8bb57c76f62eba6f303e01785b23c9897073fd6444f437c212f89d967adb859a

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
Size 1.4MB
Sample261102-1z69esfx2l
SHA256 8bb57c76f62eba6f303e01785b23c9897073fd6444f437c212f89d967adb859a
MD5 d0314cdbd45a7a89e0ef7e3fcaddc3f7
SHA1 fa512a6b05f22f65bb8c1b8c76ecdefe63f5b94b
SHA512 9a4af223d98ef1f038e46a614603d1f9bbdedff888ae6b784b59a30dcde60c17d8017183fbbbe0fcdb168b695a6a9e0d6ac90dfbfd87e626dcbdad12654a2c52
SSDEEP 12288:3LqUgvI0uA6bThta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:7qrvIhTLxvXqbwGRz55jAre8MjKiwi
TLSH
T1AA650103B7A9C5B9D07A927815935512F3367906172043CB3362A76EEF7ADE0AE35B02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2400	elevation_service.exe
556	elevation_service.exe
4280	maintenanceservice.exe
2060	OSE.EXE
5816	PerceptionSimulationService.exe
5964	perfhost.exe
4688	ReFsDedupSvc.exe
5152	SensorDataService.exe
2584	ssh-agent.exe
3044	AgentService.exe
712	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9fb54d67612dd39a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\SuspendOpen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d23acaf166bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000158c4c6e166bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c614c9af166bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071a9706e166bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a297156e166bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000863bf96e166bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e76afc6e166bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
2400	elevation_service.exe
2400	elevation_service.exe
2400	elevation_service.exe
2400	elevation_service.exe
2400	elevation_service.exe
2400	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	3044	AgentService.exe
Token: 33	712	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	712	SearchIndexer.exe
Token: SeBackupPrivilege	4688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4688	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4688	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4688	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2796	2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2400	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 5080	712	SearchIndexer.exe	100
PID 712 wrote to memory of 1292	712	SearchIndexer.exe	101
PID 712 wrote to memory of 1820	712	SearchIndexer.exe	102
PID 712 wrote to memory of 2432	712	SearchIndexer.exe	103
PID 712 wrote to memory of 2908	712	SearchIndexer.exe	105
PID 712 wrote to memory of 2832	712	SearchIndexer.exe	106
PID 712 wrote to memory of 4364	712	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2796

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:556

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4280

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2060

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5816

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5964

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5152

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2584

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:712
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1820
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2832
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fbc838743321bd23bbb5468e9b65739feb7c807d73dc17c2e9496b80f2969255
MD5 ab238f24b91588d9be5dcc76e746a183
SHA1 a34f187f89a5969141290d26a962501fd9d80c30
SHA512 26b94baefe884f575aa6c911c822672c44d68d5fa5bf7dabb24e06d4beeeebfe255624b086657266a4326d1d7e00cccd338d2237cc6cd87132606c556ccac5e8
SSDEEP 49152:6b+632BuPkFKRrdE6ohQstBhuXjfS4LWxn5LxvXGApMjKS:s3q6tjBSdL2D
TLSH
T186D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 4d257898e3dae4eeff4c4ca01e682210a0b911c816715aeb61ff85f74374ed6e
MD5 b1e2e5753baf6e51617e47b3a3080a90
SHA1 57bc2461ff6aef5e4df3dc9d0a4dbb28aca6b833
SHA512 50c8d278dad2f949abd3df0f25be4815f8bf142991b66619824c1caf31d0297cbdc30023cf90a179bca5bf62b5f907727be0590ab4326458a19c5fc2b5d36508
SSDEEP 24576:zXYfDtczA+LxvXqbwGRz55jAre8MjKiwi:WtcbLxvXGApMjKS
TLSH
T13B75012577E508F9ED6B827DCCA28502E6337C814760E78B03B4A9661F33AD85E3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 1978a2e7bf6a3f672b1338513fa725e8960bcf92ff7cac2df5353aea4559994b
MD5 227f322903e1b43cf35500c32320c60e
SHA1 afd83499455f6837e94ee538c6b9cab36b48290d
SHA512 3d0c3d68063c23cb6dba0015dc43013a4fe400e4b3957ab60cabdaf2d3a5f9a868e1d6e3e4fb8b44dfc44351ceb256cf1ca4a242ce7059db713ad4a4f762b889
SSDEEP 24576:W0Le5ji0hmxnrMRLxvXqbwGRz55jAre8MjKiwi:WPji0AxkLxvXGApMjKS
TLSH
T13585AF16F6748731D073C0B9C5D2A68EE97130825B308ACB4296D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 edf10e4d38aff4d707da7e9603b04f9d9bb7b1e3f622dc4ca2f4067f963b28d0
MD5 4d4703fe3399d16df23b8b790a5321c1
SHA1 0b6d0b6396ec76852be0fc7a9ffc83d3cbd940a7
SHA512 04314940caf6ae5139e2ca469462435fe4036717023e2b612c39b30b1fa44a33a72174ff40436d7dc5d86ae1f28a27b14899e1c5ea05785276e4fff17b0d4440
SSDEEP 24576:ma7/ezSC6vUyDZaqgrvWx6q8wyurLxvXqbwGRz55jAre8MjKiwi:x/ezSC6vURPvMHjywLxvXGApMjKS
TLSH
T150755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c5209fa4c2409daa1a93b4fdc9269509055ced8df19fcf068df4b7742301c131
MD5 e2e932b033679bc3e7391ecc058b179b
SHA1 a9cfc1748b5d91f86be226c90b02e2f2d57e3297
SHA512 f4f8210c8d71b89ab8ba7fdc8e870dbe0b66e46c15a8ac5a2fa283c268baab73c6cb714957b047b4caa3fa22b64c33f38139f185c5abd351a4bb2ab41c0a27ce
SSDEEP 24576:JVbqPb88hv/lV7iLxvXqbwGRz55jAre8MjKiwi:JVO88hXlVmLxvXGApMjKS
TLSH
T1BB559E66F6748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C3E67AD5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 982d6b7bb1ee7563f602d40af9a25321a6dd734c173d79604cf67bad69e1256c
MD5 98d3491189a037991b3838598c4ba5af
SHA1 40657be8fbb6f27ed1490b87308f616bc1bf9f25
SHA512 f1014d95e1dd081b4c262d09b4637e89307a8400cdf3e21d051e97c854aa44b58282585d79851cc51a82bf6508add313765bf3fcce7458872ea8b8b20e9735f6
SSDEEP 12288:5G1hta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:5G1LxvXqbwGRz55jAre8MjKiwi
TLSH
T1D85523534FA95CB2E79E527A14B355CB9011BE80C7A80102F537BEEB5DFCCA0D2A4513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 df2b31683e9419cfaf6ec5ea88235b30fad0741eaf3721d31b5030fbea81fa3b
MD5 eb61b3fdba9e2ca47869bdceeec8fe8d
SHA1 9ad94784daca59b603d3f86232d1fff126abf519
SHA512 c21c5787fa6aeae609b710a89cb83966206237109e9b1d3ebbc4cb470086e5e291097cdce3194bf3ce811314604e60fe8d16d53706d34e832a881262ee383a64
SSDEEP 12288:teBNUbTVO86U6hta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:tJIU6LxvXqbwGRz55jAre8MjKiwi
TLSH
T1FA75CF37AE28FCE2C27E4DB91A918640D77278704B6193CBE175C20EDE239E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 99c56817eea326508cdb5270a02527a2054c20738126fdf5ff6ff045ca4fa0cd
MD5 57a8863312bf9dd527dbf260373c800c
SHA1 f3114c852d6620ac21e83e82a88d2d9003928ffc
SHA512 1533c5da9e458fbd4072cdf0793028d97e73a077d3bb7fbc04550bb56964380e77f0bc6ae45f3bb4c00b9347895d4c5bf8dd9397a32ef5db8a2adc7732cc3b4e
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THz:5QvGAdlCEL8c/pRNw5C7dL2D
TLSH
T134266D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 7d1097d0bbb6806bbb276fd6a273b5d4935905b760e1fbc944042d78d3a5654e
MD5 b5bb9688dd3cbd60a14c50195e1c3b1b
SHA1 ccb0e549775143e5e9e10b37a8e0dd291d04e5ad
SHA512 77b58dbf7a23ab5ee8bb21abc137714c4707362f7fb72d392f06c51c0b31f16a92e415edaad6e8f2506cfd0d129f490f7a5f0d76f0079a2a8d2fe81b1d9086fe
SSDEEP 12288:0AwSfxL/2Dc3xDLLmt0LDQewsAj0hta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcreR:JwewsAj0LxvXqbwGRz55jAre8MjKiwi
TLSH
T15475EF31FF74E432C3BF0DB61B26C716542CBA204B611AC3E3A89E9E59745D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c4b4118c59981210c60fedadb3917ea71f46fcdf78270b038877c12242fb51c4
MD5 f1adbaa4de143a0e1607421ae858ec96
SHA1 772f12184b8494ac7b8109ce5a8de1977bdba9bd
SHA512 67929ed1c6ebdab2806ebccb65ffb1917199e05677940357069d604e60191600339268b20d1ea8eadd13a56d96d7f85eb9e1d12cfe7436bd9ada98a46a93a47a
SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHcsD:1UEtQevvqc2W1cpV29I325
TLSH
T11D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 91da21c5434a6a45e38c99b5f069a3c64bc62a88a616a673dcad084af37672f9
MD5 5354674d4e6e1d18c90b20876e0dae24
SHA1 a9fb85d62cd13c6710f2a085fcee4e7ad796ef4d
SHA512 a5b5f1aabe1deb154dddfe318460f86075ba7962bdce4e83e8175eaea79cfdeb87491e4d09e266d4a113eab11a16591df494db5b3b2417b727238778d597e355
SSDEEP 49152:HCbRquA/m2yL5zifFiV+XenmE3/zULxvXGApMjKS:QoqHVjnm3dL2D
TLSH
T16BD58E0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b2e90f02c7440f6c2e0710a1f0096b04609349322a0947b2fb18da3708ca9290
MD5 f75aed6858b59c057689297f6d242967
SHA1 7a2ea69f8ee82cd76bc851c48979b2ec48f77117
SHA512 94ca63db89629c065af13d3acb8286c42eda14e1e6f9cd1c256606f9cd491f9bafdcb3a6a57e5e27edfbecd116e9593dbed9e5de09f838d8c055d085f30bafab
SSDEEP 24576:mAhGLmIFoiwtA5l7S53XLxvXqbwGRz55jAre8MjKiwi:mAM1Foiq5HLxvXGApMjKS
TLSH
T1DA35AD81EBF955D4F5B3AAB859B69171EA72BCA65E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 0b0db3de514a48fc6b253003db98fc5249832737fcb7fd50e4ed69028573a4fe
MD5 fcd59000d6d7b017819103aab1618e67
SHA1 660f0bd47910201a720a1ff795dd984c721edefb
SHA512 ea41dcf507fd6d6f1a49ca95a372a19596992d420a9f49ac5c9319ec4b62d2673d9e76632fb5a2c4769cd8cd45f583373652b1fbc770c49d48749cc3cdfda1e2
SSDEEP 12288:Gmw5HEjsChNOBFgl0WDm+CLhta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFX:fwuXOWQLxvXqbwGRz55jAre8MjKiwi
TLSH
T11C65F14637E50CF9EAA782398593C136F7B2BC012A25C71F5760CA5B5F37660AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3f1c44d68da1509e4918fe01901719d45e2dbebc65826adbd1682bdd74bb48f6
MD5 c3c4d5eacc45ed09e700c941a2f064f5
SHA1 7cd754e8516a939bdd00d2d6cbe0406ffd30c2ca
SHA512 3a2e9db8e055758e2c11220a4451f11911c04b520c53c1f7b20aa0ca315d0c906485532b071b9dd011b692befdfd7a51b40f278512f63721aec3da95c3b7ef7e
SSDEEP 12288:TbZ1IyEhta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:nZuJLxvXqbwGRz55jAre8MjKiwi
TLSH
T18A55229327E424F5E2AB427D48F24646D3727C82537503CF6635AAAA1F77CD05E38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ddb2bbdbee8d26176b09e50d98cba220a82fe061f24234b2602840b6c98037a6
MD5 c407b6c780ac30c71cc10ee247bdcaa4
SHA1 3714034a63beddb143a479d6330d135aa9a2f961
SHA512 c7e82cf8a7ca1629f3940c071484447b43ffa0cb0045401648b2b0241f82738040746f8c0a9fb97acb163225e55729a4a8b657ff89f2b9bd9a67c0e7710639e1
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UX:VQRQyi36YOcPuLvw2gAf+PN3WdL2D
TLSH
T133667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 40368b889501dbf139e31df16c7257a74a71953cd8bedbfe87e0bdeaf4205301
MD5 9323d1875ed95f4b60ae5c755c756812
SHA1 92be2b8d12c5048f698cbbea2499c81adeba666d
SHA512 0c6b6ffc900a3dea1f72f733d7c062cb02af4dfc81d83d9ffc3c2c00ec9936d789a20903b1accb025a646e1214be1b7d387633ba9da43fcad8081f50d1f0dc30
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UX:AQRQyi36YOcPuLvw2gAf+PN3WdL2D
TLSH
T1AF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7bb32361b45cba28e24c3e05f100170d50a52c9e8b40e5b0d516220a4f681b23
MD5 db1d2b7e7ef015fe449973c6240d1913
SHA1 f31f30d5f4b09b866e5b23fc4b0705bad0664188
SHA512 3a48e6c3b3ce6c58a118c1d6456120ef4b9d5482d58d6fac5e65f9b789943d0697784f5035138849980922938ef5a41cd8d7cb170dfed170d5c452275e2658d0
SSDEEP 24576:SwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL05LxvXqbwGRz55jB:s68Qg55nhxeWu7PNU3/kLxvXGApMjKS
TLSH
T109B54933B2F600A9C44DE1769F46872196D27C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b4a2d733042fc4d504e63644822635369997f88a53235712383294fbdb0bc5b1
MD5 f5f2a71bd6966e932a84f0cbe38bd5db
SHA1 c483e65756409dd0b983817c598a96c9333c5bb5
SHA512 2db246818a349f61ea3abdd7e101cc4337e24cd963c818b97fe83c662c6c168561227d5b384189b2cf882f83e444e815bd7747945706aec945df1365e1b882cf
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99d:qy5112gYy5azzVvD69nLKnhZ1dL2D
TLSH
T1CF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 538405bab1c39df94b9e37ce9604d5e00eb3e73e5f926c87c91f4c61c2c7ad21
MD5 828d719990e6f22dd22a8dde45f1362a
SHA1 190e3c06bd445bcae82749e45687abb0845d85a9
SHA512 60a859dad716a93561dde52edec26e393761216c620b56e9b4451d9bc63bd103699dc04bdf4cf265769ee28f0ecc8238da3f9a387fa8f35613a82db775fa4058
SSDEEP 49152:zB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gluLxvXGApMjKS:Fu6JmQxd2dudL2D
TLSH
T18AD59D13F2DA01E8D06ED578974A9233E962BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c675fdcf09571752d50eac347488dd1ab83b839411e7ad65399d6bd3a80bec63
MD5 27f5d0e2f63d39a2cbaee10fba958f16
SHA1 b911a9b754b67ba9bed38c37b45dd5ba10bc6f14
SHA512 217b7627fceb682be00169f6ddd564dc24b8fbc5aa125d6101114fc9e6ce13f92a3f4c77c4ba9deb0412df6f729a2f9449b9abd63ba65a3a022a8dcc9ab0a664
SSDEEP 49152:O1hpsNoJpF1A6yU44CwH7R4xaLxvXGApMjKS:OmifPVR3dL2D
TLSH
T106B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6d11efaeb2ec3330782a0be6fff1d76589e87549a1c2db9eb2895b296a21cb40
MD5 47f11f78da95b6d01cb6628918146b62
SHA1 41b0d4816f2d059b32dcd84ee92a7169db0813f3
SHA512 a48d2d926e623c67c281170a18bdf9515385d26c52988d04b5ec1979de65b3fa6f7d6507bb49fd2d51693202aaf671d43cbf27202ef434aa921002c60a319437
SSDEEP 49152:9SuZQIY0Be2KIRVtOnks6NMHqJLxvXGApMjKS:T5dKOi61JdL2D
TLSH
T1C2C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4e4a0f2f7a167d198e71144d36cd8dc1191a2c2dd60a80995ec1a2bde5e342b7
MD5 6988756b8384de3c8d8610e192841202
SHA1 06d581a48a7167be1109232d06da67b8b62d69bc
SHA512 50a3ea35de1acf356da46cadcf724bbe226754a4ced7923ab6c99ac257d7f16671c0b6f40977b1c69f95b8de6bb4ddc9a2b776ab22168c01d23e2dcd9ac125b7
SSDEEP 49152:1htSn8EApI0figGgiDn0AP5w+LxvXGApMjKS:EX2i/phjdL2D
TLSH
T16395BE13F2D900E8D05ED178C7568632E962BC160B39A6EF0A90B7561E7BFE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 50f25fd5fe8db94cf9efeea377522f400b7eae948eafe7dafea1a82db73dc88d
MD5 b1555ad5f305fcd1c3e1008d73e0f021
SHA1 4e87398f50e8a4a60405915844ff17edaf6866bc
SHA512 a697a442c08f37da239bb644462a8e23d0904a07a6c3ede1f48b815fd8fe86ee9914e6bbda3219dcea96141943f502d75c93366a97526e3755bc76fae802f4aa
SSDEEP 12288:wthta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:wtLxvXqbwGRz55jAre8MjKiwi
TLSH
T1BE5523535FAB4CB2E35E52BA08B351CBE0117E85D7A80043F63BBDAB5EF9CE012A4505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7c7ce0f9331b7dc8f70f724ce69649bf270c5ec1499a6eaab8d8798669b1649b
MD5 b7a5a9cbf4ab1d40064125558ba90ece
SHA1 57ff8ab7e81a005b0bc837e91850450e5f71f292
SHA512 cc0195fc07e247aa4b330d38971206b21d4412d99f46f73d7dc53d5e9207971d9d9a316a24d453f41bc0475584fc2711d13cd3e2a13ea7aba5e89f7c22df63df
SSDEEP 12288:tYhta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:tYLxvXqbwGRz55jAre8MjKiwi
TLSH
T1CB5523535FAB0CB2D35E52BA087355CAD0117F85D7A80043FA3BBDAB5EF9CE012A4915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 67ba004d0e9a25dd8fc3c2e1fd7c91373739d615320bb5cb084f48469ee79083
MD5 e66f4e2292cf724b451eb156bd9f08ab
SHA1 4dc35901261f51f18e72e9424e3d01d5decc36e1
SHA512 95b42e0c31c595787717ebe497f97bc3899e448881d1707bfe405e6f3064f83bf4ed76e6f71e2627955e30c10a66e830279c5a67eb8de20e071d7620f12d0381
SSDEEP 12288:hShta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:hSLxvXqbwGRz55jAre8MjKiwi
TLSH
T18A5523535FAB0CB2D35E52BA087351CAE0117EC5D7A80043FA3BBDAB5EF9CE012A4555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 86b1c65db03c68211038b8f43eca247b196a8a1660a04e64ad95f3f1119fc714
MD5 b298fd864a4f001266273c3f25b6c692
SHA1 60dcd053c1c4bf6030ee17751bba48261747fc63
SHA512 dc65db0043e4eb3ff56b398b085392400017ffc675c3ef57c27f235130cad4b2bdc9bb2cc3bc4ecb102087d886f9d9f805846b95d866e76a434675fcf13b41ad
SSDEEP 12288:sV3hta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:uLxvXqbwGRz55jAre8MjKiwi
TLSH
T1935523531BAA08F2D66BD3BA08B35186E071BDC5D735028BFA227D9B0EF5CE05674B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8f412055206913beb3481d7ddc39db2969fb6ea1a55b1406fd158b6e07ea4451
MD5 087addf155cab9627c3005ca4e46f49c
SHA1 5a344da7904b0f948a47ed36bd4f962aad29fbbc
SHA512 085bdae64397209f1383bb338414930352ef6088ce55650c681ce3508fa4c9aeed5a0aa48bbfe7ed7e2b2715bf61015b9eb245806bca56438cda72e9562dbd0b
SSDEEP 12288:J/hta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:J/LxvXqbwGRz55jAre8MjKiwi
TLSH
T15F5523535FAB0CB2E35E52BA047351CAE0117EC5D7A80043FA3BBDAB5EF9CE012A4955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5b841164a02923e66b4f5b5706198db1e3be510d758bdc02746aff24fe7876e6
MD5 ee184a786bd5bd3063d7d05fa9664040
SHA1 d8d6eb078e62c9c159e77f0209b49ddef8165289
SHA512 fb12875d2048a0e6408cc37405563b1d4c9ec8fd65cebb3dfeb477cc0aefe290ee95866ff374e8abc313842db81f6202a4a7917d40890d2bf0626fd2f435689f
SSDEEP 12288:lshta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:lsLxvXqbwGRz55jAre8MjKiwi
TLSH
T1945523535FAB0CB2D35E52BA087351CAE0117F85D7A80043FA3BBDAB5EF9CE012A4915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 df48545a3fb391171b9e95ba16cae26b4331e2a88cc6da9dd875ab87fa022caa
MD5 ab00dfaf1183002a9a15859d27e6ee59
SHA1 9b270acfee3630a29c594de47b09d3c484be1701
SHA512 f12aa994b351e9891cda63f5348f10bb6ebb167973c798344646d361a8230d4ce1038ee837f07853b9058c2025014069458840e63fc5a3681b71218a96ed2d4b
SSDEEP 12288:lAhta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:lALxvXqbwGRz55jAre8MjKiwi
TLSH
T1C65523535FAB0CB2E35E52BA087355CAD0117F85D7A80043FA3BFDAB6EF9CA01264915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 9107734ca015c8a5e946283d0e0b166eba280f1744b8bf77673712e985ba5ff7
MD5 a3e815aa6568b7ec1010b2d11124d185
SHA1 f82a942c1abf4f81a9911e663e34e09ef3698161
SHA512 d5376d4008493da849f64e3ff677baf77e91a1791edf47595116b921af6b9fb726871d21e8ef0de978983ad14a05e7a578a1a54f7384a582ab2b2ba6c47a8842
SSDEEP 24576:4ZMJzFVSO4LxvXqbwGRz55jAre8MjKiwi:4ZMJzf8LxvXGApMjKS
TLSH
T19A750191B3A01CF4ED67823E8C628946D2B27C5A4B70C61F13B43A6B5F736A01D3DB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 672c0d230979e455c8591a7a30b60d69abd84303313714b6ef9cccdc9895c868
MD5 96fc7ce3f6ed7da7edd68c405f9feb1e
SHA1 bc5c3de5df8435a406fadca1cab617b3debc4e32
SHA512 1ca16dd24f42c5bdb1c862a7a6873e18a6cff9e8e1b5694c6f85c7219cd76db21d35a7fe750f78ceb8ba94fac6419e34f9baa0bfe57faa98d9c49d1b7d32b088
SSDEEP 12288:nZhta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:nZLxvXqbwGRz55jAre8MjKiwi
TLSH
T1A95523935FAB0CB2E35E52BA087355CAD0117EC5D7A80043FA3BBDAB5EF9CE012A4515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 dd76c136271b446ab04398762a7875ce380da8cf562255bd19736117706058af
MD5 09f40379a48cf43460d723bf1268410d
SHA1 6143bc4d0371991288d915ccf42f51c576d28fbb
SHA512 0f06376786758eb3d49e5a1e26f703c9979a3a00bc294a99e0e0fc02cbe43896d91c332f99d7c7238e333c92cfe151da9cde9a0506e17e0d07310eb55d691ff9
SSDEEP 12288:MFhta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:MFLxvXqbwGRz55jAre8MjKiwi
TLSH
T1665523935FAB0CB2E35E52BA047355CAD0117F85D7A80043FA3BBDAB5EF9CE012A4915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 8c116c10efd1c509624af4625e2d30259b53a3767a3de805559c428d437f22bf
MD5 aab4de9c102e181c2f39608c2d387446
SHA1 67c7e955421a9f2c4ba832b5033e09b52c253dbb
SHA512 ba955e850c59d4d4ee9e6af012d46fbe776e9bddf2171bf63dafcc47977faf80d70a3c1dca9502fbf083060ef2ae371fe2c25a4a9682e6dcf3323cd25ee01a06
SSDEEP 12288:IyPz5L8Ehta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:JzyELxvXqbwGRz55jAre8MjKiwi
TLSH
T15765120337A530F9D16B823948A31A42F371BC7247244A9F67646B7B2F779E05E39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 977d34c4c22c3408eeb140d5829a344608c14fa2770cdbeb3301f80a6cb2d544
MD5 ea64b483ad80699d92ac3f0aff48f120
SHA1 8dfb1ee8a792daf50503c3c263e5250b5297d2be
SHA512 dc0c520bc184ce7389fd97c36769c0987b12669497eeebd0744689f3265ad4fb01357e0e81f8d9e40ba7d37f48b841b04cd941aa958084ff68d49fea49b26c2f
SSDEEP 12288:AZhta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:AZLxvXqbwGRz55jAre8MjKiwi
TLSH
T1BA5523935FAB0CB2E35E52BA047355CAD0117EC5D7A80043FA3BBDAB5EF9CE012A4915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 fcc8a3d1e58a8743472cd5416fc2a68b0262274db5afc431cb52ad743f43ebf3
MD5 5767c9edb42ddd45d09884381014e2e5
SHA1 3007fb2532abd71517b398cbbf77075e4145de1b
SHA512 6d86249218606f69b680063368b826c0b3ecdd92b02d3d9c80dd54015b26eec07968db9215052fe0494b8192e2effa9b48341e9e19eff8cd1ee92e6ca3386b1e
SSDEEP 12288:nZhta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:nZLxvXqbwGRz55jAre8MjKiwi
TLSH
T1805523935FAB0CB2E35E52BA087355CAD0117EC5D7A80043FA3BBDAB5EF9CE01264515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a1b01d9792600e0a64ffb07f586e73bee68c762e149eebe2be5fe729a31f4914
MD5 e4283e43231eb5c772c3860e5db7c62c
SHA1 df75e03558ac173e6c1e873852b11edcb3a01be6
SHA512 154ad572c894a87ed85ce192c4160aa7ee86a8dad1cf2ebfe28ce800eff293a886c7be8d972bbcbf869efc894248fa99c8da241c27b462ef3ffe88dd75618ae6
SSDEEP 12288:ryPz5L8Ehta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:GzyELxvXqbwGRz55jAre8MjKiwi
TLSH
T1D665124337A530F9D16B823948A31A42F371BC7247244A9F67646B7B2F779E05E39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 c0bc146b5282a958ebcf83a2579a9ab53813f6cf8276c149f4064c864101a364
MD5 e62de7e63d22e130e1b4f11693171c76
SHA1 222ea6d09347416383758d24e479995e08d917ba
SHA512 509d47b4a97cc505f1690e5707ab1598dde87abd30ce0ff91781a3a93d0c8bbeae4e68aa19d274963b2752c664868577f80d8cc88859dcb7ae4b36bd8e43a106
SSDEEP 24576:rTuaLl3z0zDCLxvXqbwGRz55jAre8MjKiwi:rTdLljrLxvXGApMjKS
TLSH
T1BC7502A1B3901CF4ED67823E8C628946D2B27C5A4770C61F13B83A6B5F736A01D3DB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 a5eff94ecbc3dcf0df4706a49ba868a319a045a9dab7cd7ba322515d32242bc6
MD5 988746c4d784a7b0d47bf936b679520a
SHA1 276a7aba02ba06870dab15a39de6b1cff0ec773a
SHA512 664ebda9802b16d086789bd05c1c585e6a0b5783ce9178bb51f7e45871bdc4743f9cf8b2307c183fe0a2389e459fa4ad0fbc187a88b5513a7c2a5962d8ce36ec
SSDEEP 24576:R3xd9CHKy7GZ2LxvXqbwGRz55jAre8MjKiwi:Bxd9CHKya8LxvXGApMjKS
TLSH
T1CF85DF90F3E414F4F1B79A358D724512DA767C9A5B31CA8F13A8265A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0fd1f719db7e4060c41858666b3fd8fc6873e8651fe87cbaa87fc0a90777214c
MD5 f9e7db5554f1e4e6e6e013eae27164ca
SHA1 d849663a1fe72d0c825c312c94e995d0cdabaf58
SHA512 bc08546ec72db978cb8d48ee6b49071ae29d1c8bde518e98821adac2621df88b20890a2c445a7e55092d1571448915791c889dfa41fb6c7f77906b092430c024
SSDEEP 12288:tyhta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:tyLxvXqbwGRz55jAre8MjKiwi
TLSH
T1605523535FAB0CB2E35E52BA047351CAE0117EC5D7A80043FA3BBDAB5EF9CE012A4955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ff90c1eb2ba8abd9835340858a3863f16c9c618252749f42d2c496852b10957d
MD5 4b5afaf674838568dd0071bb921b4ca6
SHA1 43ff744749ca0632ff757483288fd3e2ebca1383
SHA512 d1f5c6a03a4a6b1da6358a986c9b2844faca27fd59e0283c38a8bdda1fbeacd11041ea76b52af3fb3ad94775efba7d59978fc6e0eeb0744b4cdbbd1de62a783d
SSDEEP 12288:0khta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:0kLxvXqbwGRz55jAre8MjKiwi
TLSH
T11A5523931FAA0CB2E35E52FA04B355CAE0117E85D7780043FA3BBDAB5EFDCA01264516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 640fdcaabbd568de90fb19193245f5a73fc03d10ed0e53f9bb874f02791e48c2
MD5 fdf89c6bae2e6d80b9d790b5d0d8cc72
SHA1 ff7daf871a44183f9ec42c715198c9b12d4dbfac
SHA512 08264f2dba0cdfc9b7e67a164363ed5515893a61ca82eebf3ee0f9f8915f7326260dd449829c9c2a397bf1aadb55bf21c865bc2168ea3a6f5a3434eb8c7bebf2
SSDEEP 12288:Uzhta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:UzLxvXqbwGRz55jAre8MjKiwi
TLSH
T1925523935FAB0CB2E35E52BA087355CAD0117EC5D7A80043FA3BBDAA5EFDCE012A4515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2de4319bac38ec9c9032768a8d236d94d07a08ccc40a47f90a444136ebebcd8b
MD5 9ff2224ec3bdb47ab4f7edad0bb4b790
SHA1 154f9b3551295e1c4ecae9096fc8a58f081b00ad
SHA512 9fc496e893bf8d0395f8317de8e9b4f87cbb38d9d2f271d7f96fc2209149b792e0e5cd2a9c2d1b0436dd691aabb30e7b4439ec3edd6051b865195bf3853d61bd
SSDEEP 12288:DZhta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:DZLxvXqbwGRz55jAre8MjKiwi
TLSH
T1C05523935FAB0CB2E35E52BA087355CAD0117EC5D7A80043FA3BBDAA5EF9CE012A4515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 546f7e7f8b0fa1b9e8617d0e370e90092d2fac25fc85a60a13246d132d808b5a
MD5 5fee2ddc1c810adda10615f080b3c850
SHA1 20442123669eb0c78977578ba3e30c60cea9f128
SHA512 a75c50716df4934dea66bb20009186acfac10cca1000c9c58fac7612cfeb3bd4a5d1fb362ed847247c4e87a540da6c988421164434d73b4fca6b919d2cf6161f
SSDEEP 12288:lyhta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:lyLxvXqbwGRz55jAre8MjKiwi
TLSH
T1225523935FAB0CB2D35E52BA047351CBE0117E85D7A80043FA3BBDAB5EF9CE012A4955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3cf84c9f0ecd6baab04aa3535ed126d70225846c79b6dedb1d86a93ff2cd79e4
MD5 8a0418309d2b86991e20581bfc485a36
SHA1 87dd60390ef457dcec27af4ec6673cdeaec29596
SHA512 08509c5f21e8a42bf284d4ff2d1ddc960a3605ece4c82b826fa9fef4ac982726838bf0963538638875d08997ef87b398bc71a9089e384d65d7fe628761aa7eec
SSDEEP 12288:1Bhta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:1BLxvXqbwGRz55jAre8MjKiwi
TLSH
T1E15523535FAB0CB2D35E52FA08A355CAD0107F85D7A80143FA3BBE9B5EF9CE012A4915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f614dc3ddc086197801ee934f21ff77ba9dcf61c8f69d1c324085aaf66ac205f
MD5 eae4063deb9d1474b421c216dbb2f382
SHA1 3c38165eb3d1e8ba5b962c0679e77073dc13d188
SHA512 677d09e623e59c84f6c553c158fff8c9ec90870908c8c41725189944d2afb3ce01a3eff513ca399ac20f54d575fdba53f6b0977ac145565a086f8af3a9f0681c
SSDEEP 12288:7/hta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:7/LxvXqbwGRz55jAre8MjKiwi
TLSH
T1345523535FAB0CB2D35E52BA087351CBE0117E85D7A80043FA3BBDAB5EF9CE012A4555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 2417fda7daffff5f247c029608ed904269e8faeec1a34fb0e0f4e2d9e5fbd251
MD5 7bf497bc95178519e967528a3f1b1ee9
SHA1 26d42f7ef14f540c86dfb63294db6a130cb5e3da
SHA512 e733b1f81ed45ed61fbaecb3de48ba1dcf137c2b1ef4d447833c193a31a1dd0a662ff6b2b9966f79c64663b5e16af8501b4a13844cfe147f8e8c140f837411a7
SSDEEP 24576:XfwvOk9RX6wkyAIVLxvXqbwGRz55jAre8MjKiwi:HMnYIVLxvXGApMjKS
TLSH
T16D85D029EBDC48E5E1B7923C99B3460AF2B178591B31C2CF125A53AE0E37ED45E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 17f42299297d0bbbeeac24354747ca7e36c44002110c719cc298401d3c5e5386
MD5 be64ae2c087d71c36379fa772fa2440b
SHA1 9066b44360f66458cdf4cdf792c9fc521ff02cdc
SHA512 edaa8faf7d67b9e9d743c0e4c39b377f9d079c3c0fb524e22d3c69371d2c49cc57994365ee654c2eb8e863fa860df9ecddde0f1f13e1c66d6ae9be1458285cc2
SSDEEP 49152:nYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0eLxvXGApMjKS:JySzP2dL2D
TLSH
T1DC066C96A1A801D5C1B9C1B98F1BCC1BFA7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c50c294ce4f07921c4260ca03cd2254ca023b1d7787802920964bbea2a21d85d
MD5 49c8b8837f4d60b10d6b56fc4fc81a0f
SHA1 9b2791f5838acbaee11073fa7ad09d3aeb9d1f05
SHA512 e604645d1da70931c0296353d61f4946c9a0ebb100fc91f39119f29c9adce2d513b747fc68362b64ae155c6734f748ce4c5d67ed8b913f90880681938bf6d823
SSDEEP 24576:p47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYILxvXqbwGRz55jAre8MjKiwi:p47JUQjairIhCnDHUPfF/uLxvXGApMjD
TLSH
T14765AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF2270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3edbe5ef2d5145140cdf8dcd11ce04c11c9e1fa88a6de2133d387c0525df86d9
MD5 76b3ea3c918f750253f3bac0369e9395
SHA1 1494f21e2bf78d9dbeb9dd5c1e852f9f3fca63d4
SHA512 5c2df21f65b4fb3b989e79c1d69d6c0c8580cf8946aea6c40394910cd95040229d4c73b203368b9328695012fa9e14cb91fef269143a2ff058f7b04190c03c67
SSDEEP 12288:8ksfJhta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:2JLxvXqbwGRz55jAre8MjKiwi
TLSH
T13365F116D39802E8C16E6279CB524A41F3337C5583E193CBA6D0F97E1F7A9905EE9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 10ed3b5392e5047959fe8060654bf71ce2940a424a1c58a14e3ab83ab6480cf4
MD5 8f5c25faa093e368c0c5aa3a3f96e999
SHA1 39ce2a05999dd99ef2e3d65bb30a97dd63dd6558
SHA512 05fa3c886e6b577c74cf08585774eabda5efd3d26793f4194876bc4e6a2fbc47ed59260d623fdc1539e2a99859e7129e69d68e537cbe6749e24940ffa6b9bfec
SSDEEP 12288:Ei//5GU3f26NeA0igaf3XL1VMVesydmhB:Ei3gUPbkfxs3XhVMVezdm7
TLSH
T1293518017626CB4FC66940321E73D2CDAB707D41EE48AB0773C9873FD576658BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 2f784d7f0d159eb95fb20f4ad992e34ac524265bdf420e6083583067edab3558
MD5 891dbc300a9fc90e9a2bbc27d3596a26
SHA1 95604b60fcec40daa9c3d546a0d7d3b11b8cdec5
SHA512 8410479a2d1cc8749a65a73f64454ad9aa992ed3cb049ec2d9dd4b5dd5df5eb4270cbc1c67b026384e7a59e454b2f67da7ec5e2c94cfd38c946561146e8a542d
SSDEEP 6144:MyP3nP0FkIuhFH+eNvsGskTvzVeMe/ZnWtMxIn2snWtMxMADEgdN24qOGsLJIR+6:1PXPO+VNEJkTvzI82CN2vdSJIR+6
TLSH
T19575F841A537E78FD1B7503103265B8DB7A8EC06B7496F227389047ED86AB02A1BD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 15bf9d295d9daa43937a2bcf2c1ca32302bdf7fee8ad21821dd5233b04665237
MD5 96b305ad7a0c278840bd17b324b4700c
SHA1 08b65513dd5f209dcb01963be1eb27555b214656
SHA512 3cf5e410445a584fccadc80287cb8e09249a3bd1867b53c6514ce652b0afefbb35caa3922f0b997d2a2f6f261289c7cd326fec39d931e6c282bccbd0be4ba63f
SSDEEP 12288:az7xhta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:IxLxvXqbwGRz55jAre8MjKiwi
TLSH
T1B05523634BAE5C72F67E53B504739156A012BE84CB6800C3F526BEEB5DF8CD05AB4A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3b171453039b021364712c6dc337ab39cc89e5aea8232e94ce0e4ae00887a58f
MD5 f920ddb1ee973935a6d24047954a49e0
SHA1 6443a5e78566c173eeb079fe1189034843ec08ae
SHA512 21b3eddb93eee3090429708ca215b32d571b51570eee96864061c7d0b3e5ba30b985c7ba9fed525babdc7e2acef8cf14a0cdb1cdb7c25c31df1e94e2895c6d92
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYrLxvXqbwGRz55jAre8MjKiwi:xgb4mBIBhGFILxvXGApMjKS
TLSH
T15E65AE1E22EC02F5E0FAE2B89DA64417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 fdb2aee33b7513980036705eb8689cb097bf1a08588716567adf977451437d6e
MD5 c81474d19fe0f969f25ffbea405703fb
SHA1 7a9cc533bb032fe61fe615cc6598a47d5a873ce0
SHA512 9acb7c56eee9e9354862492a87060ffcb96d48c4963e6db145cca55eecb9dc1fb90b336dc8381efb73609042029a5be77d54e4628587509e4397b0334f98b9c8
SSDEEP 24576:qG88u8FpJqH1nzria7/m4LxvXqbwGRz55jAre8MjKiwi:R7ZFPqV6a7/TLxvXGApMjKS
TLSH
T1D485F16177E101F1D47BD138899246A3F6B2B8150364EBDF07A89B561F33AE04B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 3f6d2fe3d4e1c51dd84c1bced6d93d206714bbed4f0230bb8f29e581a3a4f017
MD5 752ea20078704059bd0cc050851176fe
SHA1 3a8f60010a60d937c55806e30f82ec72025bc06d
SHA512 b431849c1e8578fd8bffef7c253a732fa11d6881c863dd4745710f86f8f1a3ce0fb862b11d12edf67d27d0022ba9ee60795db430a47f50cda9a4774bc8ea1a84
SSDEEP 12288:ZHvUrBFrEjwaQ8hta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:ZPUr+NQ8LxvXqbwGRz55jAre8MjKiwi
TLSH
T16165E12B27ED1CF5E67AA17D89828609F271B852071192CF02A1917E4F77DE8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9d6c4d0703e3922a89bdd227ce382ea3d19f661cbc31db6cf63a80ebebe8e42f
MD5 2fa372d069325eed21f34d8e0a5822fb
SHA1 a1e65ccdae6f33d4435f3460982b1581c0d2c9c7
SHA512 244c98646a0732cfdafde41e7fed4ccd5f740352ca2a72b62b608a01091a2287b355f07a1e4dad416d777e4493cc53fbcf289ca8116d0eed9691a79f5c083bfc
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjsLxvXGApMjKS:1G05lO43b9dL2D
TLSH
T1B4D5CF6A62EC11F9D1BBD17CC9C74A0BEBB23815033556CB02A486A91F27FF4567E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7268a35665d14a7665d45b4617de443c93aa150650ddab2a3cd3d9447689294e
MD5 6e60223626ff1d61241cd589daaffc92
SHA1 48f23d35a41bbfbac523edb194a905840cc21b3a
SHA512 cc79db8271963e29a16eeda085cb423e42398ce2e6caefb0b9673f5fa601c78c0dcdefc03b9b86f5049c4a417d5e5a84e767656bbe9db8a6eb2d31fba8bc1eff
SSDEEP 24576:sfa5POZ3dpuWVM50JicR2hG0lasx2+47eidneLxvXqbwGRz55jAre8MjKiwi:0a5POZ3hJt2pasx2+mkLxvXGApMjKS
TLSH
T10265AF5EA7FC01D5D1B9D17DC583861AF5B1342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 44f032687314fe78416558a2bb04cb9b1e4cd60d3d4c38b98f4d4f048fff5f14
MD5 84a7259c580c9876b5c2e455db219f44
SHA1 3635b37fe255cf3d982adf8d8950559437e4a86d
SHA512 c47a10b87e89b22bcde4a9a7eee691e1dce51c85607086361d39b8a5e6f71bb8154a165a15d462f017076e2a136638ecedbe904af4882ce744337dfa392ad217
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7FkwLxvXqbwGRz55jAre8MjKiwi:JNc/zEOVHFzLxvXGApMjKS
TLSH
T11D857B2623E901E4E1BBE1BE89779546FA717865533086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 20bc081184b0ceaaf5401057fa58855904062eca28f28309f24803ac52cbf0d9
MD5 e31a19c18cb9efff9f54ee3bade5048e
SHA1 ba5a9965bd3ac723435ca8fba1656672cfa74b7e
SHA512 a3b170850d84ebf43771d69453e84ace938d60cbc06ea9f57eaf2b2a8c8deef4e98f2bd1e232f5cb56b829d60278b55eda6928c3b09de1b8a6ac5e01c14abad7
SSDEEP 24576:M3kNvNnaFeYhJNtmZBmKLxvXqbwGRz55jAre8MjKiwi:M3MwBtOmKLxvXGApMjKS
TLSH
T1ED55AF6EBBB806E4D1FEC6B58D238512E6727851073253CB9290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5d8a6216fd913a0edf025374266901d1302008cace8c177122394a32d47244a9
MD5 8c5de05d48460c4e580f5ce7f3e9d0d3
SHA1 4fd853dc43adfb35da49fcd4b480fc60e4936a13
SHA512 014658f105fd5b066d78b6403570f1c59f3a117d3518f05fa3f5186a388a691caffdfd5396193704c06666aa447e1fc3a8a2cb304e30c184bbdd4ed31bfda529
SSDEEP 24576:nD3FHshBIYQgANLxvXqbwGRz55jAre8MjKiwi:nDVHeBIAANLxvXGApMjKS
TLSH
T13D75E17EEB9C04F4E57BD1BC8A638606E27138A9033155CB1294D1BA1F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/556-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/556-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/556-157-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/556-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/712-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/712-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/712-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/712-158-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2060-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2060-246-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2060-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2060-54-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2400-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2400-21-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2400-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2400-15-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2400-22-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2584-311-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2584-121-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2584-113-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2584-115-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2796-2-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2796-8-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2796-0-0x0000000140000000-0x000000014020F000-memory.dmp

Download

memory/2796-7-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/2796-65-0x0000000140000000-0x000000014020F000-memory.dmp

Download

memory/3044-131-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3044-125-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3044-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3044-136-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4280-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4280-52-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4280-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4280-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4280-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4688-89-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4688-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4688-95-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4688-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4688-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4688-326-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5152-102-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5152-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5152-108-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5152-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5152-312-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5152-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5816-67-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5816-307-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5816-74-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5816-68-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5964-308-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5964-79-0x0000000000A40000-0x0000000000AA6000-memory.dmp

Download

memory/5964-84-0x0000000000A40000-0x0000000000AA6000-memory.dmp

Download

memory/5964-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download