2e94cbca1b88337d23331055f60d9b4656997a018fe9fe6566115a4f20385511

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
Size 1.4MB
Sample261027-rt9ypaew7p
SHA256 2e94cbca1b88337d23331055f60d9b4656997a018fe9fe6566115a4f20385511
MD5 73ee08c9c27134ba49909ca7ca333c90
SHA1 edaf079f3ce7ec1eede463a6e0d61350f3f61026
SHA512 2f92f9745d8256bcc71a8e19a9512c3809419d4bade2be772a66335a8eab6bc05d39a21fe251628c1bdebe0cfb2438ed64eba39b64844dbc09622d7bfb3136f9
SSDEEP 24576:3TVe23FrHmEGQe6gHkcsKb3Xrqk9th8AaUG1QOTT1VKaL+BgTAzy9cGQAVRcUp:jVe23FrGEGQe6gHkcxnrPtcS6T1dCmlN
TLSH
T1AD65AC12B7209965C4161A398970D7F19730FC088BA5A38736EF6D6BAF6F5C64F63380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4784	elevation_service.exe
4348	elevation_service.exe
4504	maintenanceservice.exe
3096	OSE.EXE
6132	PerceptionSimulationService.exe
2872	perfhost.exe
3108	ReFsDedupSvc.exe
4712	SensorDataService.exe
5732	ssh-agent.exe
3956	AgentService.exe
6032	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\819551e767fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eadd6fba1f66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ea745ba1f66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\explorer.exe,-22002 = "Disk Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb6ce4ba1f66dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068167dbb1f66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a66c9b91f66dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b8727fe1f66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005995d4bb1f66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067d8a2ba1f66dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
4784	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	3956	AgentService.exe
Token: SeBackupPrivilege	3108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3108	ReFsDedupSvc.exe
Token: 33	6032	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6032	SearchIndexer.exe
Token: SeDebugPrivilege	5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	4784	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5656	2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6032 wrote to memory of 2128	6032	SearchIndexer.exe	100
PID 6032 wrote to memory of 3972	6032	SearchIndexer.exe	101
PID 6032 wrote to memory of 2828	6032	SearchIndexer.exe	102
PID 6032 wrote to memory of 4884	6032	SearchIndexer.exe	103
PID 6032 wrote to memory of 2780	6032	SearchIndexer.exe	107
PID 6032 wrote to memory of 5248	6032	SearchIndexer.exe	108
PID 6032 wrote to memory of 4900	6032	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_73ee08c9c27134ba49909ca7ca333c90_icedid_njrat_remcos_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4348

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4504

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3096

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6132

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2872

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3108

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4712

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5732

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6032
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2128
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2828
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2592 2588 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2592 2588 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 35e5590a38301b3ae4f1416311dc269f1d2565fcd1d9adc806165fe8ca0a8eef
MD5 0f1b593ee8b73cd4ded0aed840751e9f
SHA1 6c59eb039f4ba795d9fc73a17b38b150e461acd8
SHA512 3f6720e201e277564c049e48f13a52ef864614db474f0f5d9a670532b33b5510fc7b401b7521fb54352ba24b4a4cfd74f1024f5c0190bb306574277cbe6adea2
SSDEEP 49152:1b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnlT1dCmlcGtVjp:L3q6HjBsT1smlXtVj
TLSH
T121D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4f44abd59a7d0e3bd26fd3490755add9bf3ffdd978bbb1e40ea19e1213e9f4a1
MD5 790bbf14a358157389c70b65c77823ed
SHA1 0d24127713b8674f190bf3e2249596e322c9d0c8
SHA512 457245f6a02c96e05c263052614bfac4af876c3262bfc656d48a543b7645a5533599a8b01e6065be43dfda6aa7c242f18eb59e6f7f50573f17b78d3a3e98b7fd
SSDEEP 24576:TXYfDtczAAT1VKaL+BgTAzy9cGQAVRcUp:2tcbT1dCmlcGtVjp
TLSH
T10E05F138B79408F9EC67827CC8A2C116E633B8554BA4E7CB03E499651F336D46E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 773c212caaff101c6f5de8312b7f7318c0b67342ee7fea194af633b90b3edef1
MD5 50045cf76e999d0839b6ee2fa496b4f3
SHA1 89f9f5a0cfae6aa83db09e97efd7897dadc309c3
SHA512 587274818335664015a8d544957f95f0ad122ac7f10179466bd21d8cd859ee2869c92eaf09b7c3930392dd3cb200fe643598ef67da03754c3a9cd19fdd5ec0ca
SSDEEP 24576:/0Le5ji0hmxirMtT1VKaL+BgTAzy9cGQAVRcUp:/Pji0Ac6T1dCmlcGtVjp
TLSH
T17535AE25F6788775D073C0B9C5D2A68EED7130855B308ACB4286D77C3E27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9652c7980853113a340485c0475beb0738fa3579824480606758728ed0907f51
MD5 1e9e5cd1b85e8667729dc0ead9786c2f
SHA1 446ec3a4a01469521bd576f5187dbd849ea154f9
SHA512 e9f2322b6e8d63150f97645e307b67167d9989d71ef46c225176dcd49592a0e1f0e29f3f1f368b1088efd2b0b113e85831081825ce41b977b994519bfe16fe86
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWE6q8wyurT1VKaL+BgTAzy9cGQAVRcUp:b/ezSC6vUzPvxHjyeT1dCmlcGtVjp
TLSH
T182755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3D277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7d66f65138df186d0bb1500bc66ea4eb6b3251dcd97a8bd8f484f0b8ae8b58cf
MD5 5734d04cbe8351abcfa9ed62ba889bb6
SHA1 7b279b557ded8ceedba4adfe80085ddea1b9b326
SHA512 0fbc092b5833d9b52ffef1c0cd57623812a855dbdca9abfd821c968de7a673aecb920950ef271771e0fb86b3bdd1d665e8a1a45562adef9217a509c875c17df4
SSDEEP 24576:qVbqPb88hv/l+68T1VKaL+BgTAzy9cGQAVRcUp:qVO88hXl+hT1dCmlcGtVjp
TLSH
T151559E66F5748331D073C0BAC4D3AA9AEE3234415B318ACB1246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 04f5ce1f0d88636e3640c584c6567a8c45aeefc4f45c5b71a135c5d27e0ee1a3
MD5 e1ce067a493dc4b936e7a87a5e0fa7c4
SHA1 7c3ab2402ab664e42582bd3223ea11265ada4f57
SHA512 f4037acfb35f490e3ab6b0862e5d40600d529860e3ee5302fa0b6a00b544e6b9f485a4db13af7cf1bb4bfcb7dd7d4d5ca228c1afa8a651d7cd344e8443e2a9c8
SSDEEP 12288:vRBWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:vR5T1VKaL+BgTAzy9cGQAVRcUp
TLSH
T14CC4233CEB0C18E4FAB64AB475D6E24B8679DF984CF85D816098FADA0436461F43F451
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 54c50cf2c5da7f7cc02077411e53879ce5ea21ced7a00460e46938a5558932f0
MD5 ce82cff0ba5aba6a3e346676351eab1f
SHA1 8b61a077eab7c0ff6346f097f1c55dc04ccd8cb6
SHA512 d4db63b628a4667e0ac5725912e64ddfef036567fc5c28c969fdcfdeecbd4d6c4a429e02692f5fea646e1a4b21a9875756b9ec65e060e641354dcca3b7e8a215
SSDEEP 12288:ceBNUbTVO86U+WhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:cJIUET1VKaL+BgTAzy9cGQAVRcUp
TLSH
T14705CF3BEE28FCE2C67A8DB85691C200D77278704F61A3CBD165C24E9E235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 17dcfc85493e21706031ae2b4e90ec5830c504bac72b5d466dc5d8ef7e2cee74
MD5 cb2ab06e9ddb3a64b9aee324170a8dd7
SHA1 91ea03e75d30fb81a6a420303950f1ca8d5789bf
SHA512 7455e24a14b31294b9f7f3814d16e75578ee8c54f91c2f177dc438dc9fd43eeaccc3e36c2309e3df92937b77956c3da7982c7de8ec2fe9c501458c194f44d643
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THc:qQvGAdlCEL8c/yRNw5C7T1smlXtVj
TLSH
T18E266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0bb0978376ce644ca2e883773c695e89f472ac42e3772621737f1d4d70279c8b
MD5 6f74bc53fd78784fd70ea7af836e08e0
SHA1 315133b850622089987927cf8b6289d4154acbad
SHA512 046222d20f2dbf7fced1c81f86f53350fcd05b138c4e8eddc531f45925300bb9eb5392089cff22929127671e40757ba3fe983e689b3a363b3800c524f6668f0b
SSDEEP 12288:uAwSfxL/2Dc34DLLmt0LDQewsAjYWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJD:TdewsAjKT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T18015E031FE74E436C67B0DB61B26D316543DBA604F611AC3E3E89E9E59302D22336A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f855c5fc81be0bbc9964f73bdbe84489b47e0ccf26ea8e0df6743040d4fa3362
MD5 30a7eebf382971879d323ea6b5480222
SHA1 95577ac0f476cdab263ddbbcae734523e29bd909
SHA512 082f013a65b6812abecc2763644848e0bd038abd24e54545bd64d0f5440043584270e3bbe49347323e21c5fe5dccff65095c99e2d297dec2f27223ff4ddad134
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHG:ZUEtQevvqc2W1cpV2EI32G
TLSH
T15C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fccaadee82e5c0b6acd36e041f7dfa2b35ed7298c42f7a10971ca3eb61c95cc9
MD5 cd31164972d3a0b32fb30bb16dd1cb77
SHA1 79b0cbf63d9c3599b8979faa7e2aea5485159351
SHA512 03176ed69d738ab5f4ce04824c891964e4e565c1fc14c62bd1364b0704e14b130a870dde7c09794007b4fdfa6a09bb565a7fdc7e950f099a703ba391e4440f26
SSDEEP 49152:NCbRquA/m2yL5zTfFiV+XenmE3/zqT1dCmlcGtVjp:qoquVjnmPT1smlXtVj
TLSH
T1E5D58D1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8cf538d749b0fffa640ed363c60c9533d9b389028968d53d2af965a393d1dffa
MD5 a3df7274cd5d11515aecf9fc7c6a182e
SHA1 a9abcd10d65febc2a39bec92e5fef961a16671a9
SHA512 746a0e76d25a62883dac3f4491d5196b593f1781841221f078590cf05eb04e226dba851281793e33b4ce1e95f7ea58b22df615989405e32b9679582f7a80c546
SSDEEP 24576:yAhGLJIFoiwtA5l7S53vT1VKaL+BgTAzy9cGQAVRcUp:yAMyFoiq5fT1dCmlcGtVjp
TLSH
T11035AD90E7F955D4F5B3AAB8A9B69171EA76BCA95E30C20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 ec7d427d87e1880ebc992899c49cf0992497a2495f0adcfefa783e40f5ca1ee9
MD5 5d4d6a401b2916c19d5f5b3d523bbd84
SHA1 bde6f578a87390ebccd2a56bcdf0017d2f819bb9
SHA512 df2d74ceab46378da78c98c1a807bdf882c8df7a9c68745a2dd76304e574eb0c2630069fd21e82d6655a8ac90f6429657251807e1cee150e47dcf175864fbb6a
SSDEEP 12288:Gmw5HEjsChNVBFgl0WDm+CXWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRt9:fwuoOW+T1VKaL+BgTAzy9cGQAVRcUp
TLSH
T16705F15977A80CF9E97786388597C136E7B2BC012A25DB1F1360C65B1F37261BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 d3f5936c0bbda5a8350bfb0679a4c604770e22f5587f5dfa93233e2b1738b94c
MD5 1ac584930bf630a5211bd028d790815c
SHA1 68aca8150e0fa7e099b2104171039d63054b6b08
SHA512 115341347abcc329f374bd72fe9455a248296730bfb4ee9bbf43c79457f62b10c5da618521230a525cebc53dd2e595b167f5c0246ed06ee3a169525b39299269
SSDEEP 12288:QBZ1IyIWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:OZu1T1VKaL+BgTAzy9cGQAVRcUp
TLSH
T130E4126D339820F9E5B3467CD8E29206D372B8952F7543CF1164A2AA1F33AD16D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 85389329c38efd6bb393bd7050f3dc3c0c07d1eb28aeae477bf848f163bd585f
MD5 b2100ba2f324e75cc53ee2846c2d0b87
SHA1 0f1e2bf485fe5b7a29a2df7442b00311e56f64d3
SHA512 93841b8a745c619021da3989635b28b9ec654b3a4250224facacc916ec2f79bef0f0453286c692b72e9d2e2cddcc963cf23435707254fd2f27f28c025c97c018
SSDEEP 98304:FQRQyi36YOcPQLvw2gAf+PN3oT1smlXtVj:8QyiKayX+PNg
TLSH
T1E0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8d4db0203452c6a76f3634d2751006d6afcfe2dbb0c7e4d45d18b7a67e73a0e4
MD5 6d226a1337e4c44c47645f1cd99af344
SHA1 5ca5aa48736380632e7909d493bf47ac27c24474
SHA512 25c890ed821dc524cb7e51a7209b445e5b4c96e0016828a91bd8723b50968b64e24e6b79a55d33e2e82378e2142ca227024bbc7501cecd15d46c7bd0a7d08dbc
SSDEEP 98304:SQRQyi36YOcPQLvw2gAf+PN3oT1smlXtVj:JQyiKayX+PNg
TLSH
T142667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2e3ac1153c09cf146c99ee755ac3db92333cd35494a4abf1d26b21b003ff9f68
MD5 858213963eef5da2fcb1db1d7e71d26c
SHA1 87d6cb603a11afbebd74fd18700320dfdc3d771a
SHA512 f4981da91ba8f25934f6d91daaa692ab989bad9b2e69f1cecec2e469c9fa6ebbe068bf74eee4a598d8a0580c4bbffa1916da81bad3bf1e12920f35f68b98c768
SSDEEP 49152:468Qg55nhheWu7PNU3/6T1dCmlcGtVjp:CthWRc/6T1smlXtVj
TLSH
T177B55A33B2F600A9C45DE1769F4A873196E17C758FE0E3DB811572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 107ca31dc86758dfa2fd85b6b55ff58b29737a9e597e20aa80fc4e7e8c91c343
MD5 1c35eec56486cadef6e5a1c9eb465de5
SHA1 7917fc89d5dc5633fc44478e95fc27627731ccae
SHA512 02df2f6b17463b3b5837c80bbcd1f61f89b12ea75643e1df04e1c016dcbb0ca4c8a54385c130baf9f97a84dd0bdc5d6888ae7b14e12410ca2e1a02a016979d0c
SSDEEP 98304:Uy5112gYy5azzVvL69nLKnhZ5T1smlXtVj:VLIHmWhT
TLSH
T14D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1275f450322b26741a6446b05a7ea45334a3ac3b4ace22248f902605c6f5bf62
MD5 5c03de69e2d88a7136162e395b66d96d
SHA1 bb1fa5f2d553780accd4f101926384953286b79d
SHA512 d79bbd5d183d41a3fd5e53831a350b0d52db01ec2638fb049da4f81e048f9827432a73e2ded3b967bb53a9d408e12c9c7c2a67c4f864a85e993a66fd891d0cfa
SSDEEP 49152:7B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glwT1dCmlcGtVjp:tu6JmVxd2dwT1smlXtVj
TLSH
T1ADD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ba524e3cf1902cd641d78d0ecaad10ed8c0a933f2a3fdc1f020f59e6244c3cf2
MD5 51b012e2e1a444d7f1649a71b02de082
SHA1 ecd17bedbb4cb0830a0a295bc03ddf6d18ec0c6f
SHA512 76ebaf1ec399d14c42ed49e2de0b6c5e15df14d21f320637455f82e8edc2eb8d708ec806490bdbc403618b30bf46bf90c3ae6409559b6d31d5cc64b8042dad3c
SSDEEP 49152:Q1hpsNoJpF1A6UU44CwH7R4xkT1dCmlcGtVjp:QmifPbRPT1smlXtVj
TLSH
T192B5AE13F29901E8D06ED17887569232EA72BC450B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f02a50d024b22d74611572ffcd104bbe59bd1ec89782707d3e994382df5b1612
MD5 6b9e9ce419a3200614a211665209f3cb
SHA1 5de23d66538dc704e3f13514bdae7be902eba77b
SHA512 58a6db38fe371bc867cb968f02121e20d0b5e8496f4d520eef8e4245c430760ecd9c7194377b501d777d4c68bb84e58596d4481bf7b9e6056dfee48907cce90e
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHq1T1dCmlcGtVjp:w5dKTi611T1smlXtVj
TLSH
T18BC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d9f33a9cff11df8d50cb1d59ddffd28cada2c46076f4cfadebe2c282038b90dd
MD5 69da65f2be14d147d2bc84e296423198
SHA1 4ff785c29b1282c21f624c84dd612e7287ff9825
SHA512 3b0fcbb74dbab346299a4fc6b579163c3e061067c53190fd6e09e37e5eca7dd6d27730be48e906d3942fd7e5aebb6b254420593e29594b979d4b9531dc3a5add
SSDEEP 49152:RhtSn8EApI0figngiDn0AP5wAT1dCmlcGtVjp:AX2iyphTT1smlXtVj
TLSH
T1F295BE13F2D900E8D06ED178C7468632EA72BC150B35AADF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 245e86a6e8ec6bb2e5eb7496c9f84d4a8f1a26b902d251a774c9d25d05e2b6db
MD5 4dc6c10cf6a4b8482c0e7607dd56e0ce
SHA1 611cabedb01a86125004126cb931a32f9751c0d6
SHA512 1e10a92df15f0cec44f1c44f7cf3cb7417b5f56a7629a22f79417bbae7878391c2be68a741e24b310abe2b5c9d7f931798e2db3a564c117901fad297c99f8bba
SSDEEP 12288:jJWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:jhT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T14BC4233CFA0D19E8E8758BF4B5D6E24BC6399F8CACB81682709CF59614379A0743F490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 aaebb42cadce9a1b1ae0e7aa3aca191b2089c474244320a0b656fc8f57e6d17d
MD5 ec6dad50f1c4231f97a61706cc465b2d
SHA1 4cb2982872d94ecd9f80642dc7ce71985c2b364c
SHA512 2c9cd40638c21ee6252c75cb00d1706a76e8e9b8c797e84c63e1bfc760a45882c72f6625fca94fccb2452ae0c3a1aafca810c845f1c3b9510c343e77e7231dc3
SSDEEP 12288:l0WhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:lWT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T10DC4233CFA0D09E5E8758AF4B5D6E24BC6399F8CACB81682709CF59614379A0743F890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 6f1ec5733c697cb6af42b786e91940f8f39bc38cb546395899d08d83308a8f39
MD5 1c8c932b4d294edb7cc04bae4e0c7fc1
SHA1 d2b35e39693a0b9dfa787e2df7ea01dd46a4903f
SHA512 dcfda81af9a1acb90028549d00ec3d70891b138a3190e392a9b8de4e2d13deaeea9361eb54d44b25f54cff1879d27a88674b4f17332ebe6fc17c8fae0f634a08
SSDEEP 12288:XmWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:XsT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T184C4233CFA0D19E8E8754AF8B5D6E24BC6399F8CACB816C2708CF59614379A0753F490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 606dbb0a32df8bf910b769933424e244b8e1c33a9ef00a8e6df7c018121df021
MD5 20f798e60d04ab3ffd1b55c20f095b4a
SHA1 e83a592b6715c2cff37da6d3296c82401d72440d
SHA512 ef846289275ec32790d62765045deb07be515015fdc6b090c8cfcf0f5ba060754bc9858c32433ba76de905d291fc3eac6f4ba227e3b17ad951515889b648023e
SSDEEP 12288:fVrWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:5T1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1D7D4233CBB0D04E4E876C7B8E4A2D247D379FE989E7557CF6144B59A0C336A0783AA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 effe1bbe4d53772a5d9d42e8158b76c393b0bf1e0502da164276c400e27c0c77
MD5 5bc2b8c0c69c16eff70a129059c0112b
SHA1 3e9e5250f45bf480ab073c990b3ad2e3d3f3704e
SHA512 f27523e37ca5de17613e3016974441765fadb4155e6b48f2f56a990a03104d19f70ab0c403827199e8e1e0836b62e0aaad4dda080f3d2c5f71435451e3bb69e3
SSDEEP 12288:DjWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:DHT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1CEC4233CFA0D19E8E8754AF4B5D6E24BC6399F8CACB816C6708CF59614379A0753F890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 5e5520c7c947f99a6fdc0cc03a179168082376607e7c89063312d58ad8728d38
MD5 32f9464a48b6dc1eacbfb1381c5a2f5b
SHA1 6bf4025d208f2e827e06adf12135f5c37583ed63
SHA512 3a36017fb4ff349174dedbda7c13e4cfe73997513ee258ada36cb86ff2c776e7521c5fa1f25b89108437a8a3f272f0e462501af7807e6fb60e0c672c667d9476
SSDEEP 12288:qgWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:qST1VKaL+BgTAzy9cGQAVRcUp
TLSH
T126C4233CFA0D09E5E8758BF4B5D6E24BC6399F8CACB81686708CF59614379A0753F890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 cd27eda7c1ffa67e13f08b2fcce0dc5af9d75515d38a0a0f83ae1bcfc030f2ce
MD5 ccc8229fff7c3620cf1a31c2cd188cea
SHA1 7bf0229443a25c17ff3cdb4a9707074ec0d27a7a
SHA512 6c7cbb2def900016ed6c84e51065c521a8241d14fcb0d9f6bbe2232b143831697822db2eceadac265abad6370a96524fba31ece5c83fe0aa30391108aac5ad8a
SSDEEP 12288:ssWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:suT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1BDC4233CFA0D09E8E8754BF4B5D6E24BC6399F9CACB81686709CF59614379A0743F890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 f4a31b0f812964aae588a112f7bb2b76c9cc145bd45e09e9dbfe23b610d2c2fa
MD5 0d73de2020efabbd80b2e7a7db2d8e0a
SHA1 e0f9c1a17312be670a1f429899e3f6b6e59ab32f
SHA512 ed3a31030f727760debae4abd7946015068948d2fa633928ffb4a25cbc6ade123052c4806df20880936bf3873bdd9e78f3eca76f62b5475cdebff4549d2f6f2a
SSDEEP 24576:aZMSzFVSO2T1VKaL+BgTAzy9cGQAVRcUp:aZMSzfiT1dCmlcGtVjp
TLSH
T18205F1A8B35418F8EC77827DC9569906D6B2BC590AB0C64F13E836671F333A11C3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 5a8942ef2d690748af366035fe13b0c07f12cfb9470fb778a9731f812ebd1564
MD5 6865d17b4fc00c0825de2185fdc2e59a
SHA1 e01dabc4fe0e78493ca9d26b44f09d2576de0cef
SHA512 aaf031dd5495c065c588876062ea9ce4dfa730bd2227cac622e6781714d6ada1680684a1695d8f53cc7c92aa61a957417e0ffe263646d0d72acc027ed69e759d
SSDEEP 12288:hdWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:hFT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1DAC4233CFA0D18E4E8754AF8B5D6E24BC6399F8CACB916C2B09CF59614379A0753F490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 e24cc1162dad8eb877dcfcd5f63ad484188562467a3c70d8ab3035f5b03891f7
MD5 0d0166d84e9a45acec151ab75cad3d6d
SHA1 78a5e4037a4ae98c028e2e5b7c135c164518286d
SHA512 fa26fba829c87d1910535a17ceb7c78f21de07de631f69c6ed42ed6b2866c2f23dcbb376326c0426db23086dd9eee523f6b4f288d23c8ef1aa413ed0a3e62b37
SSDEEP 12288:ZxWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:ZJT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1D5C4233CFA0D09E4E8754AF8B5D6E24BC639DF8CACB916C2709CF59614379A1743E890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 004c4d37943a9a845598571d1ad2b590eec990dfbbfa91d8de0a53a4ff7f5ad9
MD5 fa04add50285cf9e0faf702ff3a733f4
SHA1 8b18571acc5edc79d001b72e95cac8eeacb52aa7
SHA512 c9c3f0ce996b5d2583d0a05d775ca818fbbfcf97fece88e131255b8d52832dd1ee5168f5cecbf4a24fcab147ecbba8e37e95ef5c872fbe295f10a17a0563a509
SSDEEP 12288:zyPz5L8IWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:+zyaT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T111F4022BB35530F8D1768278C8925602F376B8354F748A9F13A457B61E376E0AD3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 77f13698221d0b0fc2115b355da578aa4917747e13d691db183755502f72fa46
MD5 40e22b3f0c6d4f7d328c36b0b8a8e37d
SHA1 7891f75fc99d008c8f455cf477e636b4d9d090d8
SHA512 a83f754c123e6c6cd97031df90c87b440b33f79bc1eee14a4e7276e8983aacd51c94d2de396f9697ea98bcdb77b8fb97582c46e2d6b17b37e032868a5326d205
SSDEEP 12288:hdWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:hFT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1C8C4233CFA0D18E4E8754AF8B5D6E24BC6399F9CACB916C2B08CF59614379A0753F490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 e0d5cf4a3d48a298d9af1e79884e153c488314dc5b2c393dd67bda40f7335c71
MD5 6696c2dd85c21f93932027dd43c86966
SHA1 530332ee196f0465ee26428068e8700e825d7417
SHA512 edbf900cdbca7a757577acdb6cc2d83a3a7c98b2db58e1f81e60d5bb784598924a008ab2274d5ccd29ca86e9482ee5966d23ef332a253fb1b0b724de9a496f7d
SSDEEP 12288:MdWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:MFT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T10DC4233CFA0D18E4E8754AF8B5D6E24BC6399F9CACB816C2B08CF59614378A1753F490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 9c124ec7ca7d5c014a2d4a46e19a75632c7a9a5b5f367139376fcac478de9ab1
MD5 7ff72aa360175b5d834e2ac1065b90eb
SHA1 87f04d09dd477765ea7e6d71c1b718c78f5ac7c5
SHA512 e7c7359c75c76b0d98318c7c0fdb8f1bf5951f104bd1782fd26094031afbb8d1c03a78de44da8dd7b21d0dbfaadbf6f93135fcf604f7aba5f997622d9d1afd32
SSDEEP 12288:kyPz5L8IWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:9zyaT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T1B6F4022BB35530F8D0768278C8925602E376B8754F748A9F12A457B61E376E0AD3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 58f4efca446143910f7bdd833ff015d526203eac22688f3f9f2dd7450e0f48c4
MD5 0b4983f37e4e903e56ce76753ebe7c12
SHA1 58dceae596ec8d7c18ff83f5bd2cc8d449caf2b4
SHA512 c061c837c26b7749387e8675cb49a7c8fffe481bcd785e451c3360a88790179c3944fe3e683ee51d336013a48ca2d3391e782e8ecd0029f0b1c5c2fff2fe6554
SSDEEP 24576:hTHaLl3z0zDcT1VKaL+BgTAzy9cGQAVRcUp:hT6LljrT1dCmlcGtVjp
TLSH
T1B405F1A8B35418F8EC77867EC9568506D2B2BC590B70C65F13A8366B1F333A11C3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 e4e09312df15095908d66996680d20a959bc773e90994d29b6dc52ca43d08102
MD5 ea769f20909ac3f78247e19f6ef9ceb5
SHA1 faf34fad5ea2bb614a65adf2e82593b140dcc423
SHA512 d5c00e3d5e28ceded9500708f37e0b326b40e8ba43531f6b96b06dfb44c48df9ea93e8460ed5f8204aba8526ca5e6b4f7cd4e8015ebbe8d69f2defc7138a64cf
SSDEEP 24576:q37d9CHKy7GZIT1VKaL+BgTAzy9cGQAVRcUp:M7d9CHKyaiT1dCmlcGtVjp
TLSH
T18825CF90F3E814E8F0B78A3589769512DA767C591B31CE8F03A4665A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 6e0e9d90d58b29a07357e69b29cbee1ef1254a7e6aca0099ddbdb30336abb8b3
MD5 345f0760ea62c5d18d4dc0d90a8bb406
SHA1 0657d99f33042b3664dded2c10381ad6570ad40c
SHA512 f9f1623f5a3658df9eb97a685b775c18b3f9eae54af2ae9a1be87278f123587fd5cc827e00b1e8e43c29802c085be82da38dd78cf82da578429b78c5684ec070
SSDEEP 12288:6GWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:6MT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T171C4233CFA0D09E8E8754BF4B5D6E24BC6399F8CACB81682708CF59614379A0753F890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 17c016718e8234d754482abec3fe1a1d8e3cc2a75a7b7a6cc0da7df938f342f6
MD5 65092aa0179479bb8fb6c49ecaaff772
SHA1 2e20185300a88e4caa6b1a70da4a7e053178e6f9
SHA512 9d2ea2d96e166da4010a6a81bb006e93b86d00aec639c868897babe9a2442e5d33b8ea7f6d03ee212417be4319133b792d78fb58dd3e3108c2ea1532bf8aee45
SSDEEP 12288:IoWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:I6T1VKaL+BgTAzy9cGQAVRcUp
TLSH
T16FC4233CFA0D09F9E8758AF8B5D6E24BC6399F9CACB91682709CF59604378A1743F450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 fbc4b55572454682ae5e53b036f149c94bb1695c85127822af7ea323c541c0c3
MD5 46a10fd13b105f03f4efca631b53bb0a
SHA1 4f10e8270fdd12bf75e92fd227c60fb77ed60d86
SHA512 da5e9423178000e97694e912baaf03d0042cf33a6035b1041f886e4346646bf0dd44aa86c71209345ae1587e4cdf7b93fcb3cfb88c5157563f391a9cd3c81793
SSDEEP 12288:SvWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:SjT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T11AC4233CFA0D19E4E8754AF8B5D6E24BC6399F8CACB916C2B08CF59614379A0753F490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 b2fbacf20e05c9144d0da161e537696db35831e7d659ab8f96e985f931df2792
MD5 3627dc6926cba56919ce13829e8e2758
SHA1 73f7ea74d25e67994299f58b2ea2c38e0e3f8b65
SHA512 503b86a8e18f3e93d453abea69fa7963b2cfb7d5ccecb6e375b768e5acacecefd7769f153bbe78327d76e73afdfe09dd6731a3d1241d7c124817cce86c167798
SSDEEP 12288:zdWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:zFT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T181C4233CFA0D18E4E8754AF8B5D6E24BC6399F8CACB916C2B09CF59614379A0753F490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 c369e7f7083f641c61f1dbb39edf1f30eafbb7d83c61610cbbbec1bf8e95d3bf
MD5 bc1bde043c86f6a0d16fe2c25afad616
SHA1 9bf43e6e7edad1662889248a65ec01762eddee50
SHA512 b75c107b2db97d5861a8167c920807cb86c8f7a22b6f674ab12cb02d607936641e15f8bfcfd21ace0c13b118e529fa7289f7148c27f3dc88201f62697db2e5b7
SSDEEP 12288:AGWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:AMT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T145C4233CFA0D19E9E8754BF4B5D6E24BC6399F8CACB81682708CF59614379A0753F890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 dc59da3ff6d84a336887112916fb0be2d845ea12ac8a5f66cefc02ee09489307
MD5 c580b25eb0fb5cd51fec74a9cd8a9ccd
SHA1 6d30da0ff53695f581789c6ea5f6d7ffdb192488
SHA512 d2fdbbd275268a3e946999cd8e3fb5064cb752144df0e93ef40b1acca8e65066238b4373c80615db944b31a5db77cb23bc6ac3ebbb6a6362e29eed3e7fdac895
SSDEEP 12288:4VWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:4dT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T10EC4233CFA0D09E8E8758AF4B5D6E24BC63D9F8CACB91682709CF59614379A1743F850
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 569891ae471649b94daeb5e0613c2aa13a38bcee3134874f066a9dee3c53b5b7
MD5 1861f9d230b5ae21aa8bde834d233939
SHA1 8913cc9c7be5a4c33f1f04611aa64b77437e11b0
SHA512 1799b11b046cbddf46230cab19b98af3c2106df184bf7ffdd2c183c55e19400ac57d31c2a386259161091fcaa04d7adecf591fdce38d2b123458b492acc152c2
SSDEEP 12288:PjWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:PHT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T166C4233CFA0D09E8E8754AF4B5D6E24BC6399F8CACB81682708CF59614379A0753F890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 d25e6d134ee6a1f5431b7a5f8cd833a00400b4d495757058997f939b05cec5d1
MD5 cd1d8dc283394666fa70e1b86f728974
SHA1 aab7e037dd08a8693facf7040dcf581d77ad09aa
SHA512 25111acc61c10deac09a09204315d78d92b8a48a9896f471060ac4875eb6bce2e439c7cba6e32c6fb2d5edb7be9868ed29496f617761b9e3a83909ace13cef14
SSDEEP 24576:Nfwvok9RX6wkyAIZT1VKaL+BgTAzy9cGQAVRcUp:LMnYIZT1dCmlcGtVjp
TLSH
T14A35DF29EBDC04E5E177923C99B3460AF6B178581B31C6CF129A53AD0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 73e5ed77437290c70ee534cf5f5c6f06858a2be22e57330d5bd60190194c7ede
MD5 682e061aa97e7e522beae14979336ed2
SHA1 1f125ab3ec74ceadfe72e860b80147da94ee0502
SHA512 6335718a04bfaa726cb9c3bb43de2372d3b2c3ef6bf050c1a5a4e648f22067ce03e98bd827fdc3e4493a664c655d73a5de4d23ae3d2d4710564ce1024c01b3ac
SSDEEP 49152:aYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0gT1dCmlcGtVjp:0ySzPIT1smlXtVj
TLSH
T11C066C56A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1edafc84be38bf65a12174b19198c91e4d5121da1dd6c82665becaafc5b6cc7e
MD5 08e8e75d936bcdd5ed890afbd0964234
SHA1 ca323d67c7f4fbc5610838500cbbf8103b323e16
SHA512 960302a2821779596731ad9898ca2615afeae1fb4c7cfbf784e8fda9a1a992f92e8e7c75e27ce40a980661d948c71e73ee4408d903a2e140e352dab63bc10ef1
SSDEEP 24576:J47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYGT1VKaL+BgTAzy9cGQAVRcUp:J47JUQj1irIhCnDHUPfF/wT1dCmlcGtT
TLSH
T1D665AE1DA3EC01E5E1BA827885558A5AEA71782D1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 b86380aa2bedc06e76bf2c67a1a861b29c4e3c8b02a6546367f7fd3527310149
MD5 83ad4d12b84155febfaf31d417315453
SHA1 ed129271cc1b3c11050abfa8dcdffa3d57eb618e
SHA512 0f3c20b071390e837bec5abc56d8eda75e36f2c66eeb0121134e27d38d9a4425b6f9162d4b492a387f289a068fa9d8fe1f6766f35b358ed0be707992d299f5d8
SSDEEP 12288:gNsftWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:B1T1VKaL+BgTAzy9cGQAVRcUp
TLSH
T17AE4F129D25802E8D06E5278C7969641F3377D648BF1D3CB62D0F57E0F36690ADEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 8d8bc41c7c648d97ac62467a176e822815e5f45325112c9aeaebd51956eb164f
MD5 384cdb831aaf28bca7337b90540a98ac
SHA1 bc19d291d08e35be58c396166422d0b3d278ddb4
SHA512 edbe9d6a694191e99baade2db65446576cea875f4405f5ce8a1c5e0c349625d83015687cc44d8785b3de3269a90290842b0f97f5438e1604f9fdadee4f8d2720
SSDEEP 12288:XbpUU3fWA3ACxgJsZ+vYA7VyiPMxGJgi0K8Z:XbOUPp3hC9hvPMggi0
TLSH
T1233539507626CB4FC6A940325E73D2CCAB707D45EE05AB0772C9873FC476659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 b45ae32557d7750142fe6bf6dbf2721ac7a26cb5e425746797c5b512ee4c68cd
MD5 4c98723e98b02a6803e03b441df15e73
SHA1 13f046876a32ad81c6a18a3d0e10f1b258ef5589
SHA512 a597afa209db306d2a493afdc8d30710dd0641fb88999dc6d006d7340c7285031a808f34a72d5eca19336d0168b2cb503ef0895db40bc0723381c03b24bca868
SSDEEP 12288:XbomcKArCufa9c048InF49nXiFmaIQ4y0VKMowrX:Xb9dsCu5048InF49nHD1/Kj0
TLSH
T1376519409537E78FC1B72132072A5B4CABA4AC07B7096F26B3D9053AD86B751B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 238398e77419638245cab35d8b9aa95b4599ab83728bf1bff2debfbc74ee9689
MD5 b9e597a301b631ad0046c774e4451c2e
SHA1 170d0ad280413884ccac4d843d929c2e5af2544d
SHA512 f6670a8f5c820463ca5028e32b0c5cbc68cfa3b1d17c1f7e314e71df4a70b021b902441546e5619aa4884a352e96800b57a70652d80c336e773d03b3d933c111
SSDEEP 12288:B07lWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:iNT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T119D4233CE70C1DE5F8794BB4649AD226923EEFAC4FB455C3B048B2DA14369D0BD3A905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 772a74c3ed47ff06119cad5889e1508ce9cea6c5c991a5931a7695504ab7088a
MD5 f03ce23b642a9081816595f852cb7c5c
SHA1 0b3c7ca7078cc8aa1e7dbc86cccb10a75ab9cf41
SHA512 5ecd2b25cf91f146edd2b8190a23a63653bc1fb0c5fc8d6d798ae3ad446e7332480efec38aad07b9ced19c440eed6a15bf76b2ba65208da7f46db60ea042f78a
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYrT1VKaL+BgTAzy9cGQAVRcUp:4gb4mBIBhGFGT1dCmlcGtVjp
TLSH
T11365AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 7b2dff096c2aa350d7777a64b3e328f17efe29e98f95ddd30b5ce5119ba1a816
MD5 a368fc8a5f2b5b19d841f2d5c66626cb
SHA1 303cef4f1bdcaebdedb714352993fca8bdc40521
SHA512 9359d888d455e765db8ac88ad147eb681dc05438fb04cdfeb9a7828199f4c5c67388b91a6d0fb664c203a7d426c47b38e472b4faedea8e799e4983a79917795d
SSDEEP 24576:CG88u8FpJqH1bzria7/m2T1VKaL+BgTAzy9cGQAVRcUp:Z7ZFPqVea7/DT1dCmlcGtVjp
TLSH
T1BA35F165B7E501F0D47BD13889824663F6B2B8250764EFDF06AC8B551F23AE14B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 64b64e16b613f36e008d68851f61269817f510e5a9bc81f43b88b59648e17ce1
MD5 21c61f71cce21bbe39c62ee40ba53130
SHA1 b257b66a7883ae5dad44f6fe8fb787292306dca8
SHA512 1df65d4790ff980ce95f751c120c21ab56abd697a4c9bb4a01f2b0b1f05e94bf5dffb6327ec580c3a046053b8922b135e0c32ff5c44dacd4238b4819bdc9dba7
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjST1dCmlcGtVjp:SG05lO43bxT1smlXtVj
TLSH
T108D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815033556CB02A486A91F27FF4A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 af78fad8efda11e6a6f675f71e3c9308188fd6714c1366ded6eda0b532f1e6bf
MD5 8834a97b51d20b4f6241f10c1d67b37a
SHA1 a206824a4377cdbf735b4e6392426481c0f3a632
SHA512 03076e5b04af61f52c96fa7fa40e5e442938737b9499388be9a61af9d460bf29eecabec12e873be4bceae2adccb57ae5539c020f8e055b84e6d15b26a7712f96
SSDEEP 24576:kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidngT1VKaL+BgTAzy9cGQAVRcUp:8a5POZ3+Jt2pasx2+m6T1dCmlcGtVjp
TLSH
T1AD65BF5EA7FC01D5D5B9D17CC583861AE5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0390ffe632b6c7258e110929542540a4551a5fe5fb84542665fe727b00c0d24b
MD5 ed511b3754d0ada7d8d0a2370a50ed77
SHA1 02640d1c1e7ec6499ad042306644bbe0c5648464
SHA512 4c12dc0f31bb6b6eb6085504968e1f35b959dd774e0ea80c49e8e7a08e31dc3da2a59ebb6b0ad8fb4eebcb93be1d7e5d4aa8a93bb8c3045aa6cf10419b1b98b3
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7FkeT1VKaL+BgTAzy9cGQAVRcUp:GNc/zEOVHFjT1dCmlcGtVjp
TLSH
T1F6857C2623E901E4F5BBE1BE89779546FA71786517308ACF0291811B1E73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e52219f279cb5f78e805b85f565a10b92a2a1301ca2cd243ebe5c9c90ad64d5e
MD5 a75ab3850f9f5a85b6f925e57bead6c3
SHA1 292d6a8c4b6becfa41ccf98aaa2d99311171cab5
SHA512 2dc9cacbf1905ef77b6f5af8a7b6cd82da1fd1b940e55f3adc4dd1a2328b903e7dba6d142d7513a15a95f0ebef7a4302764fd07408a0762d02eb5a18b9beb1f9
SSDEEP 24576:48kNvNnaFeYhJNtmZBmUT1VKaL+BgTAzy9cGQAVRcUp:48MwBtOmUT1dCmlcGtVjp
TLSH
T19355AF6EBAB846E4D1FEC6B4DD238512E6727461173293CB5290C13F0E279D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 18bf744a51f8b64de1ba256ef60aaca4f8bcd29ed29a989e09429a0b38a7c3ea
MD5 21e76767d357bd54eac3b936e8e0da7e
SHA1 60d2b5229921e0ca103dd64be5fb3bb4be4f3113
SHA512 b5abe768dbfe938043b0ce19dd6df1934566d602e36348891a641388a5e9a4a146e36bfbb48da33f035d2bf30ecb5475d64565cf9b9b7dd099f8d8fc77dc325c
SSDEEP 12288:7HvUrBFrEjwaQQWhaBT1VT8/qlalbwL+BszvObQzAzycKoDGJ+AVRtCUp:7PUr+NQiT1VKaL+BgTAzy9cGQAVRcUp
TLSH
T10705E12F66AD1CE5E676E17C85828309E771B866175192CF02D0917E0E37EE8BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 93a2d0bf652baa43d604f097b2301ea0ef662736537690b3268ab3c2e108c509
MD5 55d35d08fbcf6f1e494ba864e7bb94a3
SHA1 695c29d2a0256e280d9947f00b5094096c987fb5
SHA512 a270f3d1a34bdf0cdeaba73d11b0e847e0b10516b2a4ecc966fee27eb56a34767eab8123379963fb99d8ac05604dae6c245196afc96726cc97be72bdbc3fc8f3
SSDEEP 24576:TD3FHshBIYQgABT1VKaL+BgTAzy9cGQAVRcUp:TDVHeBIAABT1dCmlcGtVjp
TLSH
T1B125E13DE65C04E4E57AC1BC9AA38606E77178A8073166CB11D4D1BA1F2BEE47D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2872-302-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2872-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3096-55-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3096-286-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3096-61-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3096-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3108-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3108-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3108-321-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3108-82-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3108-88-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3108-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3956-119-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3956-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3956-125-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3956-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3956-131-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4348-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4348-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4348-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4348-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4504-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4504-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4504-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4504-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4504-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4712-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4712-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4712-306-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4712-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4712-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4712-100-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4784-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4784-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4784-23-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4784-21-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4784-15-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5656-80-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5656-1-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5656-9-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5656-0-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5732-114-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5732-108-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5732-305-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5732-106-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6032-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6032-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6032-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6032-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6132-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6132-73-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6132-301-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6132-67-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download