060fec7d5b0d721c40d2488b1f1a3be660a39779fa24cf3d5c07edea22110c6a

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 3.0MB
Sample260711-mngmqsas21
SHA256 060fec7d5b0d721c40d2488b1f1a3be660a39779fa24cf3d5c07edea22110c6a
MD5 b9a3b46b67df3c1e9828e163529455e0
SHA1 58d53629b92d23700983e90774345e68cbb5b13e
SHA512 b24ca2bbbc384739685a838943af2a4480026d9f4e98d99abcd33d39e067144e1a0b53ec4bc557b37325e500426035f5498b3c6b3b6869a652f5a658c00bccb7
SSDEEP 24576:WbfbqM4YskoVVtE4i0ZJp0Rsivg+6h55H863IXSHaPccCHr4ztqvsf7jPYHmZ:WCHFVdDZDfivg+6h+SHaLCHAtGsT8HU
TLSH
T19EE5080673F807D9F1F34B7849766A5598B6BCA9DA10C39F1561710E0E32B988C72B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3532	elevation_service.exe
3232	elevation_service.exe
6068	maintenanceservice.exe
6136	OSE.EXE
2364	PerceptionSimulationService.exe
2656	perfhost.exe
5964	ReFsDedupSvc.exe
6000	SensorDataService.exe
2668	ssh-agent.exe
824	AgentService.exe
5528	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\eb2503b68f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4e27d722111dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f06015332111dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
3532	elevation_service.exe
3532	elevation_service.exe
3532	elevation_service.exe
3532	elevation_service.exe
3532	elevation_service.exe
3532	elevation_service.exe
3532	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeBackupPrivilege	5964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5964	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5964	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	824	AgentService.exe
Token: SeBackupPrivilege	5964	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5964	ReFsDedupSvc.exe
Token: 33	5528	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5528	SearchIndexer.exe
Token: SeDebugPrivilege	4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	3532	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4728	2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5528 wrote to memory of 456	5528	SearchIndexer.exe	98
PID 5528 wrote to memory of 3016	5528	SearchIndexer.exe	99
PID 5528 wrote to memory of 3528	5528	SearchIndexer.exe	100
PID 5528 wrote to memory of 2168	5528	SearchIndexer.exe	101
PID 5528 wrote to memory of 3344	5528	SearchIndexer.exe	105
PID 5528 wrote to memory of 3436	5528	SearchIndexer.exe	106
PID 5528 wrote to memory of 4756	5528	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_b9a3b46b67df3c1e9828e163529455e0_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3232

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6068

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6136

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2364

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2656

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5964

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6000

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2668

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5528
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3016
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3528
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2168
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3344
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 01dae1dac6acf24e725ac3177f4ae114ae0195d9eb2a6e77dc6a08e7f1d47b88
MD5 56c49ce50a4fc27acee59ec46d8dd512
SHA1 2d51b574407d1b77128f3d2ef0e0066d10336bf5
SHA512 ae6e4f5f54c3bf67d08990d2b8e8ecc575f937155d632bd2b0cc4257dcb70ebf106c6abddfbc11fe2f7e91791d7aafcea8113548eedde33f4e47b4990495c601
SSDEEP 49152:Mb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnzCHAtGsT8HU:23q6tjBsCHQT80
TLSH
T13AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 c154a5108f8f37a01ebc5b9d131029dd7394ba4c3ced4f67953480a23bbfa13a
MD5 fe73be6b3041ca8d1eb13c7a252fd8db
SHA1 f78c455fef98e6b8367082291a0f9379530bebc9
SHA512 a944b8b7ebea2cfa2338fba62182ac184d8a04101d0938aae26c97b6c2c597f364e804179be55922ef7aa6ba607dcdd8dddccf80aeb696fdbc24c6e82a5432cb
SSDEEP 12288:z1XLsswWkxy2lRq2czAOfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHH:pXYfDtczAOccCHr4ztqvsf7jPYHmZ
TLSH
T1C075F128B7E509F9ECA7813DCCA28512E6327C5143A4E78F03A4A9661F337D85E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 82a87cf5c05f57346182497285d96ffac6d1a60325fcd8f2dd44de53ed836bdc
MD5 fa89a5f44388384265dac4d60a5efe25
SHA1 4406ba7f90f0489ae069b33150836a4d6cb78ad4
SHA512 f9ce30057990b19477d60453dbd70a56ca11f07887336a4df1f3ec48d5c60b98dc3d02737f97c5278674f137f2078fe80e6c28b726f55b66b3c199f4025f95b4
SSDEEP 24576:w0Le5ji0hmxnrMvccCHr4ztqvsf7jPYHmZ:wPji0AxOCHAtGsT8HU
TLSH
T1BD859E16F6748335D073C0B9C5D2A69EE97130821B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 234d699e92a95974439f77d8348d248de0cd060456ac26ca5fa11953f5649b89
MD5 e23a6a2c9b684f078668df1832e9c3d1
SHA1 0488cbcec26c2c552e65faa936e768a493b0ad2b
SHA512 c209077c4159ec38c86c6101784122e548a0477ed775815f5b5cb64b3c7ca3c547a04c0f9149cfba51300f5b460ceaed59f275d97236604a61f40d840670d454
SSDEEP 24576:la7/ezSC6vUyDZaqgrvWx6q8wyuxccCHr4ztqvsf7jPYHmZ:s/ezSC6vURPvMHjyKCHAtGsT8HU
TLSH
T112755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6060b8d351a978de318e8f0bb79a1d9fc286824418644437da6d26144b65349b
MD5 c2a5154af4074b52526e194172e93bf9
SHA1 5059632c027e5b4b81382e0024fe52d94fa5e3a3
SHA512 08cc6ca2c7d0b67ca4d083b1f52c0f4051d02e4df1ff4fa1cc5e7dcaa79d79723bb1b0ae04c8514d9770f7c52968ad05f53d8543330dad65bf0c45d61bc205de
SSDEEP 24576:MVbqPb88hv/lV7yccCHr4ztqvsf7jPYHmZ:MVO88hXlVQCHAtGsT8HU
TLSH
T143559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 54415e6035af100848bf64f2f72ccbf3be0f7e39622bbaa86435aee3b46b21b6
MD5 5c21de9535288c33e5f6d578167c4f94
SHA1 3ff12b404483d2cb5a188325b8482cabe4064cd0
SHA512 4b44ec42c959661c74af9382d6d9bb7c569f04a723f192521d257d81ded683795ec54a8920c125cc9cb65b606e8b7b59786b4d8710c656eca778ee5804dbfe2e
SSDEEP 12288:kGzfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:kGzccCHr4ztqvsf7jPYHmZ
TLSH
T1CA552381FB2916A9C3EB5D3789D7321B45005F9101DE964F0B36BA8779BDBD2D0A2323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ea279fe4130dcd9191d858354a9df39d6ae4e2f21ceeb50e128de082801c00a3
MD5 012630ce4e4e10c4e7c8101516cea820
SHA1 750dcd264b53ffcf85780153c0310cbbc4812582
SHA512 8a75f5a0c8d1d0658101aed01404259976bd7ba73b4eef88fc2bb0a375eebecdf34dd394a8d98dc560c75b39febb27f28c2acb7da961e8c975dd9e04fa07167e
SSDEEP 12288:KeBNUbTVO86UKfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:KJIUKccCHr4ztqvsf7jPYHmZ
TLSH
T15575DF3BEE28FCE2C27E8D795A918300D76278704B62A3CBD175C20EDE235E15D79925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3fcaeade409de1ba1a9c525b334e5a6c365e5aef75ab9cc696fcab635b8651ce
MD5 18e9482cc910d4fb6ef14b092cc8cff5
SHA1 43223405811a252c067a3482a3f6fb7bfe84f7a8
SHA512 9bc91715c11bb71a3121cf8342457336ee3bdbad1bac0a1e1aacf64d7caf3edbdfed2bd48ac32e62a3d70491343a1e6633fa4b1d6bf30b3305e1762ffafb08d5
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THQ:5QvGAdlCEL8c/pRNw5C9CHQT80
TLSH
T1A6266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 4639a148a9c7f575a9415f48dd4b5030ab99336faefa7fd623c125e49c37a624
MD5 235b10f0affaf904f7b35df33a4134c2
SHA1 4b69e961e148d8ea1a9d9b2c34a35ba76b0a3d07
SHA512 5606226ce4134a0a3addba01301ce90a58b88b78052a78bc423a84de18a6986e37128821a5acc584cfc82a297795fb9f4190807baa7e60d4ea47d8682d539975
SSDEEP 12288:3AwSfxL/2Dc3xDLLmt0LDQewsAjsfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYO:QwewsAjsccCHr4ztqvsf7jPYHmZ
TLSH
T19B75E031FE74E436C3BF0DB61B66D716142C7A204B911AC3E3A89E8E59742D22376B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 11f6b872a9e22d0ee32edb3de9ceb5de7851320339be7401adfec32c192341ab
MD5 e61426264f4db22285bf6afac7c5692e
SHA1 2cab052c0c4ee3f85781e73f92976dc67daeab03
SHA512 c3dadf51a21e35738db4eef5c6b729a0198a500908de7477005af777c0454cf5de3aebdd585a2d68dec63d8b049ce60b2986a327b8e2d515ac008386e0a9c72c
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHo:RUEtQevvqc2W1cpV29I32
TLSH
T1AC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9fbff9dddcc12196af5fdb48c896fa24d60d7c83f086832526a217d6d3c8009c
MD5 d8aa380a12d41ec4db08a1547ed135f2
SHA1 aaf343d7dacb1b01a72d6ac023d14c494da3f8bf
SHA512 eaad37500bdcef6c6821dbd8f1aa2cb6f3dab9178df032b042933011bd3ca55bc71037035529cb7f1dbc7541efecc696b59d5e74486f192b28400c2fb9943b3a
SSDEEP 49152:4CbRquA/m2yL5zifFiV+XenmE3/z+CHAtGsT8HU:xoqHVjnm5CHQT80
TLSH
T1ACD58D0976B8C2E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 16cdf56b1146fefa1fd29b1acbe28d22d4022279b2c03dde17c3b3dd94b53e26
MD5 320f6ba4f26c137a709463b82473793e
SHA1 5846c11822b7a1314894a0f5873ff0271058a90b
SHA512 dbac4f5ed66ecd1877fe95b71e5abff6824e86d1c9b590887b751ad8950f264214f8f8592ddb4ee444105881054a0aebcf0df401f1844d21f3948349c8180329
SSDEEP 24576:jAhGLmIFoiwtA5l7S53NccCHr4ztqvsf7jPYHmZ:jAM1Foiq5JCHAtGsT8HU
TLSH
T178359D80EBF955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 54c35e21d5a0f5d590461f885b133087e644372dbfcea0692d7c48d38ec17a2d
MD5 141d416c276b5988cc986dda8cd21c38
SHA1 927d80df60d1ef37b718c7e2eac671e30fff5a1b
SHA512 d29d56005848a8fa426d110ebb1fd44684339e05a6f066c23fd95c0327aa193bb3240ca9d169ac7b33c14bd8ab9c814b8ae73940a0b8d0ecd2a1a8be0c61aad2
SSDEEP 12288:Emw5HEjsChNOBFgl0WDm+CRfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1f:hwuXOWIccCHr4ztqvsf7jPYHmZ
TLSH
T15665014677A80CF9E9A78539C5878136F7B2BC022A65D71F0760C64B6F37361AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ee66e22667d390692bcfbefbe161782718d11c1e082850f6fda29eebbc7f6cb7
MD5 647f7b83abdeb9fec6435128a60c0baa
SHA1 73a5593cffc5f2e5f64c4a202b1780e1f5e72231
SHA512 6ebf3943217b5b5ed656993c8e1493d2f5066813061ccd49f1a8549df2d33fa472a8a98b37b2a120dea5fec66f9c62e16a400c2bce40e6dbac1fa72b72112177
SSDEEP 12288:ybZ1Iy8fXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:yZuHccCHr4ztqvsf7jPYHmZ
TLSH
T17855128673A821F9D1E75A3DCCE22606D761385213BA43CF072566972F7BBC25D35322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 81fcbd14c49f705f8326c220b73b1cdf682e6e8d2ddb7467878c27060509e6e0
MD5 fe51275de8d8b421d9e8eff219a8271e
SHA1 a4c86e92a5fc6f9865dad698ff952fe39e5379d4
SHA512 c4e06fb363b0e910cfafa21a6f020add77cb3ab63cf378ac79447f614e355c9157e79a40eecbdfd75b9bda900e03bdb5a9ddb1545c7ec14bb7fea253ee3df774
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Uc:mQRQyi36YOcPuLvw2gAf+PN3ACHQT80
TLSH
T1DF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 401d5489bbc1601c83028be6968b11f4f0b9a1476f2f510d6b91e73889492cae
MD5 4dde99743cfa62b5c0da470b84ca7d61
SHA1 fcb51230df2080a65e45ed0767166095b085097f
SHA512 4be4cb3318b65842a01aff741ff657a7b309c09aa3bc25ee7542ab2643945d076781ed0853a3cbf6c18daae6b2fc5e53b3ced3b08a49903a9de2ca34088d267c
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Uc:mQRQyi36YOcPuLvw2gAf+PN3ACHQT80
TLSH
T152667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3e97bf65e11aae0525ded1691079a8f91089dcf3fb4a3a45e310bbd92d4a8d8a
MD5 8c6053fc50fd7fc841ea3a99a0b63cda
SHA1 8b4d6de536e3d58132bc83d6fa82e2d0c60c2215
SHA512 c9bfbf5ab9a85604c698f0d1c389f157b6f5e90ce01386cf8779777dd6bbee3623d828605467bc8437bb1782e7208e9624c332e682d9e79da15c10488acbc7cd
SSDEEP 24576:twvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL03ccCHr4ztqvsf7x:J68Qg55nhxeWu7PNU3/OCHAtGsT8HU
TLSH
T1BFB55933B2F600A9C44DE1769F4A973196D17C718FE1E3DB861172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 290d03dd8cf6669fba50e78ef9cad6c32aa7917a8540e6b0288aab69d919b627
MD5 0f0cf5c8d81ed9266840eeda4c9f64b8
SHA1 b54403b2963af41facd3cc1cb98786eb5b1c7d5a
SHA512 48600a6bcbdab4cec3e85943873cc209774a7954ea6319c31e879a83eacd6d60246337fbaae9a8d1f28d98dbc820a6acbec379561513cb65b27c22bda3cc8622
SSDEEP 49152:b3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99q:+y5112gYy5azzVvD69nLKnhZ/CHQT80
TLSH
T13D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7ed2d637d4798444630900e67752be51dc9ea11c2e4c3b9102c9147283053548
MD5 7f3b199473dd1d1feb5ee925c17bfc07
SHA1 322546ef2f45a581a5176e0e9618e654aabe8674
SHA512 4df5a521b3ec275a6ec63d8f1c7a8171416fd4f10dd1bea72abab711d5ab81c52766a7acd683ccc06be3f5530bee690c543c8a3259b734801b87007acdc360ea
SSDEEP 49152:kB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glYCHAtGsT8HU:+u6JmQxd2dYCHQT80
TLSH
T174D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d1ca28234f92ab65197328b74312bc0eb6879411a9af3204b2e03d0418deee23
MD5 fa7a718da36ddb48055b26729389ffd6
SHA1 1734f0706ccaa0668114d28293900a38d0fd06b0
SHA512 103ad0fed8e4c6bb481e837437bc9b0eb107c87e7ccb9692492ac9cc99fa0be1c3eda9f3456e781c99e53a1913a9a2b673676ae81e08298caefbebcc98bea00b
SSDEEP 49152:G1hpsNoJpF1A6yU44CwH7R4xUCHAtGsT8HU:GmifPVR5CHQT80
TLSH
T17AB5BE13F29901E8D06ED17887569232EA61BC460B34B6DF0A90B7962F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f405f8cca3c9e93fe7e5ce09f8984f114b429aebd085b021c3e97096a4324a49
MD5 2975d9122c8993bf40c7792e3d9a4ba1
SHA1 a7537e7de02d1414efe84e8db4e5c65dbbed62fe
SHA512 c08c324648252a4c334cfed988291bdcd36fcab126b200361b0b5915d2ffb568e5e047154d6806a4cc26b0f3e164063e6f67fe1c12b2113b5cc2445533bb423e
SSDEEP 49152:PSuZQIY0Be2KIRVtOnks6NMHqDCHAtGsT8HU:15dKOi61DCHQT80
TLSH
T15CC5BF03F2E941E8E0BED6748B669236EA72BC464B34A6DF064072551E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c5032174a3ee8d5f2267dbc34e4734ab0b083d96ac141632838239b63cac235a
MD5 37bdfb8af2ad90721a82853d6a975790
SHA1 153ba18d6fc326b7d314e9845f19c3b4aed9b82a
SHA512 2d045ba8b9edb14d3285ef5f9395e46058351781667a31d26544c3c462f41ee5047bb570c424949ddff55111aa8eefbb260b4a863748d3e1f0aa4d6eace24d96
SSDEEP 49152:ahtSn8EApI0figGgiDn0AP5woCHAtGsT8HU:bX2i/phFCHQT80
TLSH
T1D395BE13F2D901E8D05ED178C7468632EA62BC160B39A6EF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a3d8d585b5bffc8888b2c4b82a9584cb176acaf8001188bf46d36ee083074868
MD5 f27327546c570481de2e871a1448750d
SHA1 ff69119696cdb52aa3372288db2011ebbc898a89
SHA512 500ca3a84845d5804d94fe0fdc91680ddf7c44fe71bc44bcfc829403aeb3ca2866ae181f3e917f053b537a0b55fb324c1c359e6ea2f814f950f50fcc920bb4e5
SSDEEP 12288:ELfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:ELccCHr4ztqvsf7jPYHmZ
TLSH
T1FC552381FA6B1BAAC1E75D37C9D3325B85001F9242EF529F1B2A75437ABDFD22051322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 aa1f47f0bd4a5c5a120918d6a7622d4442922d5fc93162bb942994b70b842839
MD5 ef8d625b4733b45e9bf9428904110fc0
SHA1 5dee907145de1b26c9753e8cbba7a95de263cfab
SHA512 0427da86fb297fc39f47edd8987f10df060b4d95fce1ac9595eb0e78023557dd3c12ff8916d1e53d6e917632812c503cc6ab7a265b8ec4bd1ac4c7fa6b5cddb3
SSDEEP 12288:/wfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:/wccCHr4ztqvsf7jPYHmZ
TLSH
T1FB552381FA6B1BAAC1D75D37C9D3325B45001F9242EF529F1B2AB5437ABDFD22051322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 de7bf19dece8a705213ec3ba7944c10e7a8e821a6abd2e5e7ae1aac9912f6872
MD5 81a1f2cefcb400462910b78945d9126a
SHA1 bbd0b76dc37337cbeb334dcdbfcb0d8849e7a7e9
SHA512 9090d2d35a4a77e30543705b00c3cf6b9db52afa947028b7dfee6e883e95609db6d96936fa734128ce3d3fdf8848835b29372280edd8b02849eddc937585ba5e
SSDEEP 12288:ZifXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:ZiccCHr4ztqvsf7jPYHmZ
TLSH
T16B552381FA6B1BAAC1DB5D3789D3335B85001F9246DF529F1B2A74437ABDFD22051321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 7b5b24fbc6b826a4dc598f8c4e3f9588183b2e5cc35b4b4b6517db5d248c6c04
MD5 52b10c0922d83afe5c3aa2167dfa404d
SHA1 92b02d79647bfae80b89a78ca4debe3d57a48b65
SHA512 351c1224ff0b01ae55da6659281010e7a36528838514b7f17a7748226aba4aab5c1d6b88dbbc6d6809ad8366def11e16352ab628856f8b2729a546904139ce1a
SSDEEP 12288:MVtfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:eccCHr4ztqvsf7jPYHmZ
TLSH
T195552381FB6A06D5C1E7DE3AC9E32216D2507F9143FA939F0B2139472EB9BD16871321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b3d4b3f994cc16cbb53c080d719292ee7524a5aa38cda12b50a1daf9a420eef9
MD5 4235db7577866a5045d76ce519d19a33
SHA1 7fbc9cd56fae22832bb071d1b09d7e464c45b780
SHA512 25f2bd122d94aee54c1d390c3816f29bdeb1ecabe5e620de2cbe9af6c7b2d166e351c328322272b7ec872b8ba156e0388241ff43de0c6b3625d6ac8d69f36004
SSDEEP 12288:DVfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:DVccCHr4ztqvsf7jPYHmZ
TLSH
T1D8552381FA6B17AAC1EB5D3789D3335B85001F9242EF529F1B2A75437ABDFD22061321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 42f1382ab08c778c4102ced50ed5de60f12617cdaa5522c7a2afe20a9ca88722
MD5 be4087c840fef95ff958b51b662ac7b2
SHA1 e5004aa3688ccaaadc297dadb90af32ce8c720f3
SHA512 c2ccb4f26583588a39be0188cc403326573540b3cffd26b2ce81febd4d3c8cfc95b253c437c1b41df2ddb00121d1ad85545958b66285611829d42767c78c90d3
SSDEEP 12288:jkfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:jkccCHr4ztqvsf7jPYHmZ
TLSH
T1EA552381FA6B17AAC1EB5D378DD3325B85001F9242EF529F1B2A75437ABDFD22051322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6934254c61cb34f7ad070a5e536a156f1de783159eac9be57c760ce61956633b
MD5 89923c83b4a66747454d8345d7bf3402
SHA1 0ce39c0b600c1a137ed62e0e27ddc0e6a88770a6
SHA512 5ecc765eddf831457f2083910fa4d8698b1de1e184809f4d8e5ed183b2307ec7b25dc0529974377f4fbd535cdab89fa918c7644be548aecb2ea5a60d26fcca13
SSDEEP 12288:V4fXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:V4ccCHr4ztqvsf7jPYHmZ
TLSH
T115552381FA6B1BAAC1EB5D378DC3325B45001F9246EF529F1B2AB54377BDBD22051322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 8abb43025e080fc1759709072818095c8bdde6c6c3c96dcef3fbb8ea3709b2dd
MD5 293dedb269119d8ed6f3f0b14a4a2a40
SHA1 5b6321a06c9f4385c9062e790f639205d314bebb
SHA512 c7f21fe68c173379486a342154e780e7bb89147063b6fdffc48fb95693da812a2fa36d732937dbcafa7da7cc393f752a3a8d5101571cbe6665e99d99bb46c372
SSDEEP 12288:PiZwbNzzFEoS2cPvyQfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:qZMJzFVSOQccCHr4ztqvsf7jPYHmZ
TLSH
T1E4750195B3A018F8DCA7853ECC565906D2B27C5607A0C61F03B836676F373A11C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 829b5184da0d205f3a582a30f20a775320f5919ee441e63579a4838fd76a3635
MD5 b575baabde5162af8483190e2f822efd
SHA1 2c8c1f95d10adb2e9d2427545c5172a0d9bdff94
SHA512 2136cda451060e4ac21caa63f2af2e2b2062fbcaf3ace8115d3b1da056dcffb4456a88acb58e34c6f7afe236db8775b6c7400dc94fe706107e437cb48cfed2cb
SSDEEP 12288:DXfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:DXccCHr4ztqvsf7jPYHmZ
TLSH
T1C7552381FA6B1BAAC1EB5D3789D3335B85001F9242DF529F1B2A75437ABDFD22051322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 89ac6b154675526cf377afb0ec7772331642aeba429cc261266e9eaa37ccc50b
MD5 028a546c2092eccd7e9ddd32d28fa94d
SHA1 d6026b442f5d22ef0ca566d551fef38394055a8f
SHA512 78f8c0396420a736cb7971fa8a24d12e6e01300b259903d3772315d4ebd427d634f046a3dd927bccc464385b21dc6f5a3b716f837c99de144328ef2ee55f7569
SSDEEP 12288:MDfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:MDccCHr4ztqvsf7jPYHmZ
TLSH
T169552381FA6B1BAAC1EB5D3789D3325B45001F9242DF529F1B2AB5437BBDFD22051322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 08b2406aaca3ab2819f45e876dc7b449db62cd9f35c1d96fe7107600b2bfe04f
MD5 b32035e2c8d0da87bcc0acc96455876c
SHA1 34f0ba514b4d7282c8c1560cc5faeefa1f6527e0
SHA512 e20e38621b9d59677bacc94145f7d7495205b394f9f2fcaa94f2c8d022216c0d42a77658a9cf2816013589e399df47189b1d687584406d89e6282a360aafd30f
SSDEEP 12288:jyPz5L88fXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:Ozy8ccCHr4ztqvsf7jPYHmZ
TLSH
T196650247B3A531F9D1B78639C8922A02E3717C3207A58AAF076466772F3B7D15D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d3acd276198b1d31191dbc4da74de8d98cfb9e8a60c949bee35d63937a379b7b
MD5 6b174e3a6ac970796829fb6c41265e0e
SHA1 96b76d2cddb88543486847d912ea5dd13429f24f
SHA512 ab122a0358b822ed950454f24fec627ba5e65623a913a8812d9e631af9c6c8f27ffcc14aff397948529e7be07c44ff6b05fc36ef633eafc72cc6bbf43609d891
SSDEEP 12288:4XfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:4XccCHr4ztqvsf7jPYHmZ
TLSH
T142552381FA6B1BAAC1EB5D3789D3335B85001F9242DF529F1B2A75437ABDFD22051321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f9c9fccf26723b0221ea591be309672f15dcff41f085e9931e5cbe4ea9e60b4d
MD5 bbfc00dfb2c8375c6453b9fa57eeab2c
SHA1 cc8a733055a2052c4473484b26c27dfc1dc39b4f
SHA512 8ae034bc3a783928d2cd94bcbfba3710e825b8945c00b34c2636b7f96dffed4bf09a9aae89a0bd694f5d6278a51e2e40d6e3e3033b3fbeed1c6d7d8630544486
SSDEEP 12288:LXfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:LXccCHr4ztqvsf7jPYHmZ
TLSH
T1E3552381FA6B1BAAC1EB5D3789D3335B85001F9242EF529F1B2A75437ABDFD22051321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 97580fbe4370a9e2f854ddc050e7910381ae11677baa9f3208825fb347a1a118
MD5 e94e64d187c7ee66ad04a56f324720f3
SHA1 37b08ab1b5f2fd11d94bdb337be6df39f7f230a8
SHA512 922bc3ca4e3dcaa66940fe6842fc7144a2f0b2a34911c8acc71d264ebb865bda150da94988d5850d0dec26d72f333cd09c1a6613ada5afd504aeb5ad0f66d33f
SSDEEP 12288:ByPz5L88fXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:Qzy8ccCHr4ztqvsf7jPYHmZ
TLSH
T1D5650247B3A531F9D1B78639C8922A02E3717C3207A58AAF076466772F3B7D15D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 3718d6ab535ce38dfb06e3738d96cdee55d2828a024e95b611c4f6223400c792
MD5 c2cee3430dfd23575a59609a60ddffc2
SHA1 aeade36ea0dd64d8729871f75bea82846daca8da
SHA512 221827d3d0eae3945307e1a160f856a2bfd6e7e53ed03ae3050ab3a8f6f92c23006f51e0825ee12112e24c69921dc3bdfa60b6f84111b8954c64cc5507d1b41e
SSDEEP 12288:2Cd9XWYoaLHF3z0z04PDvhSfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1f:XTuaLl3z0zDSccCHr4ztqvsf7jPYHmZ
TLSH
T16C750194B3A018F8DCA7853ECC565906D2B27C5607B4C65F03A836676F373A11C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 0853913810d52e0a582986ef0dc24daefe847c04ee23058b0d37b83d0601d640
MD5 bec900b366a7994301d54811d1ee6bb6
SHA1 76227effda977f83d6a5dceb945c2ffdeb35b0d5
SHA512 205c42f509ad3a64a2a336c8237011001c4a3e1f248e7934a483903191119d9022ea7c2bf3216a7c07b2851dad4bf4626fdcb15ab59e2da39cefb5afc68cd304
SSDEEP 24576:v3xd9CHKy7GZmccCHr4ztqvsf7jPYHmZ:/xd9CHKyamCHAtGsT8HU
TLSH
T11885CF90F3E410E8F0B79A358D765512DA767C9A1B71DA8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 84da4310a33c4ce640cca3883ffec2295c4e9d17a2fa8ba1926cfd472029fd0e
MD5 07d0ae19c9e2eeb49f17a917917cd8f8
SHA1 fc0f8b90ac76e23dd471026fe38fe029ce282b40
SHA512 1625250db884e43a40b5c4f631ba51d2dd9fd22e5fb70fbecfb30614d61e4f07b6f230a0fce87267ce8381ea145763cea4be17aead803b47d69d86261b0f75f2
SSDEEP 12288:2CfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:2CccCHr4ztqvsf7jPYHmZ
TLSH
T144552381FA6F1BAAC1DB5D3789D3325B85001F9242DF529F1B2A74437ABDFD22061321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f22cd10e1c2cbbeaa334fc569bc6b2a9afb48038dfdd4fa5143a4852d3bfde29
MD5 7e55159c2f923ca2038818eb2e139098
SHA1 afe1c42b2ba34e4ec756e758b8506ca5876e3055
SHA512 dfeef2ed04021c775fa7aca249e687df2d6ef6851dfff4bb6a492718f601acca50affac236e6010effa57bb5915f98b725b4e742e8b4317d7d1c6a60a15b7110
SSDEEP 12288:PcfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:PcccCHr4ztqvsf7jPYHmZ
TLSH
T198552381FA6A0BEAC1EB5D3789D7335B45001F9242EF529F1B2A74437ABDFD26051322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5abd89cabb1ef3eeba5b4a35daa34a8b7add97b563b937b851030147015f3c1c
MD5 62b7c7d808d642aa2eb89e60f1e2eeec
SHA1 36d68902dd40b4e281b9c2802263fc2f309be342
SHA512 14dbaaa3fed792ffaddf61b2df6ccf7c8cd8e53648e2243207dd7173fb527d53bb7c74f1ced8a125b2b0b4e5cec08c190da46fd2dc7c82bb9ca4a983bcf069fd
SSDEEP 12288:G5fXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:G5ccCHr4ztqvsf7jPYHmZ
TLSH
T156552381FA6B1BAAC1EB5D3789D3335B85001F9242DF529F1B2A75437ABDFD22051322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9081daf118b11791c86bd08a622bfc8fbbcebb2c5a4ffd69027f5b50086e04eb
MD5 2da820acedd43289e33bef63f88f85fe
SHA1 fd941a9804a3d525b27bf453e7121462038fc278
SHA512 72059ee0044e0c92c077299684e6eae4e726e1cecaba9aa909580838d937a31eccb4328cf7db117a981651ddad117a9af87ec5c677b3416c97355a3119300f66
SSDEEP 12288:BXfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:BXccCHr4ztqvsf7jPYHmZ
TLSH
T16B552381FA6B1BAAC1EB5D3789D3335B45001F9242EF529F1B2A75437ABDFD22051321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 fa186ece6d70c9589832faf5f755bb9bb522817424143f4b25cc6cc46c3a4f2f
MD5 21a4835b799c478ff9078d7c85f615d2
SHA1 ebaed368d219f93ab55e3494bf7b3b9d6f388ecd
SHA512 e7b3f8a049a32962bfedd87d1a4387a061820b2ebf8ae16fde54ba22bed302ab71abba8dbabeff6c445279627d457fc7339e1658e225f62675d48f0589ac12cf
SSDEEP 12288:pCfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:pCccCHr4ztqvsf7jPYHmZ
TLSH
T1B4552381FA6B17AAC1DB5D3789D3335B85001F9242EF529F1B2A75437ABDFD22052321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d66ad9723ec4b95b90b2b3751ca8710d06b2087eaa39dd235f01151903a64f4a
MD5 7a4ab9f3f04feebabce7da5b0bd6b75c
SHA1 d7a69ac809e78801a056058399d47e9c1c17e061
SHA512 3101f1f619fc6827e7d141ad024e59da183c2a7b9c6f54c4570143feb3f60abf1a9ce857596cd848fed71d0a7edb0d511492921b83aa633be3ebba5683a051ff
SSDEEP 12288:yffXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:yfccCHr4ztqvsf7jPYHmZ
TLSH
T14A552381FA6B1BAAC1EB5D37C9C7325785001F9242EF529F1B2A75437ABDBD22051322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 db920b0da9ea6d5219819d403c52082f62062e539fe30edf15f41194ada1441f
MD5 aed33b0eeca2730203f92596b6baaa49
SHA1 e378e551b0f27f8907cfb85f754ae16f2ff4d16d
SHA512 10aebbba0d5ff4bcba41f7406cac98b2534e203300f79f2e413018c853900da3bdf9c464b09038ada97a2aec16c330f42dd3d0a9dbfe57a0aba9a65285102b99
SSDEEP 12288:DVfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:DVccCHr4ztqvsf7jPYHmZ
TLSH
T13F552381FA6B17AAC1EB5D37C9D3335B85001F9242EF529F1B2A75437ABDBD22061321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 f6380e59d18eb7f53e3ea81cded9e883a41cb3d0051cad119f522279570b5a34
MD5 b5c1a674c59515fc39d1bbd23f2904a9
SHA1 2ca20b064f6748b0ad61e62c1fbec217b889f7ca
SHA512 e9986729bce7d1db05673d654001beafc9285fd07c889ae4e1a63912e37078dd1ae1afa967776e59143af242d5a014eaa773762b53a05677fd17cb68a16a6d54
SSDEEP 24576:hfwvOk9RX6wkyAITccCHr4ztqvsf7jPYHmZ:NMnYIfCHAtGsT8HU
TLSH
T14785D029EBDC04E5E1B7923C89B3460AF6B178691B71C2CF025A53AE1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2b36535bbe292d28ff89fafe7940fbb69928d90a9aa7c5168b843c2d2bfa7603
MD5 33e57874ff7e2187b799846f663d5d5a
SHA1 8dee9d0e8ca362e374a9152c83fdd066a9a0096c
SHA512 37aee91d7963d55faa2cff754deaa76ac2d67f4a88c54aa9c233526319473d80f133bdc01616927268ad3077b950a6fb0e1c851ace9a44485ea6f2e51b93d7fa
SSDEEP 49152:PYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ICHAtGsT8HU:BySzPgCHQT80
TLSH
T11B066C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d8d94c7def4a9bb4d7de82ecbead7c17ffb9000ec4fea4d437ad60165bfc1c1d
MD5 68e1f164b2a424a891c240525d5ed838
SHA1 f3260c0df344b21fbda800c7d2098fe4e83f5702
SHA512 a717eac221cd259511d197abc63ac480ceb926f8fb54b476fd0ae25f5283e2d78e3c27eae7a96f5c439f7f0c610ebe224e6f4abc05fe436a8ee5176892e514fd
SSDEEP 24576:q47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYgccCHr4ztqvsf7jPYHmZ:q47JUQjairIhCnDHUPfF/YCHAtGsT8HU
TLSH
T1F965AE1EA3EC01E5E1BA927885154A1AEA71782E1F31CACF1270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 d12da30ec3907ae0fb0850d371175f9be29c3f3c5c401abc7295383293136719
MD5 91e7d0501f438b40a285c7c56e4aec75
SHA1 ef7c07db4e4c8816058974b1af8fa7ede48754fb
SHA512 f4e8cfacf4c81bf8de3ee809681cc9e38a6abbb47b73ffdd3a67b4710ad3f53fd53ea38974a95d5ddafbbb5dd771dfc5d7f50393668b7b0251a4db2280ea6190
SSDEEP 12288:XksfHfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:jHccCHr4ztqvsf7jPYHmZ
TLSH
T1E065F149E29802E8C0AE653ACB965641B3233D6143E6D3CF17D0F53E2F7A6915DEA313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 7a2ff52eacf7d720c1ac27e6c9546c0da606b748a3f56a130d69ccf27162cabf
MD5 e2b6806b17082ce63ae6393c8ce46c11
SHA1 1c28056af77349f0f7f69231f99eb986266f17e5
SHA512 607464eec69fc32764e2464696efe31515a185f42f3885baa625e3199b96acf1c52e46f8eb118612a015eb9ee2031efbfe311247effa765e4c2f23c4df4c9b17
SSDEEP 12288:0L0TU3faumnJSdYjLOrpxuT2KAE2HBezXiovVEvbo2WsM:0LiUPPRpc6HBmio9EvbozsM
TLSH
T1F23518407666C74FC6A940321E32D1CCABB07D01EE446F0773C88B3F9576A59BAF6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 e156bb746ba151a249dda5ce0e9f6e5c9beab1cb0d2b9519a9e8e5c166785668
MD5 3afdecd8c958aab70ce001c9e55860da
SHA1 7270a8b19e4cdad499906569234133890cf3fae5
SHA512 3f18b512a8f0399b1777e862d464f42d7b5a8fb9dd765d276fd734844a01da1ed1216db105675a95ea51c987a51473994572eaac8ee55f61f922d78fb37cfbfa
SSDEEP 12288:OuABJSdYle6HmJSdYle6OACSdYle6XMlSs5xNbCQUcYJICMJttLmcbIkMPtLUYZe:PSqgs5UjV6
TLSH
T1F865C8405137E38FD1BA6031072A5B8C77A4EC16BB496F27B388453AD86BB15A0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 bdbb8a26673d0fc9e3264773839412bdc5f729e8ccae8f273336c5d5902863b0
MD5 3e4ae549e5cbbbd3276e871a7dab3aad
SHA1 889a3dff45eac8a6ba970ee37ff2b30233054c46
SHA512 e8aa2e96b2701ad6aa6e7a417ef47499069cc91ebbccb2967438363c8e024359f1772ed9bd2be2281fd264bc3ed25fad50162f8e3a5d554d6a04de51975419fb
SSDEEP 12288:/z7PfXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:vPccCHr4ztqvsf7jPYHmZ
TLSH
T12D552341F76E1A9AD0FB5D3688DB222612043FA10BD992CF5B1672837ABDFC25C71316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fbfd087ba4fe921eecfb26bf7d17eff4c48b91786afa8d7ee5f7b8a52d49e353
MD5 1fdbee9b02c8fc6e24bea6acc4b8397e
SHA1 80a0453a58c12a45d69706be153ebf4441fa47c2
SHA512 8f8d71727acfff480f7c5ed7a754f1e06fdfcf813ff1e3a19e7bc39fb028935e712a5b4cc471484d4989b408fd52ee2658b8b4b4b6da4a736788ca1abcb8c82a
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYxccCHr4ztqvsf7jPYHmZ:Ngb4mBIBhGFiCHAtGsT8HU
TLSH
T1D9659E1E22EC02F5E0FAD2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 764c8ba80feddf39d2a73dfa9f2a553d82280c70b5938738fc33f652631163dc
MD5 27bfdab13e9be60f7a6c69479a9e9252
SHA1 5299cbf12cc4e3c175f6f2d56bc6214d3c94cfba
SHA512 80fae68edeba99f825012170f0b461e65908ba2e5df8f2d5e95952632fee2482dc8cef1eb5979f8c8f8ada5205a2501282aa9e1f5887c82b2acc2dd43daf65b5
SSDEEP 24576:6G88u8FpJqH1nzria7/mQccCHr4ztqvsf7jPYHmZ:B7ZFPqV6a7/1CHAtGsT8HU
TLSH
T1D385F165B7E501F1D47BD13889824663F6B1B8210364EBDF07A88A521F33BE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 40dcc2ff292ea663ab85dd2291e6fe94cb799d6aa2c88092e07c061fb588ecd5
MD5 fd7ad662b12d7c76362fe4201bec35aa
SHA1 01b9ac1f42e4a4444da2c21d95c57f3645054f94
SHA512 c5f59859e2d75c026272df09c1f0c753b819ce7b36be5da557741e2db81194e205b3243b1153f645324838f17b6f72760d93a86245e12b33febce444f73654dc
SSDEEP 12288:8HvUrBFrEjwaQ0fXzoWJ+nK9CHB3Y4TsztqEW2WUrf7yR7SPYHtyP1BZHZZ:8PUr+NQ0ccCHr4ztqvsf7jPYHmZ
TLSH
T1AC65E11F72AD18E5E67AA13D89824709E77178620352D2CF02A1917F5F77EE8BC39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 33a53879d88e4eb133b3e3265684750e6118a608a3f77000e96b0df80156e365
MD5 8d0ed783a96da4363cd2afddfd771337
SHA1 2d116c55e2bc12c8281e051d7b027dbc1483f7df
SHA512 44db9d54b93f3215c82cd5e987bfc91d0ccf291cb6e2d27b08ebc868ea5fd9120b28f2a32afbfa8e3673e7f67c69665c54dbc1238959e3f35569770af9cd995c
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWCHAtGsT8HU:mG05lO43bnCHQT80
TLSH
T13CD5CF6A62EC11F9D1BBD17CCAC6460BEBB23815033556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6c0b668960842a20e164923d4796da0764a8a7636c3d18f85c32df81d73767fe
MD5 5ba2edf15e6694fe157664bc1ded11c7
SHA1 e7bd9e85e0ed6d3dc5a70490ab2c3417c0ce41af
SHA512 fa5a937e5749a9b6ae867d8695815ececf3810c26d951bf77d1d51954ec1ed76e9310781fbb5a06c7223672cc55ed4e86edd5d425d7cbf5a1bf45dcb34e603b7
SSDEEP 24576:/fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnuccCHr4ztqvsf7jPYHmZ:Ha5POZ3hJt2pasx2+mOCHAtGsT8HU
TLSH
T15065AF5EA6FC01D5D1B9D17DC583461AE5B1342253729BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 793166e63d92e7337d6b864fc615a9b91c7c3a76b81108eb3ec55e51e661aab4
MD5 5ba2ab7b2fa7f219b141cc24e189feb9
SHA1 f29512b8f8b1337d781e2ff25ff72e0d904d38ee
SHA512 3fb63e8141c920a475d0e1f2f233c9f94cd3cdfca634fee44e9a3c5e97313670416ced900cde1359de5ad19391552655314a785f373ec706efb6d5885016d1a5
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkoccCHr4ztqvsf7jPYHmZ:ENc/zEOVHFVCHAtGsT8HU
TLSH
T1F5858B1623E901E4F1BBE1BE89779646FA71786513348ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f6dfa1112e56d736e760fe4964a7844bb2ad55410a913f04c0e6a92c20a68475
MD5 d7b14e3f6928c0b186d5081c8953f31c
SHA1 42194bae2984423511809560d444748dd86a1aa5
SHA512 065d5b1321a7a2cde487cdd58b4538c81e7504786689f92f80be2f19ca7a4afeb7f5213dc6b8cc8c6b5131a0f6840fa15445d0badd2cee1652eb3b6462e4074c
SSDEEP 24576:x3kNvNnaFeYhJNtmZBmaccCHr4ztqvsf7jPYHmZ:x3MwBtOmECHAtGsT8HU
TLSH
T12955AF6EBAB806E4D1FAC675CD238512E6727861073293CB4390C13F1E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2003578da3f2b9a8a3749d6379ab4e301d23718f3a4d05cd29a7cee688ee24f6
MD5 4ec3d75970819f2c8f6fa6c91c79b6d8
SHA1 506ccbdba57f23bdd79d485522e2f797234eca95
SHA512 5ebfc4ce485ee196e25a7141aae417af36d1ad86923d8d6296238c5a3ee265cd3625964ec6d58ca7dd21f74d237e1b036b9d13e5c6613bc1e2edbcd83d4dd0a9
SSDEEP 24576:XD3FHshBIYQgArccCHr4ztqvsf7jPYHmZ:XDVHeBIAA3CHAtGsT8HU
TLSH
T10A75E17DEB9C04E4D57BD1BCCAA34607E77138A9036266CB029491B61F6BEE43D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/824-157-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/824-132-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/824-126-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/824-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/824-159-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2364-293-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2364-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2364-67-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2364-73-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2656-78-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/2656-308-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2656-77-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2656-83-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/2668-121-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/2668-113-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2668-311-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2668-115-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3232-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3232-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3232-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3232-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3232-139-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3532-23-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3532-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3532-15-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3532-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4728-8-0x0000000001F20000-0x0000000001F80000-memory.dmp

Download

memory/4728-7-0x0000000001F20000-0x0000000001F80000-memory.dmp

Download

memory/4728-87-0x0000000140000000-0x000000014030D000-memory.dmp

Download

memory/4728-1-0x0000000001F20000-0x0000000001F80000-memory.dmp

Download

memory/4728-0-0x0000000140000000-0x000000014030D000-memory.dmp

Download

memory/5528-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5528-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5528-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5528-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5964-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5964-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5964-95-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5964-327-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5964-89-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5964-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6000-107-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6000-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6000-312-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6000-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6000-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6000-101-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6068-40-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/6068-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/6068-58-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/6068-62-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/6068-46-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/6136-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6136-276-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/6136-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6136-51-0x0000000140000000-0x0000000140226000-memory.dmp

Download