1456997eb9781c0ed8a51820a4b84e47e9696661b09e80c443127477f21569bc

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 08:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 12.2MB
Sample260708-kagpgads2z
SHA256 1456997eb9781c0ed8a51820a4b84e47e9696661b09e80c443127477f21569bc
MD5 cb72fe5da07b8e3190696366c7a1d0ea
SHA1 c017b64005e0f88a91f8aff87df0c52edf8cb5e6
SHA512 bb9e8fcd2b7828f9abce18b5df6c4b24cd5a24ee1a6e6d18080b917267e0baf64e60f15394fea3d14d4c62e4f36adff3383672ec27e2e9769a786af2199d6316
SSDEEP 98304:YuBaR7bSiWvlBLwZ1aKMuD/DA0dZ7jzFzkpSODPcy1DQq/b3EvuKBPwox8WLOEJ1:YtuLwZS8xXoHPzkueNLXt8FfKW7X
TLSH
T169D68D8A62F901D4D1E6D079C60E954BE7B27C5103708BEF01659ABA5F376E38E3B321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3400	elevation_service.exe
1264	elevation_service.exe
4320	maintenanceservice.exe
2628	OSE.EXE
2744	PerceptionSimulationService.exe
5360	perfhost.exe
4272	ReFsDedupSvc.exe
2080	SensorDataService.exe
2872	ssh-agent.exe
2692	AgentService.exe
4148	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1457b01e2718719d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114953\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f476b328b30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000004d368529b30edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000113fe28b30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000737caf28b30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	2692	AgentService.exe
Token: SeBackupPrivilege	4272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4272	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4272	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4272	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4272	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4272	ReFsDedupSvc.exe
Token: 33	4148	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4148	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4148	SearchIndexer.exe
Token: SeDebugPrivilege	576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	3400	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
576	2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 5832	4148	SearchIndexer.exe	99
PID 4148 wrote to memory of 3628	4148	SearchIndexer.exe	100
PID 4148 wrote to memory of 1848	4148	SearchIndexer.exe	101
PID 4148 wrote to memory of 3444	4148	SearchIndexer.exe	102
PID 4148 wrote to memory of 4468	4148	SearchIndexer.exe	104
PID 4148 wrote to memory of 3424	4148	SearchIndexer.exe	105
PID 4148 wrote to memory of 5460	4148	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_cb72fe5da07b8e3190696366c7a1d0ea_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1264

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4320

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2628

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2744

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5360

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2080

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2872

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5832
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2786392678-1011493168-3329660577-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2786392678-1011493168-3329660577-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2820 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3444
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3424
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2820 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2678f2eefffb52b6413ea418f201f3e41b38daa3ad40425012927d1a135a7429
MD5 593448911f9c062fb0886b11ef99a83a
SHA1 1ccad8b7bdc73402a37e0ca70a2a11d2dc05a103
SHA512 b5fba1b55df9a99f71288665817144ecb3887eb0a2742454819635983fb3f3a0ec80bbccb177dbc14342b82e616b528a2896067b62c70289f7ee53d7074a3562
SSDEEP 49152:ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxnux4x8EVep:w3q6HjBxix8EVy
TLSH
T168D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 e47366d8e577f51c08c4507f77db70f4d42131a2a77a78d5d8cfa7e8a07537a6
MD5 b74863ef2b7b6ead42023cf35c1575f1
SHA1 cff602c1902029b49bb906e7b2df32fe9ee72e73
SHA512 6c755740f47d3e7157c16d110f172b9c7bdb17d81c3b92353c559279bc49cecbfa1bfd10814cd6716e09073a75934b337b47eb80799e060a42883e516b40f2aa
SSDEEP 12288:41XLsswWkxy2lRq2czAa+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:+XYfDtczAayxknw4FYnshx8OfVe247
TLSH
T17775F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 b87d7bdee7d538c03e41fadd7b506bc8c5823b15fe9f42b95d22edeaf2a401a8
MD5 4b3b37a38b284b796173afb19d0ae882
SHA1 7f1d929db7c93afafdeab2c60127d99600676f8d
SHA512 c5503001105b1ca20c7e8a39d41c93223b259921b9a2df179fb888043ac6ca75ac60391f6feb65805cd4b89f9d7a6e46553638418262509df864eefec0c6fb21
SSDEEP 24576:q0Le5ji0hmx1rMjyxknw4FYnshx8OfVe247:qPji0A7Lx4x8EVep
TLSH
T16A95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c2147c192bee925d97e0b0ca0b6db59778010435fa03ae31338b8521fdb3f287
MD5 12bf2c20b4f856eff8a1086983cd9794
SHA1 276340782265f2efb6378e4f08bebb90ceb652bf
SHA512 9aeecd6b94d4615fef54cdd7126b9604bf04e5c0bf7de2885cc3a69618a2f4523b88b5c00912ace88b9c86ef1faf8a0a69250f1c7c931bd02d52f472f756655b
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWE6q8wyu1yxknw4FYnshx8OfVe247:N/ezSC6vUzPvxHjyfx4x8EVep
TLSH
T170756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 82c3b71a02a5826554eda7b363ed64bb39ce45308e5e496bcb3bf833b9573145
MD5 6140e4e7b6af60e6ccb09091914e277d
SHA1 9da291476368eeaaba07b0cb69632ffd40743ec3
SHA512 7a7f1943970ef2492e2d5cd15efe58f4f0ff2a2cc4d5d50953a80801986a2f6b4f28b8edf92752fb466e24b6b020e0e4c8a9dac3b8c1cd801fbdcc3875815e0c
SSDEEP 24576:4VbqPb88hv/l+6Oyxknw4FYnshx8OfVe247:4VO88hXl+qx4x8EVep
TLSH
T19E559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 39da94e46c22998628f2f187e55c6501815b6ef5238f2e82eaa9f696ae96cf26
MD5 f1bb3f4813e042294dd2f11fda71ae6a
SHA1 16c1216787dd32b28d24ac920637da4a30f27a0c
SHA512 c7554042f4c28b750215603e1cc762d7fac8a844121fa5b600137415df7a168c9387143840217684acb43d2ad3190607a2bdce6f0124420e4aec0d1665656811
SSDEEP 12288:WNn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:WNnyxknw4FYnshx8OfVe247
TLSH
T12365237CA7DDA4E1FA5E14331B7572623616B9A0DA74C11BC778B14EE0F0CA0E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 f72059cb55c6aef4a9f48620f41f4bf5a75f5e9da904c2b7008ffae6eaadabe9
MD5 e7fdc8cc39018b827e0ef962a1ae54d1
SHA1 f40873e3f8e477b66265c188a4ab3d078909309a
SHA512 054a830b33dd820cdb05d33d5e486e379258da6ccfc340e4e9e69317e6d355686744dfc5f26567a279e148e3bb58bfb2703a2727e4de54d70a031cd83677f2f6
SSDEEP 12288:9eBNUbTVO86Um+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9JIUmyxknw4FYnshx8OfVe247
TLSH
T12C75CF7BEE28FCD2C27E4DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6a92df2e727073e4f3d58db2ccb744d783fe78965c425917914e4602c82bef20
MD5 65de133a002bdc17004cc6ebcdee694d
SHA1 593f2119218706d11da971a98f0a1949c239aa93
SHA512 1d960198c5814378b843d2fd8a0032d05be5df647894e58ced685871ef1e28facb58d381e815f34a79b95659ba07a58d1c5b3eb3e1fd1bc438296086b4765308
SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THR:hQvGAdlCEL8c/yRNw5CQix8EVy
TLSH
T140267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 0c8cbbb1fe54596978f4315436e6b2e3b3cd3d44b56a079ca55b1cde74fdc2fd
MD5 7ed4551b8736eebdce54caa931ff702a
SHA1 6d1e21faf848130fbccf3a58ee575b383d502701
SHA512 9a840f41e04c186c1de969d3e6b104e17523a4df9b0ac7e3d84fef919987bde4036074630cbdeab208cef816e6b2237204f39023a2d2e1bdf78919327d66b537
SSDEEP 12288:FAwSfxL/2Dc3LDLLmt0LDQewsAj4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:m6ewsAj4yxknw4FYnshx8OfVe247
TLSH
T1E585E030FE74E032C7BF0DB21B36D716142DB9604B611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e055b70b46cc8c5478d4562e11da4aeda210431cfccbafa8737222a4cf1f8b83
MD5 dedac942fa38c89f37cd62a32d76a94a
SHA1 a52d5fc40790ff5886a971f98d398d543c833d62
SHA512 cf02a1d2d70f02e7242f12e28633e08c9cb7930e3d3493595597f6466a55b571651fc686641d2bf62b3add0e001c3ed1e621e99d9d4981c12755c1e087844d38
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH2:sUEtQevvqc2W1cpV2EI32
TLSH
T1D7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6956827ad3e2deff2a8532fd400d9eeb5921c77e0ac0dc9232ba013592dc0aa3
MD5 90aa4149043b18e8dd11ec5599d2c90f
SHA1 7755c77b9ce970334659458b9bf6deafab653c77
SHA512 e2d0dc3672e691b33f930d9957ec848bbe6bd14ff5f8ba4a251c60c14755111978aa18cf239c80028ffb55bb6eb2ead8996377ac918228173520d85862c9c98f
SSDEEP 49152:5CbRquA/m2yL5zQfFiV+XenmE3/z7x4x8EVep:WoqtVjnm0ix8EVy
TLSH
T102D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f8bd5b511039033719be57d1d98d242adc6f5392c6a14b7dd3de0346527586a1
MD5 4edb229f3f55cbc3572d90ea2807c201
SHA1 d08084256c8bfe7dda9066e6d07721cc6654678a
SHA512 235416695d22b88096c836029327daca86d360089a9560cfd112938231bfe3f412d67168a7b14acde2d5771722b2e4f0ac0897bb0819b8b99bfe01fd45008a45
SSDEEP 24576:PAhGLJIFoiwtA5l7S53Ryxknw4FYnshx8OfVe247:PAMyFoiq5Ex4x8EVep
TLSH
T12035AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 91c62154b1ef42b6f8e58d817cf737447ecba687539aa605aa6422355e597b4f
MD5 a3fb74ed1893b0c4f3d3220f9b1e8e4c
SHA1 6e453080bc0af20085878a0286ec75f32553d399
SHA512 5fbf1ba07cb89e6bf18ff81cbcfb7fe42f396800f92380f394a95bed6475dcc5be3880df9936a47b597b23d728207d11826fdd22caf0f02ac045c313651484c1
SSDEEP 12288:wmw5HEjsChN4BFgl0WDm+CV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:twuVOWkyxknw4FYnshx8OfVe247
TLSH
T1C275F14977E91CF9E96741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 03f792b0398d09ec2b496690b5b0c5d4b2a5c527521e5665230a1fd25a227068
MD5 a68ce8d95752a173b5d284c375f80bac
SHA1 958c0e36389e0a5528c062541d71e774810ccf48
SHA512 1af8fa755e6f8a1e8ea23e5dc06645c8b2bc075fcf83abb0b57b607d19a9649fdf5246f0a00e45e45671efe102697c8121fed1b7ed247657180894e277c2bc82
SSDEEP 12288:fFZ1IyI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dZubyxknw4FYnshx8OfVe247
TLSH
T1B86512AC33E860F1E1A7113A89F15205E7627462677183CF4768A25EAF72DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f687c96ff52c7d478bb26178987d1e2bc91c2c41eb8acaa9b6c9b53064fbd27b
MD5 e68243ed26efb34f8519642afbb729a1
SHA1 bb2d70067610eab9ccc4ebcb27752bf98cf1f769
SHA512 86bcb57ee9af716c694579dea85632f19732e797a32aec2156b992021a415a58399d8dd006f548983cfae324d8a7ccd2960a22bc690161c1a2bfe7423ef1cdb2
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:nQRQyi36YOcPQLvw2gAf+PN3Nix8EVy
TLSH
T11D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9a4ec498eaea0f401f98d4870881bf31d10eb5f54e0d156e223c88aeba92389e
MD5 140a0220a814a550c4be8296b7702d44
SHA1 e6b024f742e7771ebedaa3d7b0904026928abeaa
SHA512 03ce71c0e2039b734e700e9aa2684b32795091c91c5eb899ce2a361e7e1db8d904198dcaa9b63afc0fd89a03a65f57299d90472958099e9d6e7f506fa65e6744
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:vQRQyi36YOcPQLvw2gAf+PN3Nix8EVy
TLSH
T145667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 63246415f76197d9b1273b2fbdc8be36193c5b2d51855ddf26c8984b5aa5babe
MD5 de014c12bb9b17cb691a06361008d83d
SHA1 41a5de8f0221fa0007326754c81dbe710ca8c056
SHA512 ec6d3251b7b8d1e7a2c386f44f41e49f758d23b59ca9f651d4268d3c50d22d6981239b2641769a9a3547808b96b1eac3bdd7feff6b686d4b1343b2828958ffbf
SSDEEP 24576:xwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Lyxknw4FYnshx8Z:d68Qg55nhheWu7PNU3/Lx4x8EVep
TLSH
T1B5B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f44d73b362879190a2a5ef48ff832939f40657ba080d2ab31943eb06c3cf0a8c
MD5 9f6b9fe775a8d00402cf8ae08f77759f
SHA1 085dc88e5589005e0e0ec9315f40395453964b6b
SHA512 08e5212f2e45a1c8aa5f349714f3e4186d219f3aaab7e599fec2c8703f1d415dd110adccc39a72ebace59fccff4da78a1b75c21f823b580134a7f286b9254d1b
SSDEEP 49152:R3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99b:wy5112gYy5azzVvL69nLKnhZyix8EVy
TLSH
T143167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 92555faf418ad2e8b5fda8b7aedc8c9075127ce57398486050ffc9c06ca5a6fc
MD5 5154761b11c8bb1fde4d766ea3c05398
SHA1 03aced27c5744b2b38baca0bb068dafff93ba6c7
SHA512 2982717bcea6412d6c0fad0fdd5c0ff105292a482cd47bb3f7628d6d2a3811bc5b3e1eb6d017843e8cd3f1cffb6d08e9e8d7f83d834f7e087b22c80b5f8cc883
SSDEEP 49152:rB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gllx4x8EVep:9u6JmVxd2dlix8EVy
TLSH
T149D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cf066b4667f569ae72a44a881cf0330007ac8b8bd3f7e11c52b6d66316dbc246
MD5 ed157edc80ab880ca0b5113b8ebe275c
SHA1 1b0c8c6d61b783d9f0ab93e62794cb2933336398
SHA512 2a287d460e988407cdb958015a77803a46a50b5766105e94d75f72287536fc5da09e2e1d4c926747750cb82ea3e38f6f74df787a01b5d1f5acc870ab0ba4942c
SSDEEP 49152:c1hpsNoJpF1A6UU44CwH7R4x5x4x8EVep:cmifPbR0ix8EVy
TLSH
T1F5B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1cc349c2382ff42b5f83e824b3375a7373312360a195ffcb8ff511ebc74ff2db
MD5 42fee964820f813a97aee39588bf9562
SHA1 2d80335fdfd9e17f3217eab793a69938757b47ce
SHA512 0f628b316b479fb9750f40bd5d4c3bdc17e2845cad42bdd7bc38e6a74029004a38e4d7cc6535ff5391c0efeded6628eea8d068a4866c7a82a4d98eb212e147cb
SSDEEP 49152:ASuZQIY0Be2KRRVtOnks6NMHq+x4x8EVep:a5dKTi61+ix8EVy
TLSH
T1CBC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ada370d8ed0db97f352793041d1834b4b25dbafe524449030e48ffeea4e00b4e
MD5 68e831d29ff5a676b11a9c8831f1db02
SHA1 8cc897a6675f56dd53054cf9b1a48b6ad24aa1fb
SHA512 21a861b5182f62ed7d582b763757a31e5858214578b44d8abfa5ae34f0726612f62df749bdec846e0c87461e357dd0f40aa4a725bf1a47420cdb8bba48fdc871
SSDEEP 49152:vhtSn8EApI0figngiDn0AP5w1x4x8EVep:+X2iyphYix8EVy
TLSH
T1BC95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 26ecdd44040df0f5ebfdf9d3781ad65c956dca7177865a40410a50d5faa1b4dc
MD5 6f7638adbbf55c83012bd5a40f7b7f47
SHA1 227572ea77e91beb941a2392e546a8ef49201f83
SHA512 afb5eebc1a1b16e162f174159d17c8e9775156df4ef533e088534052b8c344350fa68f57f99c75d8115b29e2c7d9cadcacbde9462780f2581ef6e0f521a68f1e
SSDEEP 12288:z/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:z/yxknw4FYnshx8OfVe247
TLSH
T15765237CBADEA5E2F50D11734B7173626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 f9cc004716c075421a7df42c8d61ab6bcf0fa4c6a49017e0d41b15f33b9074f6
MD5 5f1a2f18b816f81f2a16c42d67b5dfaa
SHA1 66004a2084b4349f998cdca4fe2eb130111a75d8
SHA512 e42612b7745febbb6a7c895fd6d10d993d8b878a7ed0ace6b6c6329f45f6eed4b3eafeb6019cb99f79e422af026e3e5caf99c99c3380aefd7e18080f3fb658b9
SSDEEP 12288:zM+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zMyxknw4FYnshx8OfVe247
TLSH
T19465237CBADE95E2F50D11734B7172626609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 542b25034ac034de3fe2978a43b5449e6a4bf6439ae073c3145af96c87883941
MD5 d3cce5253bd254781ef987d629b2cf29
SHA1 3b9a65831fbcb171afe718f292366849378b8966
SHA512 49bcfee828ab2c9345e820de8898b75e246cb8f21b9cb8a2120fa493bbd8c15f6e6154cd34d2cecf8a7be2746a32ab4689f6b71b5aa5dabfd6e349fb0b5fff79
SSDEEP 12288:a++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:a+yxknw4FYnshx8OfVe247
TLSH
T1BF65237CBBDEA4E2F54D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 55ba926f82e8861e4e980e8c6e8d7f2f7036921e9fca30865c674f91d99145fd
MD5 b559ba51ed2f4fc2bbd0e33f21723fa3
SHA1 22473428439591d8ea46128f7b37c3b9172b6ecb
SHA512 5f6a73f07535c8c484ed3c0a0e9a603bc9c9e31ad83c6631e5a0f3a14b9c4ebce2f4bc9f86ae6c00e952e8537de4ea170f721bc8104d44d818d7b50805161e69
SSDEEP 12288:5Vx+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9yxknw4FYnshx8OfVe247
TLSH
T19E65236C77EE50D1E85A51738A726222B365B8E5E731835FCB24700EE9F0890E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 5aa16b66a80617513a9877925e851d418f1be41adb2ef1f0a2702890e34c5a37
MD5 a46d5b2e1d602b58b0d59a6b502df602
SHA1 c7634d5a471c51c4fa86564599956ee15fcb5e03
SHA512 9f72b7a24ce84378109796fd089b494a119ce672f13af679ffc042e85142d013c48a07862af0bd9d91a334f4bb9bdc513daa46872ab078c115541db505b9a840
SSDEEP 12288:v5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:v5yxknw4FYnshx8OfVe247
TLSH
T1E465237CBBDE94E2F50D11734B7273626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 53426348f58f9f39e4fdf902914051c02b858da390173e7c0157185265c328be
MD5 2ef5b9dcf8478f7cf90b191c2f999387
SHA1 c37e67c5b99899856ee64dd16c8ed92382282de0
SHA512 585e2877f4054143c4ae445e90e9f5e83f3694246089a8dd5fe1f8ecba343a0013c82990901b284cbf09906b73a5a743eae562c8daaa1e6dbfea17d60806533e
SSDEEP 12288:dw+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dwyxknw4FYnshx8OfVe247
TLSH
T1B965237CBBDE95E2F50D11734B7173626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 d38ddb2d9220a1372981f03cf19b6d35babe91dc120436a60e1aa591a6cd8baa
MD5 fa9a6eb248eb4c725e3a9577a87d52a2
SHA1 5a2eb53549e22dec5754ba9fb13b9500c043c4b5
SHA512 5fb508e8c595d673ca61a4de834d37415d5ea8fcea2c12dc267e960802f39adacf58b2deb026a6ebe2acb8ecf4e410052249b72b10ed2a16fdaf37a306623eb3
SSDEEP 12288:oU+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:oUyxknw4FYnshx8OfVe247
TLSH
T10E65237CBBDE95E2F50D11734B7172626609B5A5EA71811BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 fdc9b088a3d9560d06162cae2f69181645018d21d7f005e89ae9f839f59b5de6
MD5 215322c25319a99146212550eb090f91
SHA1 e9c7a1401b8444e97f901e596c111769ea919c00
SHA512 e1e8753d5125ec8896ae9286604234c20f08cc23661222e3076cfdcafc31e0927f3bffad8324a61240b69da55bb1aef4f600e11215089369a6298ac0ff102130
SSDEEP 12288:eiZwbZzzFEoS2cPvys+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BZMdzFVSOsyxknw4FYnshx8OfVe247
TLSH
T1FC7501A8B39018F4EC67413ECD259916D6B27C594B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 2d97fb1fbb165e8117897793f7dfde70ceefb71778a35d8d4115f1765bc252e5
MD5 efcaa9afb600e64b7430e1549eaa931f
SHA1 1aa8742fc9df95786b737a14bfebf9d12f40edf7
SHA512 b6413fbe03cc55f0ac91d4eea7ef4f24d989a7dd125263401a6e2a1af14274a061683cd7ef4d7df769ef6958bb36d92f484d2d99db69cc53a484bc99ad40bc38
SSDEEP 12288:tr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tryxknw4FYnshx8OfVe247
TLSH
T13B65237CBBDEA4E2F50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 4ed5bbe9594cf87ed751a1931f371122bd589ad5652172baf758578c923e0df5
MD5 cfe7fa3f5d1b5c566a4a473a8d96b8b9
SHA1 d39980ffe93033825029d1902470dca9d6f2280e
SHA512 498ea41abfcea20be0190814dba963ffe18f912cd3967317655f5d3b30fc17e038deb2474124250b56593d30f53e87b13bcca9c291d8279b199180b14d1ac44d
SSDEEP 12288:M3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:M3yxknw4FYnshx8OfVe247
TLSH
T1836523BCBBDE95E2F50D11734B7173626609B6A5EA71811BCB6DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 3cf36d63f65ab9b7bfdb44af4d2de6160312b1715e1d4dcb5e0c577933889680
MD5 f3e9f0d8ad8848ce993e37424b035c0e
SHA1 04ac23f0ea6eab22c962b1e9ba2507bdcb88534a
SHA512 1a4cb6e9f412278de95081325704a73c268280f58f9558973260653296bd29d4fea26cdeec7073a6cf6be3323e86d46c6b1b3f126fd1486d57263e0858cfcfcd
SSDEEP 12288:dyPz5L8I+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:UzyIyxknw4FYnshx8OfVe247
TLSH
T18A75125B73E530F5E12A423689621612F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 5fc6810652fb172923ab4a95142bea2bc55a69c958f187a96ae4b64fb814f396
MD5 e5d4a4507954fd8653e072b7939e34d6
SHA1 c0befa7513ef521689a8d5e8056e406032975438
SHA512 af9f83de1311337c2ac87989c08f253dfde02acfa9740f1d63bbe7f68939eaba133adcc0c0350659a400493a2f6bcf4c956dd16582cf2b134078df754d4dee75
SSDEEP 12288:2r+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2ryxknw4FYnshx8OfVe247
TLSH
T10665237CBBDEA4E2F50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 5040f053c243a7371fbb99bf63f37f4f0c6e5175781e5dabeb5aafe027bb4d6d
MD5 924bf328f2927429532850222e9f470d
SHA1 685b762ce5b54111f8f02c8416632aeee3d0df9d
SHA512 68d91d7bae2f06b49be219779f405e7fb94b729f48d50fc14fdb64b50dd81ac36d26aff7e88a4316b2f17e4ad1537055a3a131152ebd3b0e836e53a0a00908df
SSDEEP 12288:Sr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Sryxknw4FYnshx8OfVe247
TLSH
T17165237CBBDEA4E2F50D11734B7173626609B5A5EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 cc405896cbe3b083cd14e1023cc5a46b3ac9025bd138f40c250170f49a747dd7
MD5 9c4ec98d2df60820522ea35de35c09ee
SHA1 685562dadfe5c754ee433e12ccf69fdb729f8788
SHA512 57a02ffb792bdd2dfef5bb440365353c6cbbd9871d7aa1057b356f614236953bccdc34b0ddad1e78c054d9bd6d0a9b2db48ca8d32f2894a70b9173d9c370822c
SSDEEP 12288:cyPz5L8I+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:FzyIyxknw4FYnshx8OfVe247
TLSH
T1E475125B73E530F5E13A423689621612F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 b78b1b207b2904e280ba989f1a05a1d4d3d1159cf3ceb68f4ea879b7f874c855
MD5 4ff786ec40b1390e9e1fa8583e6ae040
SHA1 367ddbf11a05a95877ee82fa5c29354c9bd8e502
SHA512 fd3fb669feca84566216f5afdbe65a26e8469a03f93020a89bf52576d02d8a98c8e4286e406b47029c8e3a1224d02ba76ac838f5b71a9b054338bd0a6ecdfa20
SSDEEP 24576:eTGaLl3z0zDuyxknw4FYnshx8OfVe247:eTFLljAx4x8EVep
TLSH
T11B7502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 e1a70cc141f9392c50fdea0cd3c26d0072e13cefa2e0d9df262fc81007ad8b66
MD5 55f248b274ee56ebec9ffd7f2d2c9afc
SHA1 c3bde0a5405d476c5f1da45774aa17d135194861
SHA512 28de7d9243db0c10e57974d1bf77e09aa5c190d74bb3868ff6308702856e24f23e4d291c663c4f5580f5e0eafa0a65ef1050c0aae343fd6f17aea5a8ee1d4849
SSDEEP 24576:Y3Xd9CHKy7GZyyxknw4FYnshx8OfVe247:iXd9CHKyaDx4x8EVep
TLSH
T17595DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 e4c4701700b8707f861acc9ac2bc0c9e4bc255751482ba6f8cb77a9509ba05ff
MD5 16710d4d79da7438b935bd3b51949bf4
SHA1 5bac310007686df9101c5b20e2a392fee72c2d34
SHA512 7bf4e83d392179c6fdf560450949e743707221f6c8c66779ecf8535406677e469002838b278c70fd921aa726c15d87ace0cc3d401d16b90d3166545f4f51d9fd
SSDEEP 12288:le+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:leyxknw4FYnshx8OfVe247
TLSH
T1D565237CBBDEA5E2F50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 4b4cfcc20e098f283b8a191ea6cce1276882d0bcc421f47547fb7ded11e7643c
MD5 e0f481a9b5779827f2bd64efd43a8cc5
SHA1 6a3084adbd7518540d73df625c734bf79f714a79
SHA512 633f4009291a85117c9f5996ecc9024c6ea74b7431352029c36d47af6a079510e1c1a8fd8846b3024e3aafad9320a7b3886e840363626a92ab08bda319d7b5da
SSDEEP 12288:Bo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Boyxknw4FYnshx8OfVe247
TLSH
T1D865237CBBDE95E2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 396c216a4ef3e139025e93c300d64556361432ab8263e414ecb7df71ff08514f
MD5 da1e8f4f828f1b5cadf085400a642348
SHA1 e2787d53e2dfd9eca4cfb8ab3539458d7a2ccf3e
SHA512 a25e2f7b67bc8cc529d218a4c63028a1c1980400389a93f9e536807879bc722e16958d4e33fcdf213e451e768a8a83610af041143cdaa0ae403225d7bb625cdc
SSDEEP 12288:A9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:A9yxknw4FYnshx8OfVe247
TLSH
T1BE65237CBBDEA4E2F50D11734B7173626509B5A5EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 b815bb23386bfaa43466f2d9d7b72016a957d88cf2e78d61e1e6bfb916dbc94f
MD5 d5f40fa74b275cd62df460b77aaec6e2
SHA1 b8627dd7fa0569e9bb1aeba3e8a42346489c9d7e
SHA512 e7dead36a8731834297764cc602f441828ac3ec24e513bcea7f56324cdc0ce34adfab5ac2662bc49f00b174ee95ac1668d32064d9dcc659adae5bacefd245c4a
SSDEEP 12288:Zr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Zryxknw4FYnshx8OfVe247
TLSH
T16F65237CBBDEA4E2F50D11734B7173626609B5A5EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 433fedd58f23e834c899f37001fab5cf140df9efb4db9fbb31beb9548ccf02d3
MD5 b0878f60e805749924f1c40ac4081462
SHA1 187490d9cd92403952a9ecaf195001e85eafd746
SHA512 abcd159ca6b2433b7200eb42798e0619eb9182c87a37e932341547df49848381e3e1e113b0af4d6f11305fcd331a8fb6d96ef3a76993dfe90680d3c73fd16bd5
SSDEEP 12288:8e+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8eyxknw4FYnshx8OfVe247
TLSH
T17E65237CBBDEA4E2F50D11734B7173626609B5A5EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 5278a21ead0c42917e3b2e66b0d5a82f6d0d0f04544f1712740a104745d7fd73
MD5 1c1a7420c5491f1c7d3863425d50bb7e
SHA1 b4763901209a0535b13575caabf2d51c535ab4d6
SHA512 d8e0a9269a65424c7142b6311812299ec508a848de9498dba2f1bfb39e0f7460206a093bada80b2ce8acbb32b9456a329d4978e6e5536ff347d07cb9dc668d6f
SSDEEP 12288:UT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:UTyxknw4FYnshx8OfVe247
TLSH
T16965237CBBDE95E2E50D01734B7173626609B5A5EA72821BCB7DB10EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 abbe19493284206e23d80c724ef4ac0cafe0dfb9eb7b73e735e3e6e0c998fb28
MD5 c90961a05196ab1dfdc74a19ee7a1f66
SHA1 4c43a6a3c96924b987974fae113935681c40ec3a
SHA512 1764d35a48d2d1f067a528baf8bdc13843c5cf7b5eb03db534f7cde362a642a49cf0147679ddc5b8c9b4571d0a56beec81cbf08d79ebd20f059366baa0b8b3fc
SSDEEP 12288:Z5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Z5yxknw4FYnshx8OfVe247
TLSH
T15C65237CBBDE95E2F50D11734B7173626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 a09e71b1c046909b5ab0282368a8f0c01f08dd6e65a0efd1f138a8fbe79bfa67
MD5 6a3d8aa76dfdb1d608f3d4fe9df1f9f8
SHA1 4cd31d643ac72114c97dce3656bf780899cb3b8d
SHA512 42c33cc71cb0219fbf0674edb9270c83ce63c5af8b257580ce82ebc511d2900950c981a45a8e771b49458d072730dad165998db3074c698ad31b9d59b642e12f
SSDEEP 24576:rfwvJk9RX6wkyAIHyxknw4FYnshx8OfVe247:EMnYISx4x8EVep
TLSH
T11095CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ad80f8a990023d83046f9b1703a0cf715766fe6dcee607eb501dd4c2ae75efcc
MD5 be5bbea315b680c8345cb54bcc479536
SHA1 7ca4b6f0ec08f072fda025d4d27ba044cc8d5e29
SHA512 76d549bcf98c09d67387ac98b2fd4630deb16d96fc1c294853d19e1bf5cf392452faacee8296cd8df15dd8ebe1cd6f18ab1fe8e9631615857a10f3452d1d7d2f
SSDEEP 49152:7YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Vx4x8EVep:fySzPtix8EVy
TLSH
T131066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fa6849962a14792c72ea2f48def3ea240a105192f090fc9f61a695373f291265
MD5 a378eedda44bd593d52559c1ee0e843b
SHA1 a926ca9bb13dae47545ef3a5e6b2a5061edc7310
SHA512 a0ce51a02a23e1b59ee2a206697ebf8fef38ae4c3c9f2072f9780d8674fea4973f48b1314b815580285ee3160444282e7f426cf3075a51ae9cda416736edc521
SSDEEP 24576:I47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY8yxknw4FYnshx8OfVe247:I47JUQj1irIhCnDHUPfF/lx4x8EVep
TLSH
T16965AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 743ca089b3801d423e8bdb6c1cea32e9f6343b0f0a5bfce88b6d145ff7bc1305
MD5 528feb9db06f844e820d5c28e7e7d077
SHA1 fe110c0c11f9d4b129b33943016cea6e4b627a82
SHA512 fc94553d62026c0adb7c20ce9415756c2e964cc43b2a24f834fea448a610c3b242c7e7952f838d0b7e0f297e492c7a6f65d461f9901d0f97427b71d4d54886d4
SSDEEP 12288:o+sfb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:obyxknw4FYnshx8OfVe247
TLSH
T13575F028E29812E4D06E2176CB625641B3237C6597F1D3CB97D0F13E1FB1990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 6422276fa1aabac8655590a0d8448de4405e176fbd66ea3e12932f543557c796
MD5 fe4de5f95c439eb76e6659a915c5e664
SHA1 a4f7df70b9bfcc550f7ca72979906a508a50aa52
SHA512 208e88bfdf9719bdda8c70467aa8b32eb10d35953acfa593873186c0bdf738e35f7f068724032d165c7c6aa2a98cedd663c29440e4f7974a38348ab980b6ceeb
SSDEEP 6144:bsBC2naINFJuyotMxUK002MLjQzE87nsldIh/I1GyWkehzax0yfAErTEsW0NwinY:ky3zEyQWBOfoEcsdNDFVW3Tlv
TLSH
T12B452710766AD75FC6AD40325E36D1CCA7707D42EE05AB0773C8873F9876658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 f607f5e898eb89dec5a8dc844da8ae78f9ced87dbda6caf6920341f380087606
MD5 12ae274ed19b543585ac1e163af5c050
SHA1 e4143ae475f28048f94d7fea15264f46ca3c9559
SHA512 a13100a3bf967426a5b622e26eae7934ae21a7568cdd02f2a2160ce4795d01fd5513123187fb219115398551aa5412dfd0fedef3cb295f26337407f5b481aaff
SSDEEP 6144:E/qlGTROxsEp8cD5J11BIrtMxUKYGe9+9o9AtMxUKz4IfnsS+8gFHsPmVhIaZMUC:8TRi11MGe9+9o9vyO+VhICp8
TLSH
T19165F941A136A38FC2BB1072076A5B4CA764EC07B749AF2673CC453AD86B715B0F97C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 d7a0772c6626cc819f9f56b97bd8c932098bb9ff375ca9c11e01e6adb1a6ba4c
MD5 f30ca162217c086f50faf3c0abe11ad8
SHA1 e42a562d7ae80a3574588e22e598db277cb45d63
SHA512 244aa020fa8159dd244b7007d12b85263a185e40480e0b6c15232f484814835f51dd99c44d93451ba97606d75f33addd2c0245f3dd866c382f8ea50e4f9fefda
SSDEEP 12288:347D+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:oDyxknw4FYnshx8OfVe247
TLSH
T18865237CA7DEA892F86D11730676A221360AB5B49B70C1DBD728B14EE4B0CD0D87E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fd2962fc110815be2bb2360bee154be8b9bfbd78edc99085cb322b5c1a2a8957
MD5 0102bec5bd73a38d8515826bc741f89f
SHA1 19b868465d805cfd4e3b2a7e95e0d6546cb3a4ce
SHA512 6b26bc44856521678daf198c4ba4ffff0e9502864bd4b24d969d408d1e8e205cf821f28e593ba3b283a41dedc28efd70f99d41e04159387038795afd25c2a5ae
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bY1yxknw4FYnshx8OfVe247:pgb4mBIBhGFXx4x8EVep
TLSH
T17F65AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 e92d2b84ff4c56c2b8810e5a6655f22ee2d5690e33200737f1effa9fb0879a7b
MD5 b037bb344db5822374f6f78e840d3694
SHA1 7e99b63b7e5aedddb86877c9e7fbabbc5205e4a7
SHA512 26fb12dc91ef68b8a17e82ce8558115fc322f751182bd243e8febe48e421631eae50525404078dee100e26950759ec7fc7d24271f145679b3bb969c0d0ca2169
SSDEEP 24576:fG88u8FpJqH1azria7/msyxknw4FYnshx8OfVe247:u7ZFPqVla7/Ix4x8EVep
TLSH
T17495F16877E501F0D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 0e82d925d2ab9b58ff5aa95d9cd34affc78777821ceca79beeaf5c583f32c237
MD5 d0546c9e35b17a3aafcc735ba20cc1f7
SHA1 16303a35c1fbd0d4105ec7208c76759a864c53ae
SHA512 289618da5deeba218d832a8cd61d229b7017d566eb3c844ebae6c5974f9dd03641857764d3f32d5e09e8ba67c157f11c62da2bb9e51f32f76a5b8e93ead1e9a3
SSDEEP 12288:QHvUrBFrEjwaQA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:QPUr+NQAyxknw4FYnshx8OfVe247
TLSH
T14F75F12E22ED18E5E67AA17D89824319F771B4621712D2CF02E0917E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 67d8a71d4e3a76477d144034e3ba1927b943f6bace20a512f205fd4f6edbcdc6
MD5 d9633454644d743024e221ba44bf1322
SHA1 f3b72b1b0513ab702ef2286c27b7bbf743292f1c
SHA512 fc51d791d9a8632492cd18e3e39d8e671bd382fb7a0759b6881ee7d5b317a20b3a912b957861491af591c1da3ff9cf3091c1d9ef7926f7496779ab449b59516b
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzx4x8EVep:JG05lO43b6ix8EVy
TLSH
T1C8D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0422318fda5a9e7b552d9c56b3af8d2573100a833f46c5f2f3066aad2fec085d
MD5 bcb303bf41178997723d0f51920c88d7
SHA1 efd0485b2e979d12a436469d55fa1e3eb523e0c5
SHA512 30ee429409dc02d1db8029113c717d7c205dac5b77b4b4b344db6339950a03c182891dd1c2d34e10498e37b9e78f60280deeaf95de3462a43c4d49aa88ca0d95
SSDEEP 24576:Jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn6yxknw4FYnshx8OfVe247:Za5POZ3+Jt2pasx2+mLx4x8EVep
TLSH
T10C65AF5DA6FC01D5E5B9D17DC583461AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7091a5dbca975c829bbfea95a25344e276e391e857eaf6e59c0564988d057933
MD5 ff0497d5399a58165c8483b18a98ea73
SHA1 60077329e3668fbaa71a26f57880b0c83e5a457f
SHA512 61b52dad88bef5c1d6162778d339dd8a74f59755b7c6a3e0739c6abdba14aec3aad738417f92b2247f778feffa118436ee879aa9a2d15356548ca62a5fd6acb1
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkEyxknw4FYnshx8OfVe247:INc/zEOVHFox4x8EVep
TLSH
T130857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 30ee02a892f45e736cbdfcc5a1efe0a67da82d1dee781d97a1dc445710a45c53
MD5 850d0287d415791a214891ba85a53d7b
SHA1 ae8ec92d353fe579cf6a5b290c9769979097806f
SHA512 763053475a6c25c1dae826212c5208a8070c9830310f2e12bcb991fd39c6d09d0a952bd6104541eeb465c4332a6cb0634745d89081f1846824e377c5621adab8
SSDEEP 24576:48kNvNnaFeYhJNtmZBm2yxknw4FYnshx8OfVe247:48MwBtOmpx4x8EVep
TLSH
T12B55AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 9c4e0b5e1f5002b62fd165744c1d4429c1221c15191f1aa8e3f712200384d70b
MD5 b0eac740d2b4ad20cc2bd07e4c4f6190
SHA1 80e5b8c2fec1bc161dda8bd41ab1f52daa737b0b
SHA512 3814569e81f55547bc0fc8725115ef5b4a72d9761e73049c26e91acd25691be82c487149fd725bd3ea1fb4727b0406265ca6b8a21926671164b76b3db316f3cc
SSDEEP 24576:rD3FHshBIYQgAfyxknw4FYnshx8OfVe247:rDVHeBIAAKx4x8EVep
TLSH
T1EB85E17DE79C04E4E57AC1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/576-0-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/576-11-0x0000000140000000-0x0000000140C51000-memory.dmp

Download

memory/576-6-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/576-83-0x0000000140000000-0x0000000140C51000-memory.dmp

Download

memory/1264-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1264-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1264-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1264-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1264-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2080-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2080-107-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2080-101-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2080-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2080-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2080-317-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2628-179-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2628-53-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2628-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2628-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2692-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2692-137-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2692-126-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2692-132-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2692-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2744-71-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2744-84-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/2744-65-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2872-316-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/2872-114-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/2872-112-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/2872-120-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/3400-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3400-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3400-20-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3400-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4148-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4148-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4148-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4148-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4272-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4272-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4272-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4272-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4272-331-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4272-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4320-38-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4320-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4320-51-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4320-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4320-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5360-75-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/5360-80-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/5360-86-0x0000000000400000-0x0000000000563000-memory.dmp

Download