f8e294646d2336f8ab1c25feb4c36619a91fb577c105832b3a0ead8287814c31

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 05:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 805KB
Sample261102-gl99dahv7k
SHA256 f8e294646d2336f8ab1c25feb4c36619a91fb577c105832b3a0ead8287814c31
MD5 e113721cf08ffa14da178b0bef2f1dd2
SHA1 5d378c3302a85fce90dec1859c24864b6d3a0c3b
SHA512 2df4e2d5071beb7ca8cb81e4d34ea93dcd1e98145b5f8571228345fa760b382f6604f5252a4f45038b452800a8328bdf75666a72a0cad02abd26efbe84f50c2f
SSDEEP 24576:+rWoK4kNM+CsqjnhMgeiCl7G0nehbGZpbD:/oK4+GDmg27RnWGj
TLSH
T1A605F106B26C3CEDE0668134857195A6AF32FC311750960F17F57B666E33293BE29B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2668	elevation_service.exe
4040	elevation_service.exe
1424	maintenanceservice.exe
828	OSE.EXE
2336	PerceptionSimulationService.exe
2248	perfhost.exe
2840	ReFsDedupSvc.exe
752	SensorDataService.exe
6068	ssh-agent.exe
6132	AgentService.exe
5712	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\51b6e1517465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaws.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096ccc1b68e6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4e5baf78e6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a0f2db78e6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d75233b68e6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed78f1b58e6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002de561b98e6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2668	elevation_service.exe
2668	elevation_service.exe
2668	elevation_service.exe
2668	elevation_service.exe
2668	elevation_service.exe
2668	elevation_service.exe
2668	elevation_service.exe
4040	elevation_service.exe
4040	elevation_service.exe
4040	elevation_service.exe
4040	elevation_service.exe
4040	elevation_service.exe
4040	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1324	2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	2840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2840	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6132	AgentService.exe
Token: 33	5712	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5712	SearchIndexer.exe
Token: SeDebugPrivilege	2668	elevation_service.exe
Token: SeDebugPrivilege	4040	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5712 wrote to memory of 540	5712	SearchIndexer.exe	99
PID 5712 wrote to memory of 4676	5712	SearchIndexer.exe	100
PID 5712 wrote to memory of 4384	5712	SearchIndexer.exe	101
PID 5712 wrote to memory of 1168	5712	SearchIndexer.exe	102
PID 5712 wrote to memory of 3272	5712	SearchIndexer.exe	104
PID 5712 wrote to memory of 1604	5712	SearchIndexer.exe	105
PID 5712 wrote to memory of 2656	5712	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_e113721cf08ffa14da178b0bef2f1dd2_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4040

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1424

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:828

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2336

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2248

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:752

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6068

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6132

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5712
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:540
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4676
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1552 1548 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1768 1784 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1168
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1552 1548 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1768 1784 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 42399cd69ec7e098391bbf4162dd3eafcc7fb3db90f82d1509382d927ace67e7
MD5 c5ac08b354eb3107bb5d9229c3d47330
SHA1 9bbe20ce21a6f6605a7dcd28005dddc63193f119
SHA512 5974b301554a1a61cfe6b7eea087c037a15b51347c67f63297023a63648d0e5f946b6cda739c88db2121d2179ed54ffa81c3fdf07a9cad7b0bd68c0eac159843
SSDEEP 49152:Wb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnlDmg27RnWGj:I3q6sjBmD527BWG
TLSH
T10BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a732cd68420abea470f707cacb9789b53258acd7110436fae9a0eee9d8800847
MD5 79e7fbc7a57ce61ae95fc67027f9847e
SHA1 1cdb9c5ea038659487f27d6b3bdfa5f734b98963
SHA512 cfadf95bbf1a103226bbf9a498f5a02e4bf898fbc6129e6bcd87faad18b6394ef9e1e1f4b4b11ed2e6a5ae42500f56d8475fb7d93b50ec70af8725a015127560
SSDEEP 24576:eXYfDtczAesqjnhMgeiCl7G0nehbGZpbD:9tcjDmg27RnWGj
TLSH
T1A9050129B3D408F9EC67817CC9A2C506EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 505931f09c109c9afd3c3ae632002da55d6db311d1ed0b4e2b3b5bac526ac9bc
MD5 818a3f17efd4147e2f92e0ab8cf0638b
SHA1 7f7af14ff4e8eaab31b0d888c82548a0c8992a8c
SHA512 ee40244d5a5f5776185fae5f35e12327bbdb90d36d473030c872949987d998bfba2f5418059852958a8db2f9ea463428b91a973a85bb006dd8fafdbae31bb9b8
SSDEEP 24576:m0Le5ji0hmxxrMZsqjnhMgeiCl7G0nehbGZpbD:mPji0AjUDmg27RnWGj
TLSH
T184359E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 87e5b11ea7204b0327f31b584714e95eaa79ba70ab9de15c4a5fd36f66105874
MD5 2414f5fbb00fe866a4b4d2ca84711543
SHA1 c6b1ad7dcf3b399fe5daf4515dda5f8e5b52db93
SHA512 526de7da498040cdc278583bc8d85f936317c6077a7689e427e2e3f01ebb3e390f7b65e04be0b83d0472f70ff16a9f5120177a08c89d4c95557b2062f6cd9033
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWn6q8wyuPsqjnhMgeiCl7G0nehbGZpbD:A/ezSC6vUzPveHjygDmg27RnWGj
TLSH
T1B6755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bc131a1882f35a67eb9c0953f175c4b98ae783415ef941cbd8dda905813a5434
MD5 904c87081d07e56e2da5653ff35687a9
SHA1 2d56b97a919c22e6a5c9c45a27be856cc28a26fa
SHA512 d14f83040aaa24be6df5f91a4df076c2c548550210453c54ce79784b9b244bd2cb36479af09d487e31e443b7ae0c894aef4bbb2e95e2ff6a943d5cb908fddc92
SSDEEP 24576:iVbqPb88hv/l+YysqjnhMgeiCl7G0nehbGZpbD:iVO88hXl+bDmg27RnWGj
TLSH
T1DB559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 1df2cc6617fbbeab891388379ae06af299e207052c86c946dee8b698a9997e73
MD5 c0001dfb7eea0c6317f8893e51528f1c
SHA1 e890ea23261d70ace2afffb7360f50c3294aa6a3
SHA512 706674d504ff70c1f78a8e9bdd6ac806aa4fe2fd5c16681fb1262ca56246eee800be7b1ce5296ea2968dd634b649527267529342df40b86bf5ce62d898c93afc
SSDEEP 12288:gLgAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gLNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E9C423BF964C50CAEB7608B5C3E9F15EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 9799717461e58d8e53448578de8b468bf40c1fda5fee83bab5c02fc993334591
MD5 acb3406ae2d972eece3fd07a21cd746b
SHA1 5fbd9bc04176626f9128cadd8f00eb707441b6cd
SHA512 b5dba967f9b16cf81a18d9d89bf22cdca9b0b301e9723f36bf6ccc3b955eecaafad6661c3e0a5dafcd6a7aa4d1b388c866631e8a14358dde1dc5adabc98fb9ac
SSDEEP 12288:geBNUbTVO86UFAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:gJIU6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B05CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 08a3af13bae233e7c6b8dfa356049570a538a01883cb1cd14a6d62569cf293af
MD5 dd6b0eb22e2042b4d8518c6a13c9b9e9
SHA1 55de6ae433eac832460a4d9fc875a601cc7ca0b5
SHA512 81fb20b5c25c8e32dc160927391479c2524e0ff9ce0d1e97c89b5c1bc56f028d565c1277618c276d0f8ea550ebc91de49a8887cefe9f667c60422505c0183152
SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THd:kQvGAdlCEL8c/DRNw5CDD527BWG
TLSH
T1FD266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 5aeb32d478e2022e390b16dc55fb93de1b48f22bd01b21ea38e360f38f09df2f
MD5 646cb6aaa23b402315be96417d66eb4f
SHA1 86121911a5c545baf7308871fa9a51cdc7881cab
SHA512 1e4b3fb756aeb0e6da6d48edbf0457d47914de7d0e58ed49d2ec4c98fd96b5f680ae79b10c0daa4d24ce03a26a55875faa66ae59b1f9f7d434520935c0ec348d
SSDEEP 12288:hAwSfxL/2Dc3RDLLmt0LDQewsAj/AXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQK:C0ewsAj4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C15E031FA74E036C37B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9e83c476df2abe988ea32ff64af770bf912e209985beea170b43ae369d0ccf32
MD5 20267781f68d034280ce49caae5318ed
SHA1 be7289f330a4d70073df6f869eaaf5dae50b05f7
SHA512 d4b5223a0d1ac9fb025b2f00493229be2f11008857e7401eeef21cf24fc131e57dc89a62bac1ed993672d91c27ffcf563ae12ea7e53c5ef9243ab3f2b695636c
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHMVQBWG:nUEtQevvqc2W1cpV2tI32TB
TLSH
T1E6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 063a1e5e9e25093188235a71aad9778261c63ce6da88343f58956844415f984f
MD5 ad544e8a7e56096f8e4f970bfb83733c
SHA1 34e02bdbd80211468f5b798be29d17102f7e0122
SHA512 b81552c3b7b40bee63eef528fd86b75460136ca6e71397eb64f44c351e9cd4d28cdd67eb21ca9bb790a0eb3c9b709502d04a06a7b31d9f8176097e5517237e93
SSDEEP 49152:GCbRquA/m2yL5zTfFiV+XenmE3/zEDmg27RnWGj:roquVjnmvD527BWG
TLSH
T1DDD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 192758051e9e76fb96f9eeb5200bcb5684efec038bef04257574f280de77992f
MD5 b800156a44faafe22b5d7809754d7742
SHA1 4c4cbdcb004170c0226d4230fa0c45bcdd90e5b7
SHA512 deb7b41573937dbf71f0589897ca0fed9067cbd6b6621409ed6a0770880c3bcb046ab75d362a7a16832c6d2bd17e962a4846132b008aff7255824471dfc966fb
SSDEEP 24576:KAhGL3IFoiwtA5l7S53bsqjnhMgeiCl7G0nehbGZpbD:KAMUFoiq5/Dmg27RnWGj
TLSH
T170359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 4fe83a1a7d2b1424dd816683d9dd4c2e9f468b35fc303cb65a7ac7d99fe823a0
MD5 fcc10b847a12f84243af7ef12cacdf72
SHA1 49d6ddfd3b0b5dd926427c7a2b4ecc509ff8c180
SHA512 c393369b682d1af193e2ef007f4f346491c64c9bef4bae94fadb2a7cd6cdf4ba36ec518e11392a525bbf060dc1b7943aca67ae5f66759f24c055c0da008df84f
SSDEEP 12288:kmw5HEjsChNVBFgl0WDm+COAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83i:Bwu4OWksqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C05F15A72A81CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c51bc46faa0347621b9b63a8320ab372afc6e1e81148eacb1d77b4d9e0c7570c
MD5 b106e5a8b19f97a6b0a4929bb77b0fee
SHA1 ac508b621822f5b12099a2413bab395384fb7db3
SHA512 ed28443c843509955dcaea3363c83b7cf8e2523997229582d789c179130803729dd57a7c1e018f6fa6642477cdb3729b6fa598d410f41acf07f0c01c9f93156d
SSDEEP 12288:JeZ1IyvAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sZuhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T172E412AA239820FAE163417CC5E5D609E7337C62673043CF166659AA6F73AC44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 84c185710d0838bd3483ad2da17ef0fa237cbf7e3ce5c42e6f107b1d25c6a46d
MD5 001ac1d62bbf2b1af78110013e1a90d0
SHA1 e22e2d8d65211c4c5493cfbb12b4e54b7ab4021b
SHA512 f5f6e57920ebe2c9c45625bb4f7927a5b2e129148c58f5a78934b2a7d611ddad0253268e56f6dbee8b8125a1d109e9c4b6c5201b536061c78362a7beb35ea2ba
SSDEEP 98304:hQRQyi36YOcPbLvw2gAf+PN3KD527BWG:4QyiKa/X+PN6VQBWG
TLSH
T15D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c78b25f66ca5244d1b50bedd29ac9ca6014afb9858b8f48010987da093062de9
MD5 8b4f6797c38e283f133505b701f4747e
SHA1 4b7f1d101494617a1262a063550f3f295cd8639c
SHA512 448caa9663218fbc22132db368f165332cb29932c1d30eeada8188ed6a9d39761da88da930057740d40d1734073bc3e5fc082fc824ba176e2eef5850bde6710a
SSDEEP 98304:OQRQyi36YOcPbLvw2gAf+PN3KD527BWG:VQyiKa/X+PN6VQBWG
TLSH
T112667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c65824eae684c64f96607d38f5df21edbadc7f266431fa87a8170910140781f5
MD5 a41950ae5ef0b1bce01ec5561e597f89
SHA1 45838c32e1475cc54bc8d6727546a981e17f8d15
SHA512 48b42cc4762eb64ff75a3304393abb0c8ccec5691d1a75da9973340932eacf4c315411335a0d70e19e0bd5caf2dd7c0072c2d27a1bed8458ba96f19c1ab0858a
SSDEEP 24576:IwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0RsqjnhMgeiCl7Ge:O68Qg55nhceWu7PNU3/UDmg27RnWGj
TLSH
T1B5B55933B2F60099C44DE1769F4A872196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 18449c4e5c829bc09983d067d134e83d888225b79c1286f26f29dae7349af2de
MD5 99b9c34c2570e771d6a079773a354b35
SHA1 7e69773da9c984357867a0d6d5320c3e58acb92b
SHA512 0f7e01f2f0ba8915251f9e7dedb0899991c81683033c3100a3bf6cf4483cefa65fe7becfe704030182e83765d35ade801921b4f0cdf158806a1225be76c7953e
SSDEEP 98304:9y5112gYy5azzVvt69nLKnhZxD527BWG:gLIHEWh3VQBWG
TLSH
T195167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 63b875eb5d3fc4f515a9bffec44223fbe4631d04b7767d9f4ee7b3712fa1f3b0
MD5 8c1e35ad240308ac0939b9a1d14d7945
SHA1 f9f98fbe98489664fa8708a3253e02360b29552b
SHA512 472b908dfb566a1fea24d086377b1ca34dbd7e468339c5eb476fb2bfd6d651b658496d2ff93696a3569c589fd08096bd9731574f82b7e86d78084a915af69c91
SSDEEP 49152:tB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gliDmg27RnWGj:zu6Jmdxd2diD527BWG
TLSH
T1FDD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1db4ed2e0acb8d9ecc30a4b5370cb0fa7792ed5bf269871483e257193fbb0975
MD5 76d30a8d6d750aab7419885df93b4152
SHA1 24d6edb9530772588912d54dfebaf89b11a8149c
SHA512 911ec49f594d59ef89441e734168f097326bd25993dbc25f529f1152b7718c6c5f4cb9de84c83542fc95d04aa71f773365c757cc0ee293f167d9fd1b57d9348d
SSDEEP 49152:T1hpsNoJpF1A63U44CwH7R4xuDmg27RnWGj:TmifPWRvD527BWG
TLSH
T15BB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2d9d81b7d3d8f4fa9028624889e55bb27c7e9d743cc6c4b2a875a92aaf8fcea9
MD5 781e3e5716b2b88676f71d811edeb469
SHA1 326503779e56d8f6a8ff252deaf6d610de668f1c
SHA512 8726d40275f34cbc4b89e9224bfd38d7c149249bd0a49f19e716d62f58c268a67b1859fd7d7a266156e167f1669ffd202cbc5437e36f3f6853f2f0dd52fd68f1
SSDEEP 49152:GSuZQIY0Be2KcRVtOnks6NMHq1Dmg27RnWGj:I5dKii611D527BWG
TLSH
T175C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 121dbcbfc08557ebb8a9a3985358e26bc4c23baad32d684018811c2a2894e010
MD5 46b31c3475261acee91c9046fc919b30
SHA1 6e42b1eaab13ff07dbce783389055f39bb1776d8
SHA512 1f7deaffdf8afbc3e09b47d8115d34edbca4fe92a068f3dfc1e7302bfabfc52285f9b7f7d8c4f197eb1ebb384988fb372d62131133bdedbbb7f848bff3a3f666
SSDEEP 49152:qhtSn8EApI0fig3giDn0AP5wyDmg27RnWGj:LX2imphrD527BWG
TLSH
T10295BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 dc826b7e24d7a9e61166d7e9fb84223b191a5137120735badd965dc7fc582c18
MD5 aa69b7134865401dc6cc32fbabe58ff2
SHA1 e32c76a2db75a7ce6705d5e87cefd94e218c6cda
SHA512 54d1fcc2055d7683c2aa6b8dca3edcd762264bf36ede05b1ce5e71cb6a0def8b86d38065bdc0a5ef9685236fe8d72f5080e1d8eb98a5628e6e22a24ef0cfa223
SSDEEP 12288:uoAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T188C423BE964C51CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 2eec677380a3f6614b3877a05bf6f84f28626cce52fdbba33daebcb6c86d7521
MD5 efb1ae1f6d5bf8562013edf63cbdd8e2
SHA1 8c75f417ae40b2d9840990024619d027886ab54b
SHA512 6ded0cb418661b7822ca575b6d59dc02ad99494a54fddd0c2db7d710a831be734f9dee735521cb121034921909baee9926df6ebb7a9500c6a5057e9d846d1b22
SSDEEP 12288:JTAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:J8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T118C423BE964C41CAE52644B5C3E5F14DAC073E5BE92004937AAB7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 d4b3873b75200f88340f73fdc797f5bc66e6ccb49aa20bba82de65d7cc74f8a4
MD5 e4b6339801f306283e462b04e5518b0e
SHA1 10a35592e629d76e65f38d287383f38bf36fdec1
SHA512 9ce2802fcc5f5a6f393e101c73123e9157252d0f9573e8b26e9e77140764da759800d6b9417951ebba525952bb4963ffc779d878493eee6d81ff24fed033105d
SSDEEP 12288:etAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eisqjnhMgeiCl7G0nehbGZpbD
TLSH
T18BC423BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 06a0da609985683721c4887ebe549d9c3d1f0fee2a5fcbd4459d6f78ade28358
MD5 c413f3696b5d06ee9fcfa679c197d11e
SHA1 4bedb0fa1a374a2e1c07f2a6d94d4e5e71667a0d
SHA512 e6ccf234df5cdaec3be01317115e36ea8c0204439ae01069c4fe821eeb26db1efefaa9df2b23acc89c96ba7b20d808dba1defee7f7cbf99a74878e5014b144d1
SSDEEP 12288:IVaAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CsqjnhMgeiCl7G0nehbGZpbD
TLSH
T198D4237F575C00CAD83285B8C2F5E11DE8277D96EB30059B6B532CAE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 c5cdd515977c2ed7bfc80a95a16ecfe5e1d921083bb663b3985c136a578cbd83
MD5 047e5f3ba31bc2489058eed4299d20f4
SHA1 075df90c4625b23c8456dca9a83d4663805f3486
SHA512 052c6f8e44936064194f3d8e3c8e2aa2e21b22e0f209ba39981cbd94a44db72d7823a9c005b2ef7619b3301a58de7f46bdcd4729ea33559967e33aa6ddd332b4
SSDEEP 12288:bSAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T122C423BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 473df0bbde4ca313f546f5555518ac4adfdbf0de000069bcd1f9299a9b0eb08a
MD5 b7e5960288444856f738b3beaa9d60ad
SHA1 2f85b69fa9378bb2898573855b37f166b7444b2c
SHA512 33750ed54f5728effd429ba73eaf656cd41415294451ea3b958fcff097765774d580a903669f1abf2ef7d82172b532fa969821eba778cfe0f76c72595e4c75b6
SSDEEP 12288:AHAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E2C423BE964C41CBE52644B5C3E5F14DAC073E5BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 d51d3b575dab672b68cb2f8c01e0c37498d5821ef0fb18de9e199a3164e897a0
MD5 1988ecde63b8e18ab9eb1d68877b64f0
SHA1 744c9f7cd136a098aec8ab086f69aa3d7ce26357
SHA512 3a95fbb376ebf6690114d106faf8ddbcf54d0b0ee56b87441be174268af06b48c594d272d4b3765ab2a89d9da8a2dc9e2cffa9095a2183eec0e37b10e1c38808
SSDEEP 12288:/LAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/UsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F5C423BE964C41CAE52644B5C3E5F15DAC073E5BE9200483BA9B7CBEF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 5008aff81c75b0e262881a8670f5315c347d53fc85135f947acf37822d35a2a7
MD5 417eaee36294ad8da7f7231d12c516d1
SHA1 ccb7d6d85e295eaf2ef64f1b73c5d3acc8ff624c
SHA512 a82f20148adb0b9a02eb0f307fe438af2edcdb4bb978b97a9987e88fdc93d1477531a816ff5913195ea4a6d980ce7a2d1a9edcc2f2aa10f691f0f631fce5c107
SSDEEP 24576:9ZMRzFVSOcsqjnhMgeiCl7G0nehbGZpbD:9ZMRzfsDmg27RnWGj
TLSH
T16B0501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 025d30fafbe5e7ca12bd658838e1542a73fed77fd7e48d6912f26d14667e8960
MD5 20cbb90f1ff1fa9a2db14bb578c47fce
SHA1 6b24ea255eec0afb1d022110928ee0cf876e1272
SHA512 1a4e7b1385b941275672e4302b57085e93435b12e52ffafcdc98e6c08850788d538e0af8c154456c8997f1ccbd84d068e4c6f83e881c85aedec53fa2aee6b804
SSDEEP 12288:KkAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T161C423BF964C51CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 5379d9f6b8d5bf1f11198b308224aabb19448a9fdc7b9857954dcd1d83c5e48e
MD5 a8fcd2c59ce9876a0767bb34d5c4ba67
SHA1 67c155c5e5fc49bcfaddd2574d21f3aea5c939a3
SHA512 85107aa7de25cabf8180b7b0eb47146a79d9ff22a10225555ff45febd269f3d4eaf53742e0f8f37b18298b3f20126927feb363f1a2114492f64dca8f241b1e1a
SSDEEP 12288:rQAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EBC423BE964C41CAE52644B5C3E5F14DAC173E5BE9200483BA9B7CBEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 44fc22b3a75d63765908ab289c7541e15a20d6794255f9b2829f9f4ddac14004
MD5 2ca79e23a4eed3ea375850a8c966ec46
SHA1 eae9b8383a437be89b754cabc62b8863fc31b12f
SHA512 61b3627389cce2764e3cb1191ff010c35e3719458bb8831639491a6068d798094cbc7f8ef01852b6ef1d404510ac4b3822447549b71207f2a8db26685f9a8920
SSDEEP 12288:ryPz5L8vAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GzyIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C2F4125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 9019d66ec60dc8bb39fd49fd517b6d3cbc820a238b5605dea51f1380c7bba9ac
MD5 3088d71bb73f9cffdd5ddce47b12626c
SHA1 68bbd75cebda9f2e705831c4b5595480d124365e
SHA512 7cddf3484ff4f558104b3a1e8ea5db8e5c117412cf8b2bf37066f6511086081c29ac04f48e480d209a09e0faa5bd596f9c8e0acdbfe86dd039d47c551addb4df
SSDEEP 12288:CkAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T140C423BF964C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 8f4d76d929135e0f4f3d3bb622b4d1d12327334e43572ccb008eb87f1ba79139
MD5 8dab193f43bde09c222da39dd7a8a40f
SHA1 67c6ff124859ec515067856e2f136b033f7e3f41
SHA512 29ecc98d2f27d35a102e5f229f4e1e3058126f6aa6fb0615d9b8d1168e0dad81b1a207849393b66311c5d1278c908133ba096683f6addb7285acbc4a28e37e78
SSDEEP 12288:TkAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T179C423BF964C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 a3b0abf03ecba7fe74fbe635f3b16e945262c414bbbab709969e3d086790e51c
MD5 f34b32f613cf495541873f12207c16a4
SHA1 31434ecda55e78f96816220c661a94150e7764aa
SHA512 1517e8cc06992793f8afcb217f8d706fc3190aa34bcdf3d9e1ad9edad11acf1f2c054f1cde52aa38fa800f7a0938e97d5cd5128ac3aed187cd55a1c26f9d2e06
SSDEEP 12288:4yPz5L8vAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZzyIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T181F4125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 f0bf4d000cfbbbab84c6e2bfb0ec94002af889b537ca41012bf5c1c1580d4a10
MD5 afc0acf231479a56ff4f140bc0d6e86b
SHA1 cf173e8e0533eefda97042b2374ad7d74fe099ab
SHA512 a1fc1e12d9cd58752d54aeda2cbc423e452b3be61d6893c78ca2ed36687e9e09766ad4556413056332feb1a1a928cea4a425c64327cd8cc89d187af55c3b09ca
SSDEEP 24576:GTDaLl3z0zDSsqjnhMgeiCl7G0nehbGZpbD:GTuLljzDmg27RnWGj
TLSH
T17E0501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 4dcfe35cc067874ef6fe6abdb535e19d5109f9f43827ab2c12bf024b9dfbbb38
MD5 80c10d62eed2a83af1dae5c72619dfdd
SHA1 e59f2a1b14b0d02c939966721d8f4bb8724bb6d8
SHA512 c34555c5acf32a051a4d14b974ee1e4a65499dea1ec63bf078b33fc86d95f8dbacdb91cb9e8dccccb60ef53659460d03184fcf9609c1da58a82855a4e723ece5
SSDEEP 24576:O3vd9CHKy7GZmsqjnhMgeiCl7G0nehbGZpbD:Qvd9CHKyasDmg27RnWGj
TLSH
T10025CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 8b44e009a23c8000effa1d3cfc2ff759bd0db4db81e054e67dae69f0759e0755
MD5 1ce81052b1d99e70739abb89ae225121
SHA1 facf0430d65f16e1ee016891647f283704087b09
SHA512 60109627e60a72fdaa05ab539b11d8503605a2a6e91bb6b00410df104ecd606383fdbea03da38ee7feb02b9a9f2e15027ff3d7cc888a95a48cdfceca56d75b88
SSDEEP 12288:qNAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F5C423BE964C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 5e51c16fb49f65f9915f2eb6c20f497a737f627f855c2c0826e4f0716e78af0d
MD5 d79b08e1383815343b11bcdb00a4f6a0
SHA1 73872fad64dc464e3372e1b123791b5440161c7b
SHA512 c6de38958368c58884ca8ad7619a93f416beb712636133ec92eb9de3915a5807f3adfd9c37feda46fff205115395df0a8e1d3761fbbe5aeb037c9158802016af
SSDEEP 12288:UPAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UosqjnhMgeiCl7G0nehbGZpbD
TLSH
T150C423BE965C41CAE52644F5C3E9F14DAC073E5BE92004837A9B7CBAE7F18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 1d65ce4939bf44309deb5bb862eae61f98479dbeeb5d2440463ed930f2821d7b
MD5 39846234dc7e5d4c1d79438382a1646b
SHA1 4b3c9138fe9bd80fd2523830cc97b689021c0ee5
SHA512 e6b64d432eef778ed31d06446492d47cf70a06d6deed6ea74b0a30ef72cc29ac69242fb4dc8a1f6cc3ca84338cd568885b5bf5a604d3447f37088d21cc5dfc87
SSDEEP 12288:7mAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7nsqjnhMgeiCl7G0nehbGZpbD
TLSH
T168C423BE964C51CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 59fc4d713ec95239ff27c94163aaaa2bedf59cf117f4102dd9dcfac910d73827
MD5 e97de935d035f3e5967e5fd82a4f0dc4
SHA1 7e35194d595184759e27154bdad20ffca0b4b69e
SHA512 f9dd4fa52343226ffe2607757dae47fdd0f396aefe29d8c3d76a11c319d5ee4ef65df3b579551f943cbb47b17a62954a1ac5873812050fa7e54dcd03c595e78d
SSDEEP 12288:EkAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ExsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D8C423BF964C51CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 54171860d1a401febf7f5b70827fc2c5b82993fc1bcf3d282892b4fcb0fcec3a
MD5 65227cea64697640c30c2ea028f8bdbe
SHA1 f3d830fea6878e4ebe426a9380150f7e61ad0faf
SHA512 34c1880e109e587a64239984574cb66973b681f50a3de65d59d108bb41791341b689bfb3a088606a184498d0a949137e0c0fbcbc9df20b9002a23f6cfdfc247e
SSDEEP 12288:yNAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B9C423BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 2da2419ec51aaa942a471045c3a8859c4c7212106fe5ba5ae502726b75e88465
MD5 2eb9f654ea2d5cf6cd117de618d7cc3c
SHA1 7962b9500975bd0e3cf0e23829e75ece4ad84d72
SHA512 454582af43dbd68faddec0006f44853b56e09087a34a01925fa516200c270cb22f7b3fd1c839cd7bfe1b8d149de2d767a57fcce343e94823638e26a06df6b852
SSDEEP 12288:Y8AXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T186C423BE964C41CAE52648F5C3E5F15DAC073E5BE9200483BA9B7CBEF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 d985365e0b400e5b17961747318da25d626eb0459d581cea7f68ef665d379444
MD5 35152584ca89c7ba13162aad7ca1e3a1
SHA1 3882af5f64d0332809f2f7bcfdd79224b94880dc
SHA512 566b93d3392bd7aa4192f8ace6a9d0674b9ea147f3333228f563b09498bd38e93a21a3f7a1c4bb4d429e85993b72ab8863c50f948deb297b81212e09fbeed5da
SSDEEP 12288:7SAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7TsqjnhMgeiCl7G0nehbGZpbD
TLSH
T119C423BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 fb6883c115f944161e4458f8e96bd582d320c60f02d3ac49e6bd9840534007f0
MD5 7fdae47455bcf2d4a1d1c6e82275e2e1
SHA1 cfa723622c1a6fe36d99eac4e9bbf21491fe6c4a
SHA512 18afafb29ed92019d7140feb84e020f9ccd5787ca0978af4bebb604d42255e77ce93f8ac9a04e91a3ef385bf6fd13ad87d2068f2ee5eb64fdc1684f74e0644f1
SSDEEP 12288:w1AXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16FC423BE964C41CAE52648F5C3E5F15DAC073E5BE9200483BA5B7CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 9a86794bf66bc43e5fded34c804a64be04c55ad89d8838c1f0f317daace8cea9
MD5 c6fe27124b575f9800b590938a728df9
SHA1 94eafcaa5e187b3ccc1623bb06ea73cdafe91352
SHA512 527010c51af767d9a234f62317f317a695ce98c6b954ad63ff7379e1c49c3f6bc7b606e2132e19ddf339686ecb19c63c9ecdb82702b150e3ec46804942749a9b
SSDEEP 12288:ESAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ETsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BBC423BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 0ad2f89fc3a2ad460c7351f45621af8bfc86d5e9bd77964214e61123b5b9b8b9
MD5 6b4450fd32b8dd8d47ac51aba6d5d44c
SHA1 356b1122dc1ecb2cabce886d8ca7df4b7fc1d795
SHA512 87a3d9738d87550042807db0f35f8c8ab0977134e943c4c3dd6428f28b25f62f51254b2e6a06b6138e9a471a921d169f80ca787664a93332e81305ef221295dd
SSDEEP 24576:CfwvUk9RX6wkyAItsqjnhMgeiCl7G0nehbGZpbD:SMnYIRDmg27RnWGj
TLSH
T10235D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 246e294320f5842c08d48d47ba392abe23a2b3361ab992f18fe612daba0ec438
MD5 a371a6b4c74afd17235dbd05a3d7ac74
SHA1 22e10c07a06dcb680d85b22fbb3bb91be3c00739
SHA512 916730d9dbff0fd6145cfbca2ba977776be693d8747dc59ad3b36524a5c99639b9dab1c06c3718328639208be4bf0763946750774c5e2662a637dac862924a2c
SSDEEP 49152:kYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0SDmg27RnWGj:TySzPqD527BWG
TLSH
T17F066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 caff9c6c7c6e4b01c628edc0be16b7085f4edd88fe5c70c0f62b61bc03c2ef83
MD5 ec6d0a2c5f163b4e14890910071cd259
SHA1 b24111425d32218df1f0658a88b322b8e75d6242
SHA512 7d8e9e243f14bc9bc9dba91bd625fa9d6bc4584e26f200c3f55937eca8d092e73c3ff3262f921fee77f0e99e4783bf307b0ef377eac1e7551f152e0da99f7a1f
SSDEEP 24576:U47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYssqjnhMgeiCl7G0nehbGZpbD:U47JUQjTirIhCnDHUPfF/iDmg27RnWGj
TLSH
T1B865AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 09e1732067e69e7fc9f7612f6b8145d615a61e69914a00cd516215e7545cc321
MD5 5262e05ab7242e4dd8d1ac6edeaf41e3
SHA1 0d9c81234b75ce056aae059afac5b698f5ec2ef7
SHA512 665a81bc074f7f13992b910c3dc14d37e4a5a99cb13b93aa3de5cf99dae03b0cb3d411de2d136c9666adf6709eeeffa9c0764b783911dbd728066219bf7b6b47
SSDEEP 12288:Ibsf0AXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CCE4011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 789209a5f4c845296417fe8cbe759be831591563bab731294b274beff9f53571
MD5 ecb8bb13a2fe0481614258d91ba57c7a
SHA1 fe732f5229bab7f9f4837178dcef0ed049789f14
SHA512 16d4c6f426de5536cb15426741b6b7a651016fb85fb0dc18aa40783359ea6001ece0f448ec534bb8495452d1b4366f96e6e807698d340f4031fc306b2a840155
SSDEEP 12288:q8ALEXHU3f8uYgqEGp/NBAJYqksy3GscNoEP/x3fGmidf:q8AI3UPCeL3y2scNowx3fyf
TLSH
T1143528017626CB4FC6A940325E33D2CCAB707D41FE056B0772C98B3FD576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 bd201fa47a8b9f3d6587fc07c048f5fa0f35ecf4d32b1f1ab04b83af1679fb94
MD5 e8573d6038be831bfc39f7291c8ef6b3
SHA1 669f39d87d0f77289e5db1480474442c94fc0575
SHA512 cc6a9ff7bb91033c703231aa87f4453ce1aef431e7a2192ecd830e85465f7d0ba87c0d48f0cb92e0fe5fb739707e43a87e5916e75bdcb69075d3705a6c82bacf
SSDEEP 6144:TTkUEjg4AtVKys8NrIcaIRxv3vUumgNsZF3zBQytMxOQytMx4+/kyMC:TTkHg4ksetZp
TLSH
T17755D7815437A7CFC1BA2032072A5B8C6BB4DC06B7496F2773C9453AE82A751B0F97D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d8efec1767dd98b49011f654a18d5e374567982c12fa6980a77680f4be8e1111
MD5 ee1a197185e4ccb1f26ab340c0476d73
SHA1 e7973becec51baa8274e371e5c017d9677f0545d
SHA512 f50696e23df8edbeb22e1f27f8ae614ebad13bbc6bf1764db2764eb3fa496d7f45cb52707fa85fe81cc8db1d7577d2a2251ec4dc8b6d5cad0c9784d6aa0e036c
SSDEEP 12288:B07MAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D2D4237B934C518AF93609B482E9E12D680B7E669F1044C3B94778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c685d1bc5496386c62c33dea8240e82570ab1bb08e8a6aab167e45731eccc12c
MD5 452f158f240e932cc5f7c8f5e7398a79
SHA1 4f3efef4b20cdc32c16f4531ea14d3e397e2909e
SHA512 9e2969ef728c72ac98deb2270e1f9eda36a6d819a67dad594808942e1846f73ea148e19cf6eb3a73848fab965cccdc8da68adcaa0df05056f6145debac7672b3
SSDEEP 24576:9gb6bmBIi49WNNFpg1rSvFv7bYPsqjnhMgeiCl7G0nehbGZpbD:9gb4mBIBhGFYDmg27RnWGj
TLSH
T16C659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 31f49f61a066279d2c3c1bccbc09c40222843d88432ab259f965c34a9ca0d7f7
MD5 cc84bd1cd775c00fdd668b40a5aaebb1
SHA1 7b373d2630b38948f98964123d9e1e8fce910960
SHA512 ae351ec6c8828e78de09fdab5fac7c7e10dcebf218f39eb474edd6f47c430b563100f2d619e3d6a103b6ac4009d92bef3681f4493a583d961dcca5caf8b38470
SSDEEP 24576:qG88u8FpJqH1bzria7/mcsqjnhMgeiCl7G0nehbGZpbD:R7ZFPqVea7/bDmg27RnWGj
TLSH
T18035016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 db74072b1464dd3cacc33df9a10fd73be764b17876617d7c961281cac228d367
MD5 0aa324202df43da6f3aa4a72d87b2ffd
SHA1 a13c727d3b0ce741500ec0ccc7e6be9c2ee7a0c3
SHA512 a321f95034324fb7832827ab41d9d3f0f2507de3d468f10e5052022ae6fa252799a4904ed749f86d119d849899fc8788accd9b59572153a99bfd0729edf7538a
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjcDmg27RnWGj:gG05lO43bZD527BWG
TLSH
T11CD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9d4b9eeb937120b50594260a7c49b42c0e1f3fe6ed2ec15c1956e7c1ca8108eb
MD5 a9d57cd2cfe65f24f91542aa90d25489
SHA1 246776554f65a2235742f940d65c4f1f14c1d25d
SHA512 4f75a956c26cf3a36c92708a360a983596731379d82b93fcf31729c153ab882bb4001166a1794ec1950ce361a11e119d6ba9e7218a861c159883f78dbf39df54
SSDEEP 24576:qfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn+sqjnhMgeiCl7G0nehbGZpbD:ia5POZ3BJt2pasx2+mUDmg27RnWGj
TLSH
T1EC65BF5EA3FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1295429cfbbf86221b914e731b22fa6df9ef384f62e7899847a5fdf0e6ffd2d6
MD5 a59b4ce5d58d227a75366d7e34355ffa
SHA1 d260cd530e303fa637a3bf7cb9f219e91bb9f66b
SHA512 ea63f53a3a0984cc37ae31355810378759c9e3350279c61fb1f58831b2a0031f3d1b8a180c9097b58227d3e388be07b592af4186ebbc4867ded0457f5bbc3226
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FkEsqjnhMgeiCl7G0nehbGZpbD:NNc/zEOVHF7Dmg27RnWGj
TLSH
T158857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c901d8db6cdff87e8390d190760d4e0c3d0138d862679a52c1ba16a92f07f45c
MD5 758bc453c4febc74c46926316b0102e9
SHA1 f19c17a1140fe4b90c3fc8f81e844336e7797ff6
SHA512 15e277b502202dd62a960291bf1c595519fed9ba19b99bb59e96f9465bff6ea6c3136d9e5be01371152ec8cbac2559bf30b372ec67897ebc57957cabbf360ace
SSDEEP 24576:2TkNvNnaFeYhJNtmZBmKsqjnhMgeiCl7G0nehbGZpbD:2TMwBtOmeDmg27RnWGj
TLSH
T17E55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 43f92a6c3ed51bfee849aeb426a67024e2d437403c349cb0aa161a4913291d2a
MD5 ab04eb7083f285521884c89e9990df81
SHA1 b580a85347a06ac2bc94c2371fdad4ba2d330d0b
SHA512 cbfedbb811b156a2897e6560d64687c9f61b4d43b6af6bdbec36db63439e19f2d23838c064a2a4bd4847a9d9566f74b18e6c432b341b76ff15c27cab1e788c5e
SSDEEP 12288:UHvUrBFrEjwaQ3AXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:UPUr+NQwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14505F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 673eb363b3e5f29aa55d96a3941e13bbc91f8113c6812b4a0c0d0ca1f872a7a3
MD5 d791f71b50cadc099c06a4c5e15688b5
SHA1 9c05a2c3667d7dfd45b121139c7ae4b09da067b5
SHA512 97bbe665888ff50b11716df8442d57f1fff17a8c7fc273b122e888dce7b74393e18b4eb185a04ae1cb9fcb9447e3e436784cd70b07cfdbf78c9f8894c8571fdf
SSDEEP 24576:UD3FHshBIYQgA1sqjnhMgeiCl7G0nehbGZpbD:UDVHeBIAApDmg27RnWGj
TLSH
T1A125E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-94-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/752-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/752-101-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/752-359-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/752-361-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/828-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/828-56-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/828-62-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/828-301-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1324-78-0x0000000140000000-0x00000001400EA000-memory.dmp

Download

memory/1324-7-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/1324-307-0x0000000140000000-0x00000001400EA000-memory.dmp

Download

memory/1324-303-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/1324-0-0x0000000140000000-0x00000001400EA000-memory.dmp

Download

memory/1324-8-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/1324-1-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/1424-48-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/1424-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1424-51-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/1424-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1424-40-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/2248-79-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2248-304-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2336-302-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2336-66-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2336-74-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2336-68-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2668-15-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2668-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2668-21-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2668-23-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2668-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2840-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2840-82-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2840-89-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2840-376-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2840-358-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2840-374-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4040-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4040-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4040-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4040-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4040-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5712-363-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5712-138-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5712-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5712-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6068-115-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6068-362-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6068-107-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6068-109-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6132-121-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/6132-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6132-127-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/6132-129-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/6132-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download