkPsl0:A7ZFPqVha7/5YDJwKbhldABPsl0
TLSH
T1C685F16576E101F0D47BD1388A824663F6B1B8251364EFDF07A88B561F23AE51B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 5a413e38d151798ec0a862413fb0f60b7fdd93b21573182a16c05656652454af
MD5 868e131735e1f621c0668c3e5b9dde62
SHA1 931b343670a3e19de82b37a121a5d2fb3100763c
SHA512 26701e9d900fbde584b98b3ed9ecd23a58072ef6d7ce7a6babc6fe202b2bd2d25ac8d704abaaf1af25bff9398c2b07c949eeddce810cf07988a89d74064d94b8
SSDEEP 24576:nPUr+NQV4j0DYmRCKMNC+ABUgo+AAkPsl0:nJQeYDJwKbhldABPsl0
TLSH
T1B165E12E62EC1CE4E67AA17C86828719F771B866171196DF02D1817F1E37DE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e3acff4a2716ad912a35625689a5f0525a8fc4d3e376e8df2540b1f03a57be05
MD5 bda60bc3fc2cf8bed16b33825c591168
SHA1 6c0458169d74bfdb2a45a6bfb8744a98fc47b866
SHA512 48b1932486fe519bc880bad1a35b427a87ffb8877b7e1aab4c13f09760d033ec51b0f8a9cffdc6d7b0e7062edcd4f49bfaea0745d26f5ac3efa9d84ef46943e1
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjuYDJwKbhldABPsl0:UG05lO43bzgJnHKPsS
TLSH
T103D5CF6A62EC11F8D1BBD17CDAC64A0BEBB23815033556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d609172cb107b2e0e6453b24dc14fc240da5890ff9753c249254e1c1fd01083b
MD5 5c64ca0b831f3cc8358b0225c1dc19d5
SHA1 f93ffd63860b9231a0e251397c395311b3cacc96
SHA512 b3f8be761e7a6c4a7677970e10d3657da2a5d6412a8a90013947ff0a9d83dad4bd9c8cdf450fc44aebba95cadad46b5f5029fcd4769ebfa061fedea41845db75
SSDEEP 24576:vfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnv4j0DYmRCKMNC+ABUgo+AAkPsl0:Xa5POZ39Jt2pasx2+mmYDJwKbhldABPP
TLSH
T1D565BF5EA6FC00D5D579D17DC683861AF5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6bd3d80c658dd41afea72dc9d22d309f0f27b61f9c5561047a5aeae3f432e751
MD5 0efb3537213cdd8ebe8035be699c88cc
SHA1 59c1786b2548f1b116a163b3b69525a079628e8c
SHA512 b06d78b52d7e043e3ad18568a1f0ee4201a450afd25626c88af3f539465d113abb66e39089638707b6790dc3cb5589ef32634d61b025f8a8203971ee63f6edd8
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7FkZ4j0DYmRCKMNC+ABUgo+AAkPsl0:cNc/zEOVHFZYDJwKbhldABPsl0
TLSH
T19F857C1623E901E4E5BBE1BE89779546FA71786913308ACF0291851F1E73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 936ee2e1f5b681e6a4ddb0218daf652254eb190c43ea5b599450e62f2a9b2d59
MD5 f91eeccc7d366ac76bcc563e21c5ed00
SHA1 a4031448834ec76640dfed4739744f15d2941356
SHA512 56eb45525dc54125bd4be2f0d4f1e940d1a41ffcb9c9016aeeea14e39018a96bd6b1a8a580c9f794f0ee4dc4744110efdd00b7186c486ede1a9593d4960da7a4
SSDEEP 24576:XtkNvNnaFeYhJNtmZBm74j0DYmRCKMNC+ABUgo+AAkPsl0:XtMwBtOmUYDJwKbhldABPsl0
TLSH
T1B655AF2EB6B845E4D1FEC6B4DE238512EA727861173292CB9390C13F1E279D89D35F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 29e3132aea37190e417b84b09910763544bb0fd1ef9fcabc68f5228a2d3e389e
MD5 e2f56920569d87cbce8dee3fb7001fba
SHA1 a23289ca29528c13038271d6eb369ca8ee25ef1a
SHA512 58033032259fcb71f0807408569cd5b6f669a471f29d7f156213d85d104811fa67f50fdfd4ef5c857e734cf91c2698f1f04a26f8dea396a6be2f5606bcbdcd23
SSDEEP 24576:HD3FHshBIYQgAi4j0DYmRCKMNC+ABUgo+AAkPsl0:HDVHeBIAAjYDJwKbhldABPsl0
TLSH
T14875E03DE69C04E4D57AD2BCD6638A06E77178AD032165DB0694C1BA1F2BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-14-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/468-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/468-23-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/468-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1216-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1216-248-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1216-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1216-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2316-313-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2316-122-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/2316-116-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/2316-115-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2844-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2844-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2844-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2844-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2844-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3256-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3256-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3256-328-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3256-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3256-89-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3256-96-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3292-84-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/3292-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3292-303-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3292-79-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/3428-127-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3428-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3428-133-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3428-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3428-135-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3616-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3616-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3616-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3616-102-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3616-108-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3616-314-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4500-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4500-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4500-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4500-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4576-67-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4576-281-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4576-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4576-73-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5104-0-0x0000000140000000-0x000000014021C000-memory.dmp

Download

memory/5104-77-0x0000000140000000-0x000000014021C000-memory.dmp

Download

memory/5104-7-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/5104-8-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/5104-1-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/5684-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5684-50-0x0000000002280000-0x00000000022E0000-memory.dmp

Download

memory/5684-46-0x0000000002280000-0x00000000022E0000-memory.dmp

Download

memory/5684-40-0x0000000002280000-0x00000000022E0000-memory.dmp

Download

memory/5684-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download