f4b4a81126e184804ef9c5e9857e47848d205e2b934633e8ab62911c53ad69b9

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.6MB
Sample261104-try5hsbv4v
SHA256 f4b4a81126e184804ef9c5e9857e47848d205e2b934633e8ab62911c53ad69b9
MD5 7a555b5ce70f99ab822c36e5ff76cd5c
SHA1 9c486634446f5e1994dbecfae5a989028dd46ae4
SHA512 f610d0886da093f6673f4f6c5628f1e38735bd4620f27929115e2749d9534bf0b3764050ccb3ee8c8ba4999d25f4f01c79810d7eef8a0147580dd5d56d920e3c
SSDEEP 24576:3EIU58bWMKEz5CYtL0jrsS85iA7qPsWpj0K4VsuFAAk8vH8VQ/Omtd7mPuI7cpcg:3xQPXECR4p7012GuSzfmWPuIw
TLSH
T138851259E7A804FCE4AB9138C5554A42FB76BC5A077097DF23A047662F332E05D3EB90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
408	elevation_service.exe
2572	elevation_service.exe
1180	maintenanceservice.exe
1472	OSE.EXE
2016	PerceptionSimulationService.exe
1756	perfhost.exe
3324	ReFsDedupSvc.exe
2280	SensorDataService.exe
3692	ssh-agent.exe
1524	AgentService.exe
5916	SearchIndexer.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5652	takeown.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4033927b3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4656-0-0x0000000140000000-0x00000001401AA000-memory.dmp	upx
behavioral2/memory/4656-82-0x0000000140000000-0x00000001401AA000-memory.dmp	upx
behavioral2/files/0x0001000000009952-200.dat	upx
behavioral2/files/0x0001000000009cd6-202.dat	upx
behavioral2/files/0x000100000001b93c-201.dat	upx
behavioral2/memory/4656-197-0x0000000140000000-0x00000001401AA000-memory.dmp	upx
behavioral2/files/0x00010000000093de-189.dat	upx
behavioral2/files/0x000100000000934f-188.dat	upx
behavioral2/files/0x000100000001b93c-395.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001555311f786cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000939eff21786cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007963c261786cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c72b020786cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030e60d21786cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
408	elevation_service.exe
408	elevation_service.exe
408	elevation_service.exe
408	elevation_service.exe
408	elevation_service.exe
408	elevation_service.exe
408	elevation_service.exe
2572	elevation_service.exe
2572	elevation_service.exe
2572	elevation_service.exe
2572	elevation_service.exe
2572	elevation_service.exe
2572	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4656	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	3324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3324	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1524	AgentService.exe
Token: SeLoadDriverPrivilege	4656	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: 33	5916	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5916	SearchIndexer.exe
Token: SeDebugPrivilege	408	elevation_service.exe
Token: SeDebugPrivilege	2572	elevation_service.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 5652	4656	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	100
PID 4656 wrote to memory of 1160	4656	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	103
PID 4656 wrote to memory of 5820	4656	2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	106
PID 5916 wrote to memory of 5036	5916	SearchIndexer.exe	109
PID 5916 wrote to memory of 4860	5916	SearchIndexer.exe	110
PID 5916 wrote to memory of 5964	5916	SearchIndexer.exe	111
PID 5916 wrote to memory of 2568	5916	SearchIndexer.exe	112
PID 5916 wrote to memory of 5596	5916	SearchIndexer.exe	114
PID 5916 wrote to memory of 6136	5916	SearchIndexer.exe	115
PID 5916 wrote to memory of 260	5916	SearchIndexer.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SYSTEM32\takeown.exe
  takeown /F C:\Windows\System32\DriverStore\FileRepository\ /A
  2⤵
  - Modifies file permissions
  PID:5652
- C:\Windows\SYSTEM32\cacls.exe
  cacls C:\Windows\System32\DriverStore\FileRepository*.* /E /G Everyone:F
  2⤵
  PID:1160
- C:\Windows\SYSTEM32\pnputil.exe
  pnputil -i -a "*.inf"
  2⤵
  PID:5820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1180

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4500

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2016

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1756

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2280

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3692

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5036
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5964
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2568
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5e5bd8805c9e359f86fbf481b37a6a6c90a91ed72d21da47cd382c424795d471
MD5 8e953fd1644f91b6eb6792ba1433a326
SHA1 f16374a6124586797c94dc45297193bd72d30efe
SHA512 cdf198bde9d1e2231c35718a7b04a5727c710f69d9a07130b75e01bf0de0968a9259ac637d1150eb8909e840933bb19d5ace3ef0637d672c032eb6b07b21a5d8
SSDEEP 49152:hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnJWPuIw:n3q6HjBTPuIw
TLSH
T158D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.3MB
SHA256 661cde5e642772987335313b26ec5e678e80788ab96d9859fe2a6d769ce2cad5
MD5 aad8dfd118943f2d688b592cf94a7ac3
SHA1 1b2273eee04e3ac5021dceff2bcd76431d6aa7cf
SHA512 e3dff524672dd0719a919c2496e8a8eb6b49c0b144310b60153b74d017735c143be023e5bfb1edb3f5c8eaf968083f7a369c4ecf53f311bcdd2396b28a6ec0ed
SSDEEP 24576:tXYfDtczAwtd7mPuI7cpctubZbA0jrsS85iA7qPsWpj0K4VsuFAAk8vH8VQ/Oi:4tcTWPuIwt4p7012GuSzfi
TLSH
T1CFB5122867E448F8EC678139C9A18602FE7378984764D7EB03E4D6691F332945E3EBD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.3MB
SHA256 b3708b2acb459c85af46a85be0ef4e2cf26d549d2fac029a433658d006ce5ff7
MD5 d358a5a1fa94260bc0fc4c376b1de576
SHA1 4c5a9e66da5bc95796baf4383a551002e7b54e25
SHA512 035a6b9190fae7a23dd724cd94bc61efdabae38ed33484aabf8ca27b2d619a556d3860cb0c46e6cda55a33d9b4a166aa2ad5cf50893f7be1844f71478b4958f7
SSDEEP 24576:TXYfDtczAwtd7mPuI7cpctubZbA0jrsS85iA7qPsWpj0K4VsuFAAk8vH8VQ/Oi:2tcTWPuIwt4p7012GuSzfi
TLSH
T133B5122867E448F8EC678139C9A18602FE7378984764D7EB03E4D6691F332945E3EBD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.8MB
SHA256 ea23befad7913ba6cb199149773730cae1ea65a9805640597fc46d8f44aef8a7
MD5 1af3444f9ed58fb125497ed6df7fe479
SHA1 2c50b5fbaab2de2d32558512e6711a3409fbab65
SHA512 141a111b6a7c2746853fa258cc5df97abb5d02b3e981feb24b66782efe405f5899a771f3ad0950cf1035748c2230d19f1141359b985e2822ad30a1e9e2e0ca2e
SSDEEP 24576:rXYfDtczAwtd7mPuI7cpctubZbA0jrsS85iA7qPsWpj0K4VsuFAAk8vH8VQ/OFtX:utcTWPuIwt4p7012GuSzfFWPuIw
TLSH
T104D52328A7E948F8EC67C178C5A1C642FE3378984764D3E70395D6691F332985A3EBD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 6be255ac00333ab90a2a292b4d0dd2857036617490d5c42ac7a58db693ba879c
MD5 3a5cd7fba1f0527bbb00ae956368fc36
SHA1 2a139c7d8e3ecdb4d116736bd7af344d32f2c746
SHA512 6e38a43705f4b9f28fa21963e110f0222ffa97c925c1f9fd0d890580452a2d4fdf16fe2e9c5bd83cca8b2e7f0eb4bf90e3d7c0545df74cbf4fd2bb2a124152d0
SSDEEP 12288:P1XLsswWkxy2lRq2czAwkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDn:tXYfDtczAwtd7mPuI7cpctubZb
TLSH
T14C750128A7E408F9ED67827CC8B2C541EA3378554764E78B03E496661F333D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 bd364e733788ea5c441c5e9061e46c52313ba3affd6d2243994592bddc116ea2
MD5 e1d9eacc0f0e88a6898e59ddc70e8c07
SHA1 428c4bf1a5dee8ef518b32bc7b44f992f9af807b
SHA512 0ac42605caae743092fc89c7201b1dac0566d458bd4131e9fd182925e214fdb3d44f9c92553d4750e8d8c696e6482d4f63497e763fe8214942f3e64108a01ea9
SSDEEP 12288:rXZNYVLeyUji0h90ZD0wxpGZIVuprHsTkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoW3:t0Le5ji0hmx2rMRtd7mPuI7cpctubZV
TLSH
T1C7959E15F6788735D073C0B9C5D2A68AEE7230865B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 254019da6a303cf9022597bcb14b004a93058dab86ba0dd43d41e481923266ba
MD5 829c706b16e05d0931d8c154f131fdbf
SHA1 a83ae380d37b64fa64cb4331482810fb698e9ef2
SHA512 3652b18440a3f94f213a407b348daf5ba8b0ef7272d3451908f3be0702df8bbb3378fc85f5de5b8512d146d3688c9f0044c4af598dd5c99fc0ae2f2a4d1c8ba5
SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWE6q8wyujtd7mPuI7cpctubZO:L/ezSC6vUzPvxHjySWPuIw
TLSH
T16C755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fdc2cfd42ef0b9055e3fc951e5081b736a65e8989d699ce5859411b4c0198e26
MD5 ae6bc324c918dd78ef06d4a3cece5eec
SHA1 01eb0ce80e07963dd8def13fc81cdd83963b5ed1
SHA512 7963ca6742dbcbe8db26010c835a3c64d32ecc747e4202246dc17259920bd76b0f836eccce3edeccf8d7cdc7259c07322bd2db163482b66f00c489ba05e3f77e
SSDEEP 12288:QVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98Ukt2VtKqbUb4mNdonIwsI9Ec7tl:QVbqPb88hv/l+6std7mPuI7cpctubZf
TLSH
T1C4559E65F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 ad7f0640d064f635c6732349b29ff426fc67c128e77646cc7b441d00d940ddba
MD5 8d4d40218c113f3e01a29e31457cf9d0
SHA1 876eba6dff440a8fbc06af5a29a35de1f7689568
SHA512 81f5d5de72061ab4e57e152d4e75d1a5da796587c8c93999e3922a121570da6731632eb2504140cf3280fc4e0a303890e10ccc8e627f3281c3a6fba4781e7ed5
SSDEEP 12288:5Qnkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDu:5Qdtd7mPuI7cpctubZa
TLSH
T1E45523188B2D8CE4FBB7C1B0F4F1CDD27A174E5858AC5752C747F38A1A7813AE622191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 d4e91aaf82fa4a8b512e04351a2ffb58fdde4c4192c95d5f401ba578347f98f8
MD5 684523f82ca73a3d30a70c3a8338a968
SHA1 af5bcffcf0d563b41d5304e70d9d909f50dc0d83
SHA512 4259fdaac5e599ec0db1e1bf9af56fe699adb8af5c363f318d41251899a3c9c53fa7df44aed78071b47b5fb75a46d3d0bc40f312866cdbd58b1a8234a7685180
SSDEEP 12288:7eBNUbTVO86U8kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDt:7JIUUtd7mPuI7cpctubZp
TLSH
T13C75CF3BEE28ECD2C27A8DB85691C640E77278304F61A3CBD165C30E9E235E55E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b0bd774664fac6efa63775ba17665fc89146971527c11159969261d23d9d050b
MD5 f419e209608485f06bc18ca64df50490
SHA1 c051219dc718700031ed85751ed944cf884fc0b1
SHA512 ed477a0f34d42909022d4cd3dd9a7329733afc019eb2946619ab5811fcc641cd6195c83651522572cff144da0c97768254985c6e0f0fe7cc87990e4c1150d4a1
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THg:JQvGAdlCEL8c/yRNw5CCPuIw
TLSH
T101266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e8727b7c2cf36e39eed9a312ef2f50052f904bd4b832cb3f6e8c4bba0ea428f8
MD5 264461c364bd5416bd2dc31cd2334b56
SHA1 4801b5cf8cb5e152dcd970a9e3046b7c4ade35cb
SHA512 32fde5fc5ecce8f6d7a0b5344f29b025bc597fc5a15031e4b9e515d484533bf94159e7c790cdb34bdb6d33881a8e4ed286d7adea140fb8fa081def9afdeb0471
SSDEEP 12288:YAwSfxL/2Dc30DLLmt0LDQewsAjikt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDh:9pewsAjOtd7mPuI7cpctubZN
TLSH
T18075E030FF74D436C7BB0DB22B76C716183D69204F611AC3E3A89A9E19702D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 64560e542950914d943ec37486c927d8b1beff730123bcae6cca1aed21d7d012
MD5 57d39144af9cb98bd7a682305cb1415c
SHA1 b4ed4916cb422fbc74b095ecac02acfcdd0713ad
SHA512 943d30f2afd5ba72d4a9961373de806e984ff981543be151d92436aab6c610593cdcc8ca81dfe69827a0564b54666a180678a3c1f1135c1c18f5fd15a4a0eb61
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHxbw:tUEtQevvqc2W1cpV2EI32x
TLSH
T1A9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ba26fcabfb50ff519cdd7c0b46017d4e1cdc2483e8543e5490152885e7776ccb
MD5 34ff59e463ba7dac2c623e8b552f4e4f
SHA1 9469519e17e603fcde706270d553f426945682b8
SHA512 8dda579e553314106eab6fb1560bc62df3757630638351f33b1b5b1ceb2230385663165ee5d16abafac0a0a6c834cdccb73240e6322aaa80eea8451c79dd5f9a
SSDEEP 49152:BCbRquA/m2yL5zifFiV+XenmE3/zuWPuIw:uoqHVjnmGPuIw
TLSH
T1ABD58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2a01e106721ec06ba882213d6a35a68d9c46671ec203906beda552f68177f9fc
MD5 fa8df5e949519d8d0290fc4c4ae6d52b
SHA1 c4bf3da03f2fd190d5860ef2c9aa918bf22d56bc
SHA512 18f9be8e5ef06ea4061c970e2b6292cbf66c15efa42d222fc942b3d85972f7dee1989b6860fb894f8e45637287c4990c52099f459610c4bc8ff38f6ec453a881
SSDEEP 24576:sAhGLJIFoiwtA5l7S533td7mPuI7cpctubZH:sAMyFoiq5nWPuIw
TLSH
T175359D80EBF945D4F5F3AAB899B68571EA76BCA95E31C20F1150D21F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ba15d4d82ae20bbf032b4ce0dcea0f845eb62681296f4022afd306f5691b7187
MD5 ca9246896de0f3818a90130a57410bbe
SHA1 534fe487f30a5e47d7fe21c59cbbd4a5cfd36bd5
SHA512 fd45548df7b37adcf6c38f3246af31ea71edf0743a8de1af4852fbbc6ff64a0cef91f226c26ce46c80b151d3d0df9fd71d2c98bee744945c2575add71265af00
SSDEEP 12288:6mw5HEjsChNJBFgl0WDm+CBkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDi:TwukOWytd7mPuI7cpctubZO
TLSH
T1AA75F14977A90CF9E9A78138C597C532F7B3BC052A25D71F4760C65B2F37221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 0fcb6038fb64dd8498384023e4723fb5b1597c6c386dafd6d8e6400df23d7b31
MD5 88baeec3141bdf6f9f936b85132a3b58
SHA1 144479ec1bdabcaf706ef51c4f3e9ba6f603f060
SHA512 e674a35649a01c0314da80aad11fd9489790d31669311be78ac901937f51b2d267c30d502e0537c46cbf79731d758e716757759446717e9f452c4079d7e7fcb8
SSDEEP 12288:8WZ1IySkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD6:NZuZtd7mPuI7cpctubZ+
TLSH
T13065124823E864F9E2A3C278D8F18AC1E7337855277943CF4216935A2F336E69E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 33c090018fb28b6081bfa6481c78dc87d9e0aeef6af44fc09acea3dc730da481
MD5 0d48c0abd682c567d08b8c188bb53220
SHA1 fd61eea3da8ab51af12a5cc344a1209e3d8042a2
SHA512 f892cecd8eb9493ba83869e7f6bb8bef3a871e0f8866c766c56b6ecf8a0d837b8238b6883b9b9714f3bd49adffc3e47a390787935ce0303b0268d1c274fd20e9
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UM:iQRQyi36YOcPQLvw2gAf+PN3fPuIw
TLSH
T10B666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d06c94cff4738402349c2be58f1f42c6a8f18a0ca6f934509cc8a268bc42fde7
MD5 ada5f7a991cb468b49510ad8be602764
SHA1 3019178947eca5422c4ece2d832fb67d0239a4a7
SHA512 0554f32a94dbdb66ad81a275e3b94449d2329be6dba14e78e433f0390b30bf058ff54bfc383915d2a03febc7f8d5781a8b56913513ad5cc9e0b35fff163f1e12
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UM:uQRQyi36YOcPQLvw2gAf+PN3fPuIw
TLSH
T18C666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 444e3ee29531703a59060763b363a9a9c89f41391e3e4e0da782f765c9e3ba82
MD5 dcc7e23f439c9659d9245c19e4f83024
SHA1 5dc11d86b80d9716a476d24316d79d01547b196d
SHA512 d962eebf1a4a653bf4ca68ef9c6ad63e9525833ca72388931b456129e59f0af1c5f257a8eb067f1163315bc6d524082de55cb6c7f7e3a17f91d179254fe98d4b
SSDEEP 24576:VwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Jtd7mPuI7cpctup:R68Qg55nhheWu7PNU3/+WPuIw
TLSH
T177B54A33B2F600A9C44DE1769F4A872196D27C758FE0E3DB850572161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0dd74b323923eaaae7bc5a88567b6dc562062e03a15e116fac05a0b03582af80
MD5 7ded7cc32ab7546ab55b60b20215f636
SHA1 1335ad2583621e762934c4dca62d3c861e58374f
SHA512 50575950285d21b6dd0308be0889e8212f94ac246f9f520155eb5a1b679a8e2235e7d187faa78abdb9903d7ae08961a0449c8742b4d114de1912ee0fe2bb4384
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk992:qy5112gYy5azzVvL69nLKnhZ4PuIw
TLSH
T1CC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 96174bd782f65898539c86ef970d6bd35d2caaaebb99d6da7de8fb569ff75f5a
MD5 d18453e903aee60afaac25fc1cd6f0a4
SHA1 a1f216e0264e52a39695b9a7a020e628c9aa9c87
SHA512 6aa78c1710a409af84f5c24533a531d19bbd8a125099a046701f33f49d5c4fee5b1dc17968f63fe865f6b80ebc4a289d25d44191dda5a98e642a193a8cb634dc
SSDEEP 49152:CB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgWPuIw:wu6JmVxd2dHPuIw
TLSH
T19DD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9b03959d2ea7e9da0666d7939972c285e9ea5a9e300684c32e103c76d1725af0
MD5 a1e48945475207bffe91d44e0a18058f
SHA1 67184fb7d799f428f114b230702dc77851feb01c
SHA512 1d9de48ae7cc8eb15690f057de775bd37de9ead929722d44564ed34ba6d0eba2ba34ada532abe4d18b5787dbe485f0e667980363f8a4df1ded44774bff4f1df8
SSDEEP 24576:Chv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3gtd7mPuI7cpctuv:q1hpsNoJpF1A6UU44CwH7R4xQWPuIw
TLSH
T14FB5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ea11a41c400e049c85955c84f4b6c9ac1cf5870bce47c246eced84663754c184
MD5 fa096bdabe83bd6fcdc29901b2bddf63
SHA1 dae5f84ea86c6a69cc576349a6891bbf38f3879e
SHA512 01c9d2bb9f77d05a3949ed4a97332f52edf7a01deee49c68679478414ebf61b8f4dbb4d5d304b5b6ee160a6317d6d73e68b3dbec30454449b356d8a29870653a
SSDEEP 24576:k4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnqRtd7mPuo:USuZQIY0Be2KRRVtOnks6NMHqRWPuIw
TLSH
T1C9C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9a30cfeaff68107e98eb2d6ad83e3f4ac79a719feea78a222725a5e19a32de2d
MD5 42b3be31b96e7a42ce397bfa500a8f76
SHA1 cc3d78eb602878a7283c45a29a62bc14efc6501e
SHA512 b1d7e7506478bd002e34fa91ef5f43a7ebc5b0966f82469cfd5daf1777175a29f41401b6a4e3b57ae88bdd321bba897278a1d76657da1b8446a26adc1238893e
SSDEEP 24576:qhiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLgtd7mPuI7cpctubZ6:qhtSn8EApI0figngiDn0AP5wUWPuIw
TLSH
T18695BE13F2D900E8D05ED178C7568632EA62BC150B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 0cb2af1161cedc444a4cab7e83c145836f108dbf312133cf91d64a3d60a30eae
MD5 9c56c2f9106e8d2dfada4e31928ca5b0
SHA1 16349ba3af7d15e7367f10e89c75250910413bda
SHA512 27c71b4953fe833147f4be4676bc632a8659879a8460d2105b0ec102355b9b7fed032d5b002dfcfbb43454a249cb5824386a599ac545466b58656ff492b19a74
SSDEEP 12288:3fkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDN:31td7mPuI7cpctubZB
TLSH
T1255523089B5E8CD5EA67C2B1F0F1C9C17A1B4E5DA8AD1352C74BF2072B7523EA6325D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 28cdbedd39daba7de5f5e892cf4f6b60fa87fcc2d859990f9bc5d5a0ccd616e2
MD5 fa447e95079b7769c39c39a666584337
SHA1 7a45fafe9d8a4b2dc9b76ca57ed351f725f46765
SHA512 97040cf834ae96eeeffd308c1276ffa17e6b6a0fa302534a8012e7b018cbc40506a6fdc06919031a07afbd6d24091cfc355cee98a807c67b2ffa57c1dc56bc90
SSDEEP 12288:G6kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDF:Gmtd7mPuI7cpctubZB
TLSH
T16B5523189B6E8CD5E667C1B0F0F1C9C1BE1B4E5DA86D1352C74BF2472B7523EAA224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 5fd969a06779eac3667641b24eae9d319ba527da932113c68ecdb44b060c189c
MD5 4d97b4f53cb268f59e1456f26a3209ae
SHA1 ad863cc1ecb2d04c85adc17dd529890d62a838a7
SHA512 38e4bbaa60f42c6ce83c4db5f403ab97cb2dade2cc9a6ca5b81e0eeebf348327d311b2c2c66cab4d8e6066b5d2fbc35eac4d07f898b6385ac089e35b1005156d
SSDEEP 12288:IYkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDF:IYtd7mPuI7cpctubZB
TLSH
T1795523189B6E8CD5E667C1B1F0F1C9C1BE1B4E5DA8AD1352C74BF2062B7523DAA324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 83cddfea3bfb4165837b119eb86924c723e5eeec5f7460c1c7509bf2342017d3
MD5 81f0ae7620c1f2e4fe0824901c6e5fd3
SHA1 6502108d72119dd4a553698cd795cc4dce153e15
SHA512 202128b25a14207548b9f4ab4f2d3fe8706905618a12c86d37812d2fc5250b85231bef7d9137d6a7d3255007f9424f32670e99dc3e54bdd1297f00a1f4671028
SSDEEP 12288:HVFkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDi:Ftd7mPuI7cpctubZ+
TLSH
T17A5523045B6E88D4E973C2B4E4F2C5C1FB377D98A939539BC702B24A1F71379A931A90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 2d5ed7f7ff0701b372ecbd63ff83218c45a2c1893cdbd92a43cf5e333f55c956
MD5 da7988e547b0730781f1e8f87ffdcdd1
SHA1 1b65de7adfbcd34cb7226183805b88f8403694e5
SHA512 4b222d9dae84c21a5939a4957cf5df394dc7f9fdf6b1d6478ee4937ae3092671e83341aec06a2e0741b562126e8f20629f8f8701fa08132eb88b6602c66bc75f
SSDEEP 12288:x9kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDP:xHtd7mPuI7cpctubZj
TLSH
T1055523189B6E8CD5E667C1B0F0F1C9C1BE1B4E5DA8AD1352C74BF2162B7523DAA324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 181f9735c53e948ddde5c697af75c77043e51ef781ee7269efa76fe8580e1daf
MD5 e9ecafdc64d2d16d4ab83844fae29ca6
SHA1 d82a0ab65067f9e0ae7fe8e25cc9b22f9595efe2
SHA512 547dfeb49ed9700cabb037c589e2b394fb57d5bef194c8cba584075a37c20a04a5ddd435ec6de85e1d4652cff6ddcfded79a2c032f2b14aeb85af79da267003f
SSDEEP 12288:Wmkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDc:Wqtd7mPuI7cpctubZw
TLSH
T1145523189B6E8CD5E667C1B0F0F1C9C17A1B4E5DA86D1352C74BF2472B7523EAA324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 826efea18d747233c1f102cddc55969b13b1f5a02f30adba5b1da9e437dbedee
MD5 2883733567f3179c7e05776f9b436889
SHA1 444421597b8542886614580428efb755f632f340
SHA512 348676a8e176029e6021d6e2a49ab0b7c9c97506794f9d931eec05481432d9e564b74a7670084d8cfa2a60a268a327778feebcbcc7c59bbec5b51839cbefec20
SSDEEP 12288:SSkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD0:Setd7mPuI7cpctubZI
TLSH
T1B15523189B5E8CD5EA67C1B0F0F1C9C17E1B4E5DA8AD1352C74BF2472BB513EAA224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 40dcb93db60804bbc12a2b939a6c226db6c70679ebb19a595e672cc0b94b9a68
MD5 6c3c06a6bd909dfd60848de0e8c2a75d
SHA1 a7af9bafdd45fca4a086d70db57552e6411e92be
SHA512 0c78b1a8d9edb55b9f8766a2663272ff1e4eaa90db6b37edcddda2f72169d397c9879d0f5974ae5ba0d8ed06eeb42f5e5808f9495dc6301df7a9bc50f4dbda34
SSDEEP 12288:PiZwbGzzFEoS2cPvyakt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD0:qZMGzFVSOGtd7mPuI7cpctubZY
TLSH
T1EB750194B3940CF8EC67823EC9658942E6B27C590A70C71F03A5366B1F733A15D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 31fb5ab822cbe666b374e2b2807a9312ddafb12ee8637cbe1366153a022703ef
MD5 946fa12054e6874fa9535bd93d852c0a
SHA1 461595714d7b9cb2a241e0a5bc3ad8169cd94a02
SHA512 a605e8dda80494b046111f75b3da3120df31f9b4658893ff8d99d17457cbe8e0524a992da72b24d239637b1261fa96afaccb23ab052b86584645420522b6d49d
SSDEEP 12288:PDkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDS:Phtd7mPuI7cpctubZu
TLSH
T1C45523189B6E8CD5EA67C1B0F0F1C9C17E1B4E5DA8AD1352C74BF24A2B7513E9A324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 6304132e500fad2b0f7ffa1cbe59c5d6e15979b0eac8424d7692e93d0142a67f
MD5 5f09e96a5bdbac0f634438b15a335588
SHA1 a698db57fcad90c375311981299d700c148f30fa
SHA512 fa7d33e941ee884dec510b760371f56cd0a9543a62af6649099e01397c11ec5a5358173a3d4336c9094d485de6d536e997e85c8b0042b233bfb055cf9100dc5e
SSDEEP 12288:9Hkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDD:99td7mPuI7cpctubZP
TLSH
T11F5523189B5E8CD5EA67C1B0F0F1C9C17E1B4E5DA8AD1352C74BF2472B7523EAA224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 247e2daecf1e0cbf7d055dddbeb1d29e8591c20e35dddc96206e3fbdbf8fd565
MD5 2c74e0c68c5ba0c17c4d62d6fd9786c1
SHA1 b8d12ef0c4cdb188fd6d96f752ac9b2ced9eb733
SHA512 04a798077f4e3969f7353a32517595ffdbf61d9631158f4c6f7f072dff28ac27caa3658f4ca4ec9b6a59d03635b9c9ab60b89b76a2bfe41a3ac529516f6d41c3
SSDEEP 12288:yyPz5L8Okt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD3:vzyytd7mPuI7cpctubZL
TLSH
T1CC65020777A520F8D177C274C8A24A82F776B8354B248BAF475453772F372A19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 e9fda71ee01bdf5bddb15790ebc7b078ce0a92df84410ea69d1fa73fc7babe2b
MD5 1f1e4d05791b912955b05ec95eb90d86
SHA1 0fba1d547087cc1b0bd3b2d268480c17b7042c5f
SHA512 3adda4f86b9070c3be51f0b10646c49eecf165a81ad32f671b26b6026786cb1d67cf28886a38232606ee4a76b50897eb2dc443152278611cd30c78d3f3cf974e
SSDEEP 12288:5Dkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD3:5htd7mPuI7cpctubZr
TLSH
T1CC5523189B6E8CD5EA67C1B0F0F1C9C1BE1B4E5DA8AD1352C74BF24A2B7513E96324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 e745cdf5a8c29508949e8c46e3f0e615465a93b64c735153bc18736447e1bfb8
MD5 4e6661c326d2b319b8c1b4cf2a5c1d97
SHA1 77d10d68a213f5923723e6d7bd24d768429d6a34
SHA512 249ae5b54f051452b424b9d7b0ce8271417271402265e05ee5af6444ce4e1b3e98fae3bee615ec174f3be33d6c232ecb2888d3588401b5e7d2ca8d78daa771f8
SSDEEP 12288:6Dkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDd:6htd7mPuI7cpctubZJ
TLSH
T1265523189B6E8CD5EA67C1B0F0F1C9C17E1B4E5DA8AD1352C74BF24A2B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 55eaa615aaaa61a249aeae599e84d624d043135680bdefa881b54dee6ee5c305
MD5 5d6081ca39d6725de2129df3f8f522a3
SHA1 abf26e0d4592c3fd949e10c64471a96b94c47637
SHA512 0e7da5ed596b497ed19a1b5d411ca496cf1e6396aca9cfc3e11872bc3e70d439c4756ad8b12f490d48279f0bc56296ba7a00ed4aea5228297d73934b3680210f
SSDEEP 12288:JyPz5L8Okt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDR:ozyytd7mPuI7cpctubZt
TLSH
T11865020777A520F8D177C274C8A24A82F772B8354B248BAF475453772F372A59E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 d2c88dee6522b5ae4d7646ce1a46ed134825c4aeb18c7f56864441b84184b33d
MD5 8453d6f3f29a4825e1f271d2fd52e61c
SHA1 368f56364431de9212f1addb45da82ed364712e0
SHA512 958c7840691275703bcef1c89254e05bb4fd3369f990db117d4dcf640440671779a4202cb60cd8249cc28d64f0d047af4483b2051b062f17917130266f1d052b
SSDEEP 12288:BCd9SWYoaLHF3z0z04PDvhokt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDT:8TTaLl3z0zDItd7mPuI7cpctubZX
TLSH
T196750194B3504CF8EC67827EC8658942E6B27C5A0B74C71F03A9366B1F333A15D3AB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 41128da83040a86023eddba21607034e49ed94525da2f96094b9c313c54bc8ad
MD5 eba9690a690ba3305e76323cf4cac137
SHA1 08b3d1b99b3361cd99809d7e66a7ec1ec60ec302
SHA512 f926b060567fd0e7618ebf114bc4ab1d6cbdaa8f768b7c5bb536583a8d2cd4e6ca539e30f8b4c21a3d782247d12f41c554e011742cb4fd15536862a276d94167
SSDEEP 12288:ui4e7zRdTfgwCHKy7GLbbdIvZkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDi:u34d9CHKy7GZ8td7mPuI7cpctubZe
TLSH
T1D385CF90F3E814E8F1B7CA35C9768511DA767C591B31DA8F03A8661A1F336E18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 36266db40c4ca03c791cb882105e7d927b19c690428d1303e14ef7bd5a71519a
MD5 5bb2834d5bb2282ece11541406b28dab
SHA1 efbd75f29f49c3fd0cd6c6afe9477c0ae6b0a681
SHA512 e5c809145256980ac8f126f60ade843f216be4d670d0854d33e5e18e1a4c8b8b2f87a8275b022f26c22373e215784f695a58465c8adc83850bd9f8958000b5cd
SSDEEP 12288:Q4kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDc:Q4td7mPuI7cpctubZI
TLSH
T1675523189B6E8CD5EA67C1B0F0F1C9C1BE1B4E5DA8AD1352C74BF2062B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 5cd79622770740ff9503bb136f0f1b4a62706b46782b0021a4ca6a3621835302
MD5 102892915ce43d70b3095b0206a19e2e
SHA1 440e52bcc6ce1348a41d2fb0cf097c92d8e3ead4
SHA512 c193bcf068b3db811fdeea0cf59e3bfbfab7976386eea57a801383e5aa3a5e5c2ce673660b49c726c92853b8d2f0c8bf0fa023795421e4803dfe647c85736aee
SSDEEP 12288:8ukt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDm:8Std7mPuI7cpctubZa
TLSH
T1BD5523189B6E8CE5EA67C1F1F0F1C9C17E1B4E5DA86D1352C74BF2072B7513A9A224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 53ef77c87a77b98dc45ba53e9495fd93ccb7bf2de1e96752db356a685544d58a
MD5 f55e897855d6a98203cf8fc88b2afbd7
SHA1 0ebbd6c0c1510db1a2a92f14a8abde238a43edd3
SHA512 45d3e29fb899baabee063371ffdb6f429b715bc9bb7862e35a29705185878fc915525d73daec7a0f9e619df6d9f7d222800f78f36fd9d440b4e151f2c63b2fd3
SSDEEP 12288:WZkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDS:W7td7mPuI7cpctubZe
TLSH
T1835523189B6E8CD5EA67C1B0F1F1C9C17E1B4E5DA8AD1352C74BF20A2B7513DA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 e24a1e1e5c2240c6191831551eaecdcfdf8644fd6d7900006c8ff1ed05496ce4
MD5 b09acfdba80a19880a55432d05015f27
SHA1 ad7651d4ad7a47c583704f3f622f58b7b1041917
SHA512 0220f94277021171968c20b8d941201f5f84900ceb7d71fe3256f47a95c2ba3f7e6b0656723050f78dde29ba28841a1d441c3b722b5ff49541936d20c2027ab3
SSDEEP 24576:yfwv0k9RX6wkyAI9td7mPuI7cpctubZB:qMnYI9WPuIw
TLSH
T1E585DF29EBDC48E5E1B7923C99B34646F6B178591B31C2CF025A536E0E33EE45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7af4d7a99b2f66d389334fbd83c61d53bc722f18571c9342362c135d16ff1547
MD5 e9cb94df61ca0aeeda2019ab8ac1aa01
SHA1 1771c0c4c6626b5628480a18c54505a5a586fb3d
SHA512 ac06719fa53b6a58618fe257cc446d34e4e8e45173d8c65544b0466d357fdb0ad6ebf4d335a063d0d6238ec61e03b0c7151306654043ba6f6d9f2df3002e5680
SSDEEP 49152:qYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0QWPuIw:EySzP/PuIw
TLSH
T1DE066C96A16841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556931F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8925af4277273eeb468fdf12c2b13c2b267a1b6321e2f9f62194bb0422ee9da8
MD5 3583a81bea0e10abfb9ee16047757699
SHA1 644f33b621d2d456077ddba7b3fccd88ead053d1
SHA512 ad64e466db5798f2c8b44826252ae219d76215d4a2312fd02054d3e0e412b4f65e598b5f44d9039a6db11561d5747c8fb9e9a8c990be86f745209998730aefba
SSDEEP 24576:y47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYatd7mPuI7cpctubZ8:y47JUQj1irIhCnDHUPfF/gWPuIw
TLSH
T167659D1DA3EC01E5E1BA827885558A5AEA71782D1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9b63704f46ffa366c11bc6c7e56745e32526dc4c724b49e9edf4a0278638d13f
MD5 770c9e416458c568e1cf7f07ea159be4
SHA1 5ecabe86803e6c7f6b3855afe8be978fbae81165
SHA512 db171d659f774b3bb15ed4a67c5c5562639cdb02fa9718c095ff9eec433e0d83dd4db4b49938c23eae3ba9f74dac673733edd46ed99ebb35189ac29ee0c5d22b
SSDEEP 12288:x8sf7kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDR:pZtd7mPuI7cpctubZl
TLSH
T1AF65F109D39841E8D06F9275D7A28A81B7337C2597E193CB43C1F13E1F762A49EE6A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 5819e8ef5f09c6a7356bd49547cf06d3440a68283b2b4412da9365a86a0978ad
MD5 b8ecd15173e1b1a3871bca1f4c72b43b
SHA1 876f8152a7bab205e0721f15d446499ddcfea413
SHA512 55cb760c40625dc9520d4b21a917ab2c5a978a751603a5954e2dd841fde66ec028df624b50d1263ffd4385f1d35e899136d8bf85d1053ec980f7f8af91a8623a
SSDEEP 6144:/sBC2naF5CBkOowfKDeoHwjQI4Bqe/f9mzIfQBDCnBMUXC7xfgKK5OuY0y+XC6X9:gcZFXBqwf9mKFf0s5OuY0yyC6xPvP
TLSH
T11E4528107626DB4FC66D40325E33C2CCAB707D41EE05AB0772C98B3FD576659BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 104bddacc1e948ad48127e8e0bc0cc49f9cbb2b9ada898cb1bb99816c9e18a3c
MD5 ccf0d4e264e309f22643e9d4628f2753
SHA1 5d53a2079938076577377efdd9030766e96c21fc
SHA512 dea2cb6de6281c51826a6c1238d1a4308045e409dffbe7092f6ddc5430d80a486dd2d8512ffd530f3e0ad77d20608c9e8fa9fb6f02529b44d52eda6342c71af7
SSDEEP 12288:ZZA8DasFMXu1qNlpltSKz6xNcOgpYbHAsz:ZZAKasFwuwpXSKIcfuzF
TLSH
T12A7518416536E78FD1B66032033A5B8DAB74EC03B7096F1673CD487AD86AB05B0B97D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 5c31de94dea5f6368e11589b4bed4a6256c18f214d13bae698dad953895b0076
MD5 53f9b0032600b0218800552a3ebd2053
SHA1 701ae337da127bc7b90908dfa6f36d997f870736
SHA512 512057b2c0c8db8b147f5cc268f3d000c7d9cc07de503bf41b2ccb103c71a92202da96d3ab6437cb027a41d2acf89dba4083122c084c8ede6c2c60836fcf7911
SSDEEP 3:OlH/lLA48MGIGIi4pK3mCllltq3mCllltGlslslslslslsl6ul/l/:KexIiQsmCtSmCtEEEEEEE3l/l
TLSH
T1898102996B0D5A21C25A3436537693985334D54978A18BEF511C35565C227A44C26F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 aab8590ce79cb97ad3d3592a5400b90ffe8211438289b610afab172952113828
MD5 89c3d25b85629725c83fbf28a4de412e
SHA1 7ace570665797e381ae58f04ce411620aca221c5
SHA512 d43dd8a0f204d41b2390371cd13d48d07c2a273de9ce5d184ad508ff7b103cf5c40c951a483c5b06c34f320652e507a324fc011e8aa38d54e9b1222eb3da606a
SSDEEP 12288:1k7zkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDz:qxtd7mPuI7cpctubZH
TLSH
T1B75523148B5D8CD5F9B7C2B0F0F6C5E17A1B4A685F6842D3C607B38A2A711E9DE32681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 1.3MB
SHA256 f9662415bc2b2f2f843a3a5bc48b9b1bfc45e109e117f19a14a518a8cdece02c
MD5 ac160febc197a016ccab0f8c0ddda349
SHA1 f8af871ab790c3f1b3aaabb9cf9592df370fa56c
SHA512 510326247e1a541651ea72376780a6e1417a34761ce8fc2ea97a4697f0a344c0d973386fccbfb75df68ec90a0d9a734725c55815033cd5b222dd3f97cc28ce6d
SSDEEP 24576:y8kNvNnaFeYhJNtmZBmktd7mPuI7cpctubZD:y8MwBtOmkWPuIw
TLSH
T1B055AF2EABB845E4D1FAC6B4DD238512EA727461173293CB4390C13F0E679D89E36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 e8e63ddecc8f139c2279cfda27d79bfe923983c7f3719c9807b042d22bac001e
MD5 8a49218e539fad7bb4675c9960ffa566
SHA1 2dc3acb65febc0aaa8b793270b45d973296f2ec7
SHA512 087c930f6126a870c1e39e4c297af37509d83152d4bb82c6b614cbffbb237b1b4d6772e1ea6a967f5225a360a5e07d4e0a7ac43140770e63ee83e428c4d9aa9b
SSDEEP 24576:0GJ0jrsS85iA7qPsWpj0K4VsuFAAk8vH8VQ/Oi:0G+4p7012GuSzfi
TLSH
T1DA0522AE46F9A4CCDC2E913902241713BDF575A81729C6FF52E2C6B84B705D062BEED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4a511beb090ff25b2526417dbf026d23bdde933a3d613afd8b32b956779df7ca
MD5 88998d51c36e067da00c3338b64efaf4
SHA1 052e93635ee2744abe70b0999dea1a3c5c1c89ed
SHA512 fd63e2c4b48116d93c2f0ff50b672521e80592f092504da2d0828339dada88321f48eb2b6f391d375d4d28d5327b4abf4e1bd40fe197c85e9a37444c934a6cc1
SSDEEP 24576:/G88u8FpJqH13zria7/mKtd7mPuI7cpctubZM:O7ZFPqVKa7/bWPuIw
TLSH
T12F95F16567E501F0D477D138C98286A3F6B2B8250364EBDF07A88B561F336E54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5e6a077cdaedf8892a3ee83e53c87ee969071f9539ed2baf725bca9294898926
MD5 2e04e75fa7ee829d86319925a05a7c8c
SHA1 1b9b1f6ebb1354610b1f5aa281f2088941df81e2
SHA512 a75a3aba9007c64c12bf5fc3cc157f3571f659c31f50049e81757dc7a2a8901ab96f523669f3291b03eee34661263118810a57d3ce0619948f9a649003f1320c
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWWPuIw:RG05lO43bQPuIw
TLSH
T12FD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815033556CB02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a579aebeaf37bb66d76b5fa81c31c061d65ff8716581321831d0c6107cd40010
MD5 715fa84f5ea2130d56cacd558ec34e4b
SHA1 b1c3e999ec00b07890263f34db7bf591ccca3f0a
SHA512 ab392f1c33762ae087a896037e0954a70dbfe7527685377902ae393c3191ff99384b4475929d6823655ebbcafd6935643c7a82e608ad304624c610ee29fe0366
SSDEEP 24576:ffa5POZ3dpFWVM50JicR2hG0lasx2+47eidnQtd7mPuI7cpctubZl:na5POZ3+Jt2pasx2+m+WPuIw
TLSH
T15C65AE5DA7FC00D5D5B9D17DC583861AE5B2342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3df4bf1651aa6c4c67137db14f6f80b2b768f2fe206464f70e2502d7626dd729
MD5 49e6fa459e8e97ba72e56c0b2c2b30ba
SHA1 9025d78846926fa9b7f2fd6430a1a3b4fb3bdd11
SHA512 a22f13630242a582a7ba59dedd25b6990ce2273670100b18bc50249e27cfc18a0024da267e4a590214b062b034bd4d41a67b52fcca36197f5a0a83ba724aecd3
SSDEEP 24576:MNcwHdjbyQ4nLC18lb/EOjowL7FkStd7mPuI7cpctubZB:MNc/zEOVHF7WPuIw
TLSH
T196857B1623E901E4F5BBE1BE89779946FA717869133486CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 9b0dcf0af4dc3ce371ab2bb034bb88d62512fa8cc3b09fcfe534eedf76e85c3f
MD5 9229e2ef9b5f9515a21c5bb388ca31ed
SHA1 76c0029b61013e7b730dc80587926d581b2733ac
SHA512 291d30191ab378963a6eb2f69f92d191ade3d0eada9e58f8eb626d37e142f4a6662aa237ffd0e09fa1ca61f5ee55048433c9deecc4a6809a16df5ced1bafeee7
SSDEEP 24576:G6DIb0jrsS85iA7qPsWpj0K4VsuFAAk8vH8VQ/Oi:G6DIM4p7012GuSzfi
TLSH
T12325025D63BA10F9D46BD03D82520602E6B2B1B4872286EF1794C5BD4EB3EC8B57DEC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 0c8cad6262fa3462973af8ffbf2254ba70ec8ccd8c30ac851d38b9c663c9d7f8
MD5 9d36df11d8ed796cb23b31dbd0a270b9
SHA1 e8b634d48f61d37dd62638636b0cce155e4c1c61
SHA512 ea67207c70b5c8544519af3c097e78c2a03fd5c05b93c5e7b66a856fde311d16817265ea5d68b04b1ce074aaf4ff8868651308e25b8ff34da7debbf29f177f96
SSDEEP 24576:gtyST0jrsS85iA7qPsWpj0K4VsuFAAk8vH8VQ/Oi:gtxU4p7012GuSzfi
TLSH
T16715124943E8A4C8ED6E113847264351AEB9BC685B22C3FF62A1C77D1F316C0A5BDBD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 1.4MB
SHA256 190a39f44e0a29bc08edd3b23d264bcb86bbe5979b5cd3955cc1f8a4711a9288
MD5 0b3c0505d424413a743fbfa0dc74df87
SHA1 3b234da3ad7820535b2518b014ac41e23b323eb4
SHA512 7f854f9430b3d0cb4bda108336534a6124dfeac80f20d71ac0e4e808a36e29baf849fdaafc3c5351911d0f50e2b73a492a5a49a616489b9cd3e98f492e0c9a76
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYjtd7mPuI7cpctubZn:Sgb4mBIBhGFaWPuIw
TLSH
T18D65AE1E22EC02F5E0FAD2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 e83189ec92300c52a115f920f7b93e3724f6efa9ece9875a5e5742cb7c98bcb2
MD5 95c2e71ba4d9dec67520dde198d1ab90
SHA1 b63634c53ce1b96754635ae4990e11e8dee9df25
SHA512 e4f80cd2e6f33ae7f9b77633bcab235ff2698c28b7fc557065bed49d7ef711f4323e66954533bb6d5c83ec99bcc8911af574816c316ebb773e2e0c5378adecc1
SSDEEP 24576:mDkNvNnaFeYhJNtmZBmktd7mPuI7cpctubZDO0jrsS85iA7qPsWpj0K4VsuFAAk+:mDMwBtOmkWPuIwX4p7012GuSzfi
TLSH
T1FEA5D06EABB845E4D1FEC5B48E238512FA727461073293CB5390C13E0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 229b61fb4b2259147f7b7f17a61fb3c949733100c87b6436428f519e344cf664
MD5 30b1cc2b1265754a820f57aae24f63c9
SHA1 1a4785134d25bef880f8a252d680eda3cd864731
SHA512 97f79dc83b6d7351e96d86e6102c14d96815b2104477ef3e8b613f44c6eaabae7e9cc84d0ad3c6bda53b4844ffebbe8f5636d65f59f55bd745738ef7e80e4b20
SSDEEP 12288:nHvUrBFrEjwaQ6kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDt:nPUr+NQmtd7mPuI7cpctubZx
TLSH
T12575E12E67AD1CE5E676E17CC5828649F772B862171192CF02D1817E0F73AE8BD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 ce7080bb15a74ae9b90d7976c9cdaf14f358214e0c2fb9cd17e0f79c9d8d8f26
MD5 11cbe47d5e9dde3ed6e9d850d4bdd6ac
SHA1 d1c59adb27ab5817150edc97933b3494d772ac82
SHA512 0c01a396a7d7d754f650e3ee90eb9f2263b5c34fcabd45ba23117f6ace1e84746887d0821b2725233c2952c2608471eb2419260f8a4224c0dde8946f264443d9
SSDEEP 12288:pQcMxWDXN1Dp/fshBItT1IQgAvkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDU:VD3FHshBIYQgAltd7mPuI7cpctubZQ
TLSH
T12885E13DE75C04E4E57BC1BCD6A38A06E77238A9032156CB0294D1BA1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-433-0x00000263DF450000-0x00000263DF61A000-memory.dmp

Download

memory/408-32-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/408-24-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/408-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/408-117-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1180-60-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1180-56-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1180-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1180-48-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/1180-62-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/1180-55-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1472-330-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/1472-72-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/1472-64-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/1472-65-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/1524-161-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1524-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1524-148-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1524-157-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1524-154-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1756-95-0x0000000000400000-0x000000000054F000-memory.dmp

Download

memory/1756-365-0x0000000000400000-0x000000000054F000-memory.dmp

Download

memory/1756-101-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/1756-96-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/2016-346-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/2016-83-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/2016-91-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2016-85-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2280-364-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2280-118-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2280-361-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2280-125-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2280-119-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2280-363-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/2572-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2572-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2572-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2572-42-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2572-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3324-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3324-105-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3324-112-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3324-381-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3324-106-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3324-366-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3692-142-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3692-135-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/3692-136-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3692-367-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/4656-0-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/4656-7-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/4656-82-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/4656-8-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/4656-1-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/4656-10-0x00000000029A0000-0x0000000002A23000-memory.dmp

Download

memory/4656-17-0x00000000029A0000-0x0000000002A23000-memory.dmp

Download

memory/4656-190-0x00000000029A0000-0x0000000002A23000-memory.dmp

Download

memory/4656-197-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/4656-187-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5916-164-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5916-163-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5916-170-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5916-368-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5964-379-0x000001ED082E0000-0x000001ED084BB000-memory.dmp

Download