0aa435a5aa68e3d8c8de8a7558e5f75f08c0ad97aa597c4d7b8e06642a45c1bb

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 14:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 2.2MB
Sample260713-r81cssc15v
SHA256 0aa435a5aa68e3d8c8de8a7558e5f75f08c0ad97aa597c4d7b8e06642a45c1bb
MD5 0fffafa082e87325a907f5205226fd0b
SHA1 e92dedebbaca723f7e759933481fa0df39a4a08a
SHA512 c636ef7ebf36db27a5040dbd36d783e595af7cb33a17001baab1bfbd0248f4b75e06f918c4db0c32a9bc38f8cffa039789166fb596b11c22146ad3e3d5de9eb6
SSDEEP 49152:B/XIZL49J76YZvU8bDQ7mqZ+3HrRsaxHfJvYrPs9HHC:dcMvG8v5w7mV1BgrExHC
TLSH
T1C9B5CF16A7D801BDE0B7C1B9CE568942E772780A07719BDF07D096662F67BE04E3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5340	elevation_service.exe
3620	elevation_service.exe
4652	maintenanceservice.exe
2724	OSE.EXE
3316	PerceptionSimulationService.exe
3852	perfhost.exe
2644	ReFsDedupSvc.exe
1552	SensorDataService.exe
408	ssh-agent.exe
6072	AgentService.exe
5852	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\74d094e6e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d857254fd712dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af40fd4ed712dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000505c7e90d712dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006ab8390d712dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c296b24fd712dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c5e4034fd712dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b799190d712dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	6072	AgentService.exe
Token: SeBackupPrivilege	2644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2644	ReFsDedupSvc.exe
Token: 33	5852	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5852	SearchIndexer.exe
Token: SeDebugPrivilege	3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	3464	2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	5340	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5852 wrote to memory of 3132	5852	SearchIndexer.exe	98
PID 5852 wrote to memory of 5876	5852	SearchIndexer.exe	99
PID 5852 wrote to memory of 6028	5852	SearchIndexer.exe	100
PID 5852 wrote to memory of 4800	5852	SearchIndexer.exe	101
PID 5852 wrote to memory of 3408	5852	SearchIndexer.exe	105
PID 5852 wrote to memory of 3064	5852	SearchIndexer.exe	106
PID 5852 wrote to memory of 1416	5852	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_0fffafa082e87325a907f5205226fd0b_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3620

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4652

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2724

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3316

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3852

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1552

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:408

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6072

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6028
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3408
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3064
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bb9a3e93034268b8328123faf616f2db04213ae284b2763b097dc25b423bc789
MD5 e5f74716f00c33c9d41419165de4de01
SHA1 07bd8505f4289c2c9be2f0afa4bb2290e536eafc
SHA512 ef3f909f609cb445fd4eab76a0b52701b0c784aedf806f72d01bad45635c637d02da72a60c31c1dc614b237ed9b43cc7e00d06dd385ed38b9823f22261083570
SSDEEP 49152:cb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnuxHfJvYrPs9HHC:G3q6sjBbgrExHC
TLSH
T165D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 90ea0955dcc7903c7181c95da881fdefdb73bf5a2235826d1755ee8808e509fa
MD5 36155d841492dfb3a4bd38a5f6ccf855
SHA1 3e2824b33903692d062580ed02ca776c39da5a15
SHA512 781750913b5036683ab779d2cf71e10192674854fc027e4943b7a944ba2c08fab441931777ed65cc1fe1ed3efccd41269b89e7c5155f2158747559d32def1e26
SSDEEP 24576:zXYfDtczAnxHfJaMJWTTXPPC1X9qSH9Y6VyP:WtcMxHfJvYrPs9HHC
TLSH
T15C05022877E509F9ED27827DC8A28111EA337C5547A0E7CB03A499661F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ec1d87bfa1c2d0f21fa9e7231d2c66fbe919baa8545d59e22ea3f531a317057a
MD5 6da3751e548568749b2aee8110a10ab4
SHA1 d72fa6d8dcf5f7fbd0e770cc57d943c0e4b4bc25
SHA512 066d10aa6bf78533b9a9c21818d7994b599c34cd140f801d310ce69286e46af3de5378a8d7614655ef4f2edceb99409eed30179e7ca011fd5b819b247336e820
SSDEEP 24576:L0Le5ji0hmxxrMmxHfJaMJWTTXPPC1X9qSH9Y6VyP:LPji0AjJxHfJvYrPs9HHC
TLSH
T1F6359E15F6748335D073C0B9C5D2A69EE97230865B308ACB0286D76C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f0e7603bb8245fb5ccd21cd8d0f8704be5948b06c6bae33169b05c52f7cc0a2b
MD5 48462620e95df21a5e55aab55053cfbc
SHA1 44e23d343b3be2cc84aeaf1d212781aff956445e
SHA512 5401ec94766cf7c552ee13f2795c87eebdc9ca46d397fb1e1e28df103862c5576e2ee9e788f2e7de09e69ad61c936c1824a047e9f0815ef5701bf517d9929b81
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWn6q8wyucxHfJaMJWTTXPPC1X9qSH9Y6VyP:p/ezSC6vUzPveHjylxHfJvYrPs9HHC
TLSH
T105755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a4d895d461dcbcec48ded087c4ec2ab1960e4b5df9293e5eb36115ce56a79fe3
MD5 7803efa43d38ae439fc0d82a8a60390b
SHA1 9245c5bb860e0a9b997e215257ae42feeae0c354
SHA512 d5a7246a70d309b6be395a53cb3e24830946b0796b601bd2271fdb253040f614d7de73104daba2a13ab1f431023bd7c197deb5fafdd46f82c7af2d5f0307288e
SSDEEP 24576:VVbqPb88hv/l+YrxHfJaMJWTTXPPC1X9qSH9Y6VyP:VVO88hXl+ExHfJvYrPs9HHC
TLSH
T1AF559E66F5748331D073C0BAC4D2A69AEE3234425B318ACB1246D76C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 e5d23c8e305a711ab6ba4eda2b5b8fa74fd0f625bf793a5915c2fca91b299a1a
MD5 7148fd8ff7531ee8f3ea6d9da30f265d
SHA1 869116d1afd88a9ea9f3f1d315bac68ce14de994
SHA512 af16d9e1fbaff624baae241e48f9801ccf3935bb69f29447e34acef4fbe289eaebb0e017edc322e4c3724c0b0a384f293cf8719e5764c0fecbc0899af60dfc97
SSDEEP 12288:8LqxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:8LqxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T190C42356DEEE8375EF22037615D762940852BD6DABD799091003B8CF267ABA0D00F8B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 33fef8b76d3b97c9c263514372e7f35cd7bda344bbf7ed41889e704aace7795f
MD5 d2847dc019cf86c795cabfd1b8bf8f36
SHA1 ef310c580be1a48f977bd1d00beb1b3727db4b23
SHA512 b20b1ea548d5c0a39ac3269e4e39845e815a440ba6aeec4a30320e085f63d5c25c7674736e285339940e5263a5a9e4f0e2aab4b302a4387a61f03871cf2dff48
SSDEEP 12288:PeBNUbTVO86UDxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyV:PJIUDxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T12905C03BEE28FCE2C67A4DB95A918340977278304F52A3CBD165C20EDE235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1c52790c62da313e35bb6467128983e824af861e35bd86a0b40c1260937850aa
MD5 0e3e5ef5fd2a613165ba79318174882a
SHA1 7c92b19c09905933db6f9d7a3c639e64049a65f1
SHA512 f25fec4499ace8c1f9970675e4812ac9c08d15a8dc6cdd85dffd3aefb26bab8419d0f38bcf4b4bf1d408871a4a52e8ca67374bb7abf9c493a57ae9378df2c742
SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THI:fQvGAdlCEL8c/DRNw5CsgrExHC
TLSH
T1FE267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 76166b95e7b0f94bb1e17e5de5a351116b354729fb513de7fc5bde3709eb52fa
MD5 1ab0b711102435778de964e305d38dc2
SHA1 f356997c916324566d344ede2e79094140540c7e
SHA512 309985caccde51b1b2bee965aceebcd60d17473a49238e78f322e195a1369af2522f2b4889fd8e90ad818bd5d74efdd6b9f28ae75bceabd2f33c5b4c95818549
SSDEEP 24576:q0ewsAjZxHfJaMJWTTXPPC1X9qSH9Y6VyP:rljZxHfJvYrPs9HHC
TLSH
T16415E031FE75E036C77B0DB61B26C716142D79204F921AC3E3A89D8E59342D2237AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 44c8b52d604e43dec0a071f98f1db1da2d0e9d378db33dd8ccfc81767356a365
MD5 f0ed228d5b2db7c74a20c38014b0e7c4
SHA1 41d62e51520d9d7d23ea89a055f311115c031705
SHA512 85a3bef196d005aa0011afc8268bac2808570faf18013c4aabcaf376679d478240c869fc5319621911d84d774d4f7d4d3a1415deae63b3dc2e25f2cce31277a1
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHhgQH:PUEtQevvqc2W1cpV2tI32Cy
TLSH
T179474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8b98de9b9b589d03bb40c61a027ee3c844e6189368a47b63450888b77bd6010e
MD5 1b2b9d04c3227bad20bd1d5554b72ee9
SHA1 44c36128d33efc0fd9c9703a711c3f72ab9192f6
SHA512 140293daa1f8916e85872ce7e9026818d6d27165ea28aeaa6a02b25ff3e4d2ae645371fadc362baf1e99ffcd0bcf9663461967267c2690637e9d46e7797b5726
SSDEEP 49152:rCbRquA/m2yL5zLfFiV+XenmE3/z5xHfJvYrPs9HHC:0oq2VjnmYgrExHC
TLSH
T139D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3a617a5c06d8f3aa2a8541ff648aec614a11a9c14efb353fdeec40d72031800e
MD5 61ee2152a0465d8aa33c43852ccb7280
SHA1 a660f6dfbed3e4ea3c4f94ca8c73a63f853b5c8e
SHA512 32a3c869bfc65089c3d25b1fcdc575b942e72369849654c36283bcf9f18298a4a1a6b6bd0d279a6973f2a9dd0cdde761e8455a7bd86d934e2ca30e05a3395532
SSDEEP 24576:EAhGL3IFoiwtA5l7S534xHfJaMJWTTXPPC1X9qSH9Y6VyP:EAMUFoiq5oxHfJvYrPs9HHC
TLSH
T1C435AE81EBF955D4F5B39A7899B68170EA76BCAA5E31C20F2150D10F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 86d7f60f92b2e42d619bc662bd7a5b56c2f096041473eddc6bdc91cb07accfef
MD5 e8ac39da3cb659fc68dac028d18b8ecc
SHA1 34190b118c539384a612508833dc090680d793a7
SHA512 e21b58237672bfc326d63d472d327865bd660c48ab81650ef55a9126f98939ab2a6494e7e796786f8c13f936b9513faff06e957734a2291c7e54c0996cd2ae37
SSDEEP 24576:Owu4OWFxHfJaMJWTTXPPC1X9qSH9Y6VyP:OwvO0xHfJvYrPs9HHC
TLSH
T12A05F14676E90CF9E96342398597C135E7F2BC162A22DB1F1360C64B6F37361AD1EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 39a60f06ccc8c7b5282af58b57cdafce289ad4698695254895ac21fe1d727f5d
MD5 753897133bed151afd1f8f318e64c0f6
SHA1 8218d8f1453506f8a69760d658a73f9c4f630a58
SHA512 4e2ff15761c05ca4be1848823ab44a01872e2ff3b716d3d593995847a0fb96c7feb0a499eb4f199c5b700b62a7d759f36e005645b2a73ab3cce0e6f7de3f1914
SSDEEP 12288:HeZ1IypxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:+Zu+xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T162E4125A36E821F9E663427D89E242049772786A67B343CF1111A68B2F33BD15D3E733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b9f398e8be640b2da3625df8d6f164e276770c61f789dba23b990de887665a0f
MD5 55a949aa52ee219b0a59f63d4b368cf3
SHA1 d1cd7084afc1e25580ebff7fbbc64f67fda49bd3
SHA512 0d056925aa9549a1233a0e767bce98e85ebae544ef551aaae65d8fcff7b8d9709afa07e33e2ca32f10a623ab9fc98613b8054f6b206cf3c50b501d127ed69fd3
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uc:rQRQyi36YOcPbLvw2gAf+PN3fgrExHC
TLSH
T194667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 34df7dc10d8794b659f36957121038e9c6a5905c10893288507ccf419da2d411
MD5 3ede3659d65c085da6a33d38b6d1edf1
SHA1 a198b091849565a39ea72e97fd81b9a4c0d6cc26
SHA512 e3f44188d9fb7e45e31823d53fc10855f397a65b36ca5bfbef1034f3277b362d2ac326028bd5a8c1b1e7b2e702d03f8dd8ddad391c98d08d13cd195ff3848c4b
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uc:LQRQyi36YOcPbLvw2gAf+PN3fgrExHC
TLSH
T155667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f548cfd16a493da19004b58df3fbdfd7f0e3d33b772bf623529fa87c571df3d1
MD5 9e7e58d4d8a2241dcd918cc2cb50f106
SHA1 98fa1ffcbded2dd92192206ae56b859a017281df
SHA512 3bef42579b88778f6263436965dd922ac57807c0023fe5940f45b75f1544564ee750046f317d322ef1e40f714f01d7021a00beb02fed17a9f0b8ed2d102adf42
SSDEEP 49152:B68Qg55nhceWu7PNU3/JxHfJvYrPs9HHC:/thLRc/JgrExHC
TLSH
T163B54933B2F600A9C44DD1769F4A873196D27C758FE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a74d5f403f7ad18c14ede64c663f260ce2a6e617ec9bf1bb8086be3b32c94956
MD5 270b2682508225993d9e01b028bae7ac
SHA1 fee422b442e8f6aa7459a9dfe70989155fc8ebf7
SHA512 18dc859075a2ce8c4e39e82a2ac80055c9ad04046b78b0b16c19fb8af11abe2443c698d444737c4ac0c558623304ad5e7aa072f901662d6f1518bddb1d3ee6be
SSDEEP 49152:E3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99e:Ry5112gYy5azzVvt69nLKnhZqgrExHC
TLSH
T1A9167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3111923dde180e92bd4e3ff0945bbbe8ad1670083a46a5fe44a2eaf9385e6ed0
MD5 bdca05efb4a73c1fc1a34f1713239973
SHA1 b5d816cde82e7c48146f21fc80ff40147e3d6364
SHA512 b2096a46a76f23256aa35ec264008450bf357b7e4c1ea6469aa68c1e279ab67d09136ccb405f78603f5321064ca0c9574510dd251df033750f90a4145396738a
SSDEEP 49152:sB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glXxHfJvYrPs9HHC:mu6Jmdxd2dXgrExHC
TLSH
T1F9D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d1049127a19e1b180801efdf253584fd2ca93a31b02c3cdfb991570aea8517f6
MD5 e37ba0ac9d925f9b8f6eb4ae8dd4c5c4
SHA1 72590ea4fd7bbbfafc697b0df924b50f92872623
SHA512 3eb114ebf59f3c00ee3a46cc4bd01579c3432c83203d2f74d2c07373d6c45c8201f414dcac4fa9013d112b39a57b9e5f5b4d677cfd8322e08db5e6dde16e107d
SSDEEP 49152:J1hpsNoJpF1A63U44CwH7R4xjxHfJvYrPs9HHC:JmifPWRYgrExHC
TLSH
T16BB5BE13F2D901E8D06EC17887569232EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e088972deace384beb6a13bc451687a67d602e0a9a0c42826e9918927b11d414
MD5 162cd72a198f04023423ee995158232d
SHA1 b6941c644ebe9328b1922b12693d21efb79e3e79
SHA512 15db6959b9ea488a579789d6258db2c65a41c71765ac3227e3c33ed26d913d4cdd953d1ad04a1ff55a0bab53b6166ed382baddc832a67b8a28b6f1152796c546
SSDEEP 49152:FSuZQIY0Be2KcRVtOnks6NMHq+xHfJvYrPs9HHC:L5dKii61+grExHC
TLSH
T1E7C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7e0c68b2dcad7c2043fdb09792d48c2d935e1b982abecb0943a7a5ed931e4b4e
MD5 c8a8508e7e5c8274ca5919e275b4a484
SHA1 ab07553c0f863ec882855d1e243f7cbc305767a6
SHA512 7861ad8994c11876b523884e1131fc3923c47bdaceef0b848c6537b027821ec3031e5ec0281ecd88b5623d50544f81e4f64b6f2a0821e241fdcf6ad0e7dc4d31
SSDEEP 49152:VhtSn8EApI0fig3giDn0AP5wnxHfJvYrPs9HHC:kX2imphUgrExHC
TLSH
T19A95BE13F2D901E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 06d5c38c9319d50f19f1e0148afb72c96742456d79d7e8f564ad6251a3e90295
MD5 868edede4ec2f0cc210e0aeff4c81e87
SHA1 e36956fa232d9ad26a66d6f2c76cf48b814589d1
SHA512 c12befdf70eb0baee3b13c420c47f8b461ab72658dcd24c0eef095cce3990c3812a6b51ea89ca3673046c36d9e9752d719adcb908fe19a51fd0748d4aa48f5a5
SSDEEP 12288:ZixHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9K:ZixHfJaMJWTTXPPC1X9qSH9Y6VyPE
TLSH
T1F4C42355ADEF8379EE2103BA459253880856BE6EFBD3554A2007B44B337BBE0500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 1e60751b1a16fb60f4864e7e5d0246a309779ad9ebbc751ca4b05e874b8f9a81
MD5 b5a24db2d61580bae62cce229ccdda3d
SHA1 4b7760be6fa9ac4c469db93820df119751a727be
SHA512 e19cea2c051e3527501df60525b41903974d8618c76fdfe44caee858cc863474e685dad38dfc9fc3c095ac162f6e72fcd48c21786c8ac12d63c333b28bf6babd
SSDEEP 12288:XNxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:XNxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T15AC42355ADEF4379EA2103BA459252980816BE6FFBD3554A2007B48B337BBB4500F8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 3446e2489cb4e9ba24cdad3ae5f12b9488ddcb5f6b9d1a4823610f3611d886f3
MD5 86e05bba0e0708b073f9becfbc95069b
SHA1 3c6c309ea5c82a6c88272b9b49bd8127be9220af
SHA512 0a9a7a3984e260259fed57634f3682fd5b1c6f771094cf8557f19a34a9e4466e1c6b1357b8e3378578956254f82977ce232588eb8725aa7f4981555da567e2a5
SSDEEP 12288:4bxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:4bxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1FDC42355ADEF8369EA2103BA459353980856BD6FFBC3554A2007B44B337BBA4500F8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 481f524555cb7148dca9af6074d0b51b94f2f56e70f6d259a7685a71c4ffea59
MD5 7881d39880899c9ce4fb5ecd949556a8
SHA1 8c561bc3eeefc5cc3d386ae16605a59145190467
SHA512 b99b11b433bdf00a8f96c15519aea2bc511b48a1372380864d4c05012ffaa8c41c678a6a7fc1392be3238f9d1a17dc7e1462e45d7e96f1b0be5bf466a4898c1c
SSDEEP 12288:BVYxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:sxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1B8D423156AEF42E5ED22837985A352540472BC6EFBA3578F1102788B2F737E0540EEB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 6f4db12c121b2696b8677cac1a1f5fabf45b1906bc44960086529b1e851396f7
MD5 a4a65cdf78ae86fef2df5b8fc146979f
SHA1 28232ff2daf37896e1b611f43e714e0e78b859dc
SHA512 8481ecb12e0c40c16e1a2f9d5fcaa77e699cb3c13f0ede7e78527bc68eaabaf961d3eae555626122b0c0245583a51d962f80c991c4054584958c93eca5891041
SSDEEP 12288:OAxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:OAxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T169C42315ADEF8339EA2103BA4593539808567E6FFBD3554A2007B44B377BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 cd851b68d8921ff7689db2778ea81fbe05d831237fabdcd51760f3d85660fe51
MD5 9a41e33c2b8166f54093887aae254dac
SHA1 c5cebf311503b0115036d90feb8802e21aacb667
SHA512 cee3adcfef766225de869fc857af6650c046dec053d0cd0739ccfe947095e18366a07e672ba1c703ca79bb7e8d3bfb57f60bee2c07ba90a8c97bca2289b8069e
SSDEEP 12288:9xxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:9xxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1DAC42355ADEF4379EA2103B6459253980816BE6FFBD3564A2007B48B337BBB4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 40a4df5fad7c4440b968ac491ba6eb0f1ba8538106b525c7fd8d10277911a41a
MD5 4105162f19569e117e0b4b8d6d386423
SHA1 5fe8870813efd908f9f600682dcac7b3a020aa4e
SHA512 c2563a3eddefafde897a1ba21e03a51694cadc0d72935b2d052783ee9f850e8de8e9ae4525602be10571e1d03b70f8131cf6e518723a5801db5b8f2b1cc4c4ee
SSDEEP 12288:H1xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:H1xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T100C42355EDEF4339EA2103BA4592529808567E6EFBD3554A2007B48B337BBB4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 cb0cb9d0501f30f3de11b2d8758be888fedb087dbc49c382adf201b45feb7793
MD5 bca5b28e2649f7365d488278fc68c461
SHA1 2e7e91373598ad70c708966050419cd023ed58a1
SHA512 f8cb5d3284fec97e4152932a5cb6b5f0a2a9790dbb1eb65cda3c9638704d764cd303ddb021a208d5ac5cc65695dd8cd6d7895851cfa576c1e772544d257b9727
SSDEEP 24576:DZMRzFVSOtxHfJaMJWTTXPPC1X9qSH9Y6VyP:DZMRzfBxHfJvYrPs9HHC
TLSH
T1FB050295B39418F8EC63823ECD568905D6B27C5A5BB0C60F13A4365B5F333A11C2EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 e0a9cccbd365487b5e717f4e4328db1e0b854c1f47ced413cdc524c5971cd294
MD5 25f853b01abd1471533726b085665667
SHA1 39a574c4cf81c0cca588df4ee35900195fcf7a45
SHA512 80ff6a7b2de4e3199649f802cf984df443b2cd42ba8c848ec27231b4cd346c42ffe4d7de2e72554f14684240753f89099570ff3d728ca2fdfdb9e098fddaa057
SSDEEP 12288:pOxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:pOxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1C2C42356ADEF4379EE2103BA459253980856BE6FFBC3554A2007B44B337BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 45a4b3d56feb0d8de9a8908eab94d2a5a5511948a7e29335d438887b200be57e
MD5 8d53163bed3bbcd6b351183218dcb057
SHA1 0891192fae587b53d231f2dc70ed1a0d42bed5ae
SHA512 76635cf7bf6f77fddba5237509ef410bc7f8784276ff13a26b73093e944d75947a8126ccdb01e17d5a6d9aac27065395b4472233837e8f9685ef72c81023ac1b
SSDEEP 12288:46xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:46xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1E0C42355ADEF4379EE2103BA459253980816BE6FFBD3564A2007B44B337BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 f13c7af0104142ce90b3b31ea4a3e35edae1df8fd7689f7ef1475b090abd4aeb
MD5 af26d2b3edec67641e683bb8712e35ea
SHA1 07e4abe5140ba1351a74d9cc7414126d210258fa
SHA512 ead2e03a2df30fb1065abee8e7dd7e0c335f755dcd78dd3a3f0bfc2e341dec1ad253a1e9623edc4e47ac47e157e8dc4e2537a86458d972b6a2e76ff1d79b8e8b
SSDEEP 12288:7yPz5L8pxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:2zypxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T16AF4120777A631F8D532823988A21601B772BC365B618A9F1360567B2F377E09D2FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 104ebdb80d3af991880da26136da33d5511a4d83be8194d9c8cb2f0b3dece1e0
MD5 d8af30b8d1f7b8b6004c385ca3de92ba
SHA1 3e4297196441c2b622f0a14d607aceddc5d5180a
SHA512 ec5320c60de4cad6b0e4dedcb20fe41b32d372541354dde713f8e394c175862e6143477e58c627f9e43a18531a7a711eeb3ede6e201b905ae8bf5c3a39e22e2a
SSDEEP 12288:MOxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:MOxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T12DC42355ADEF4379EE2103BA459253980856BE6FFBC3554A2007B44B337BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 ec6d6a5cf232ef3cd25d528bbfb3eca8dffb4d9a92225c4164c4008ae52879de
MD5 b2aeb84465956b0c355c247f9701bb20
SHA1 ddc2206bc8babce53b6b9cb7992554389036d028
SHA512 d03222dc1a0b7d23b45424f32efe0e8e52b8923bf352c4241010cb392c97ab2fd398bf90f47c09d99916d7a9ab0e1e83b321d672d8cee79cc61b9207750e9e1d
SSDEEP 12288:YOxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:YOxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T192C42355ADEF4379EE2103BA459253980816BE6FFBC3554A2007B48B337BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 4cc107db7d5ac0abfda7f03bd50af58b7f06f20f4d58eee0c88438b2e6dde842
MD5 e79d353d0716b3cbb808a754f968b1e0
SHA1 3c7e33ad8a2e027d55a2c013cedc8ce9f8612220
SHA512 9a427d0fe992729c196772f157c53b311bc6f4e0649f7fe870e2346eeef7840d628c003a712efa73c47dde110cdcda9479fd4bd53e1208d1280894d62807af4c
SSDEEP 12288:xyPz5L8pxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:gzypxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1BAF4120777A631F8D532823988A21601B772BC365B618A9F1360567B2F377E09D2FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 cc0f3e589702e4329501a4981c42676a6c3ad50e5e9d0e7ab97e820ef79788b3
MD5 04f5e71b3e31176e396586b577ac1f81
SHA1 ad5593b114a22b69c73476f61c7659fc6d21baf3
SHA512 c8b4b02a6300874df2ede0e5438a1aa3869f1580203404a8da7294d98c2c8f60ba68999faac26c77626c72fe12d4607b9fffdee84a2942a595df489f881ac65d
SSDEEP 24576:zTDaLl3z0zDLxHfJaMJWTTXPPC1X9qSH9Y6VyP:zTuLljcxHfJvYrPs9HHC
TLSH
T1AA050295B39018F8EC67823ECD568905D6B27C5A4BB0C61F13A4365B5F333A11C2EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 7abf5329ccbdc0b2ff9cc933b9fa67573913a9bb0705825f2eaa84debd147f2b
MD5 05bbc4d4cbf86e377c6edb8dcaefe552
SHA1 6eefb2b7afee57bca1a4f0781cbe574ef1e88e33
SHA512 2d3c16267fba4d49ff7357d5b50c22a456853d593b4c536d02e26a59d15db1586656ff0d9d9c29b47d2520988b8ec75123aa8c421179620c4e7432dcd024aa76
SSDEEP 24576:H3vd9CHKy7GZ/xHfJaMJWTTXPPC1X9qSH9Y6VyP:Xvd9CHKyaBxHfJvYrPs9HHC
TLSH
T14325CE90F3E810E8F0B38A3589764511DAB67C5A5B71DA8F03A4665A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 6f7e532fda35a574777d2c868c4bee6964472b4b9994e6c8289a32401613e4ca
MD5 6da5b6ada22beec6d4d746eaca2cdf79
SHA1 7943394725ae10321f03d094d6e22c44aaf04828
SHA512 831058b8cb812ee82e7e340920f7edee94bfccf72645aa4dd908ec907450183d4561884cf0dbaa55fa9e058e3cad1299799303890781fb45bdb219122a4afb2b
SSDEEP 12288:N7xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:N7xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T188C42315EDEF8369EA1103BA459353980856BE6FFBD3554A2007B44B337BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 929db9f7051bffcb48d4bed94b67c256d39c7a0df7261cd8c9d9eae705a745e8
MD5 10cde5d3121b5e7be38100345926da32
SHA1 4153f9e45f5d7de965e68f04eed76b2289c8d9c8
SHA512 d62da92e3ddcbb53650037b8ea6c56301c8f25bd028af2df77d6d9574ca956017e74f8586df00883b18af24378c74c485e88a6f7cb6f27bcf69d28650a95ee07
SSDEEP 12288:AJxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:AJxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T19BC42355ADEF4379EE2103BA059353940856BE6EFBD3564A2103B44B377BBA0900E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 cfe660571ea3341e83c23badf3045bfa12a8fd21cc017ebb7c59198d84a40354
MD5 ab408093382e0f47e0095c1a242b5c8c
SHA1 36fa0180bf08a6b2ca1fd93de84374ee7dc712b8
SHA512 b12e6abd8324fd051d72df094e9f09f23fbe23f0f26b8f254351ce9d794161b93235d7f14725edf1aacd4265593f85b5760fe1a0ca1d0b0b2686ec8bb338dee1
SSDEEP 12288:QkxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:QkxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T13FC42355ADEF4339EE2103BA459253980856BE6FFBC3554A2007B44B377BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 ee08fb8d3b701ffd4b11e5484f541947d07cea191de7cf355d959e7d94c0735a
MD5 15a4da98ed63da2ff9fdb0814285f890
SHA1 9f9dad1a27554c816d4937104750c563756df77c
SHA512 e9910cc08a6ead3746ea0a7e10360d762facd81f663749d07233eb4450e49c4e0590bd4bb9f5749e6ba9a5ab15ddd253b93092d8601ba05d3c06295d5dc8be56
SSDEEP 12288:6OxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:6OxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1B8C42355ADEF4339EE2103BA459253980856BE6FFBC3564A2007B44B377BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 d8d0a6d65c3fe6bf0777e281c2f0e7ca3c062cda6d6f2ac38832ab0a8bdc8aa3
MD5 bde5800ebef48927517d2f1bf6da67c5
SHA1 2d16d2adbc0bb99181778d8a144d7d66a7e58852
SHA512 243905f686c2bae8efba93a6050aa16285546592409c2c6203a06dbc6fdd252d2f1a2dd429e7d5f7415414189a49dd585b679c5f6e751b308b76e77453b55307
SSDEEP 12288:07xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:07xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T132C42355ADEF8329EA1103BA4592539808567E6FFBD3554A2007B44B377BBA0500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 2a86cac03f95ec7ba7d253f29b1b1f91a8c1271c3741f841233cba0e7e711472
MD5 3c35e2d524e4d70db6220023ccf96348
SHA1 308100fc33c7f72d567e36b8e73245f8c2805242
SHA512 04c461301441ed8fcbaec7cd7a17e4bb7e5980a5719fccece44ec7e64b48b9deb05390ceb6b993f604cb4dfe1ad8ad846e92e489202a02162e952e943e3dd264
SSDEEP 12288:jWxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:jWxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T15FC42315EDEF4379EE2103BA459253940856BE6EFBC3564A2003B48B377BBA4500F8B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 e57ce37f1f0458e48e4efdac1539e01378ec2a3ae52d9266f4d13bf8e32fd819
MD5 13705571209638d2144734d5207097b3
SHA1 8b4d4c0b6519d9ecde0403a5c1a6f4dcbea484d1
SHA512 4497308c9da172abc534cfe5570532560d1d548792a9e0e4f6dd6f3905f584cc24a27a0622792d95e5a1a56da93a851021c82a9803a33dfd50c271434440c556
SSDEEP 12288:+AxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:+AxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T106C42355ADEF8339EA2103BA459353980856BE6FFBD3554A2007B44B337BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 9219d25ad8c2d67bf7f75a9748a240d81276a485a56f3940f7cbfcd238905993
MD5 9b3858a11d180b9848e5bd84eed891cc
SHA1 7532fa4cf1a7740bbfab6b5e54619c4969880319
SHA512 9f491186fee861f9a715401322cf82e20a9b5686a807b0a8b280965693c11bdfd192e7f572f36bf3a65480aac6571985974936ed3d68023489ce71920c363787
SSDEEP 24576:GfwvUk9RX6wkyAIKxHfJaMJWTTXPPC1X9qSH9Y6VyP:uMnYIKxHfJvYrPs9HHC
TLSH
T1BA35D029EBDC44E5E177823C89B3460AF6B178691B31C6CF025A53AE0E37ED45D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3cd79a7d12ec21693225e6142095dc5d26ea05432a20f4a7986ff3f5f1fa8365
MD5 ff48fcb88f51ccae5256344c5ffd8584
SHA1 d9cfedebbc243b1a253b5b8249a0d36d37d1c584
SHA512 c5d71fe8909595f1260d3c69dfbd5734746bcbb1bd7d69723dad9877b9241f4b63c06a6f89009e8a4798b30bfcdc2303143da39618e6035289141ae4014a8927
SSDEEP 49152:JYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HxHfJvYrPs9Hi:EySzP/grExHC
TLSH
T1AE066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f99127c0d97e804e213068b1526355916ef7af38d3716aa9cf354956aa5f7473
MD5 aace54f01b29d95dd970556dd139a469
SHA1 09fefe826babcf816a433edbd8781e2e999bc88c
SHA512 60d74095d299cefc6ddc25b15fb0b9d5beee782093d1bfce8d9f35552509373283963509192617e29335b94cbe424f767d5b55a9d17950040d7f3d7370bba861
SSDEEP 24576:c47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY9xHfJaMJWTTXPPC1X9qSH9Y6VyP:c47JUQjTirIhCnDHUPfF/XxHfJvYrPsI
TLSH
T11D65AE1DA3EC01E5E17A827885154A5AEA71782E5F32CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 4987557f4fcd581d00a8e09210745a8ae40e909ca41d2ec0bc3e7cabc6ee51bf
MD5 b0745e86265173703d2e861d262ae234
SHA1 56d99394c81456f8f4a28aec943a0c7b47fc9fab
SHA512 81853d171627f36e0ac5aeacac84b44930bb68e8a9bc5a29222f5566a9e3b562a66fd46760850286730f370aa615a1fe13c15616903d6bae4df36b3e6a3d96c3
SSDEEP 12288:Wbsf+xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:9+xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T164E4011AD29802E8D42E5279C7964640B3337C2997E2D3CB22C1F47E1F766D09DEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 944KB
SHA256 12c268b307a3b9c8529f81551e9f82d4062c96b3edae0db23a1af7473bb90c24
MD5 13f06e610d78001c37862e5a2fae811e
SHA1 c986e3d183dd57ae8d2cb429f58f6d46731ecfd0
SHA512 cdaeebaf4c68f5cb5ce0cad62d296478e5f522c65c53720fb563c976e23a0ddc43e21009d788f971a2b06b4615c1234b3660147c3fe2e5276edad1fcea504817
SSDEEP 6144:dNsBC2nart8Qd9DeMUAEhd2CotMx4ENnU3ftk/Vof4gQFlTgP04n0IXHNGyjtFiG:d64z+lU3fc43AlTgP04BNgdT/4OjbyL
TLSH
T173250610766BD75FC6A940321E77C1CCAB707D41FE05AB0372C8872FD576668BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 cc79f47474b05d16874c6c69dc82f9ea75af6f7165319996fb415adfedcd168c
MD5 7aec6e8e9e072a899c45099a25dc5998
SHA1 0bba9ea1bd1eb2606e884d06176afc4bec5710bb
SHA512 c5ce97d618e092fd942926377a6a7929604900bca3c52a451ae31536af114f7c144656b0c4d0aee068b983a69505e916e15cd84ace170dcaa3afc8614d8721bb
SSDEEP 6144:x9DgtD8F9D58+rBgU2uSI/w7+0ve26tMxEWqA4kksMTOLiFT2xp26tMxx0VhSrju:xb58+riU257+0vzX7oq4a/hS/WnC4
TLSH
T10855C8816437A3CFD1FA6031076A5B4CAB64EC07B7096F2663C9453DD82AB25A0BD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 75f12bf5d55ebb44193898c3d460721982f3777f650bdd15e5611a9adf0f563c
MD5 72bed9dc2ee9e60f71c93320e9caf2d8
SHA1 7081ff30c12feca8dcc46ea5a637a70a6a923301
SHA512 a21619ec51d2b53d94535b8e3bd910bec2507ec07e01fdb0d2df66f03c16a89d5f41f0ea8c2bf3d461ca88906c983e3b622484940857f05a874f02124aba1870
SSDEEP 12288:kF7GxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:4GxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T149D42312EAEE8725FD3103B505979224141BBD6DAF8395CB3002B48B3677BE09D1E9B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 26b2a013df67fdc621ff0a897d90299ee114bdefc1af9e3bcd0c6e857e6c268c
MD5 64dd6e0375916c53105b2e3446231635
SHA1 55ace2850cc1bd540377c8c537d0ec301963d659
SHA512 ad6511322ddce9b42001af7b8f3462dd0ceb8791f18aa6133b7006d4e5aa66fa0b5024d679e1480401de695375cdb80af102a3d00ae0f6d1c497f81c6d0a05fb
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYcxHfJaMJWTTXPPC1X9qSH9Y6VyP:ngb4mBIBhGF9xHfJvYrPs9HHC
TLSH
T17165AE1E22EC02F5E0F6D2B8CDAA4417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 fb24b3d4e0c4331589c405b02a389e9e8ade409263b116553c888dbbc1c90286
MD5 08ffd1fd7a6ac8f89e55bbe2ae59df64
SHA1 6c72a108e7984e28d2058df77e9fc2215d365f06
SHA512 5fad058797d93c859fdcdec2f39377660a56af51db3ca43ec22cd53c33ce223784bbb2ac456c0d7c88d62eebcac12aa56f2baa7410ab8fdefbb8b892a1b1d760
SSDEEP 24576:jG88u8FpJqH1bzria7/mtxHfJaMJWTTXPPC1X9qSH9Y6VyP:S7ZFPqVea7/ExHfJvYrPs9HHC
TLSH
T16D35F16576E102F0D477D13889824663F6B2B8251365EFDF06A88A461F33BE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9507becc81d85c8fcc4a787971465ea09bf23674441a4b72040cd8a6a3a1a6db
MD5 d5e5b7a797957b1847e36b4876518c4c
SHA1 09e75cb331c8504195937809f10e65b93ffcabd3
SHA512 c634f463c7ef81417310de6cf492d1c059d1f47c39a0083157cac469ca31b05f8f548d4545b499d11cf2619dcb9f6659c5b276d3d0c00ca6f38542970eb94bf5
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxxHfJvYrPs9HHC:mG05lO43bygrExHC
TLSH
T16AD5BF6A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1c09beb9195f649a53121520557def42669cb2f868c6d5beae4ee50765da8a22
MD5 354d00f395336d6a9520c679d2e6fac8
SHA1 2c7b12dfa342283009bd66abea64787c29cc6c4f
SHA512 d828ff8c791bc9ea0f663758265d133a7e56b31b87b83120e7360915e3e7603ab545b413568b42e56e613e712c6a5741ac16f4a932cd372bc056110715a796d1
SSDEEP 24576:rfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnHxHfJaMJWTTXPPC1X9qSH9Y6VyP:za5POZ3BJt2pasx2+mJxHfJvYrPs9HHC
TLSH
T12F65BF5EA6FC01D5D579D17DC583861AE5B1342253329BCB022182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 45fa731836ce9d27daa35b32ca409a940365702ca054452b66bce80bd68f8171
MD5 d09c626c60f6bb71940ce31c9b888eac
SHA1 a6f983c2e86eef9f4812499b97e82438d3b193d6
SHA512 f1f72100581136f9c489dcbaa0e7cb847a23bb74bd302a400ff92eb05e90bf936ddbc61a948a184a866ad1ec38f159dad497e4dc7406d295ee5c0fcc2877c407
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FklxHfJaMJWTTXPPC1X9qSH9Y6VyP:ENc/zEOVHFkxHfJvYrPs9HHC
TLSH
T11C857B1623E901E4F5BBE1BE89679546FA71786953308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e953e2c04de5343591f63913ee0324c4c794acce3d56924b07c3fdddc0bf1f2e
MD5 e763c3fc2957374b9a64f0859b72b8a5
SHA1 89fb951f1f6d50f9fa91382f4df5b5d1ee9abfff
SHA512 79fa265507b567eb53bfdfa927748f0379eca728046a067907b2e01b4a9798bb10b604afc90b7f4cd26d7c43f15d99d68aee16840f3c9be96417194508217209
SSDEEP 24576:aTkNvNnaFeYhJNtmZBmTxHfJaMJWTTXPPC1X9qSH9Y6VyP:aTMwBtOmTxHfJvYrPs9HHC
TLSH
T1CB55AF2EBAF846E4D1FAC6B5CD238512E6727461173253CB5290C13F1E279D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 77b45f4960e0a4144d349b8e695dc84548cdd437ba2a07d9bddac73bdebed1bc
MD5 572dcaa2347f95610c83031f17c5846c
SHA1 360c3c39a071b724edf34acb7c88e419adfb39b4
SHA512 96ccad151f4156cacd2ac4364853f399e7945dddf16a0ae4346ca996f1a1ab4e6c1499d8c2a8cff3a3294291783155b9906cf64363d1bf7a8f70b2d4208268c7
SSDEEP 24576:UPUr+NQBxHfJaMJWTTXPPC1X9qSH9Y6VyP:UJQBxHfJvYrPs9HHC
TLSH
T15C05F11F66ED18E5E636917D85824309E772B862171292CF0291817F1F77EE8BC3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 139979ed898dc6716e6b966d8d0c923c86cadcc92c746e0ac6016146c11c45d8
MD5 43dbf3cfdb1a93253fecc460ce25e3ac
SHA1 cebd4262b119755877dd4a359f5702bbca8c6bf2
SHA512 ab97a91dc6516e6dbcf97d21406986fd88b14b0ce599a1c6d39522b162967ee100d9845b503c9a7debc52d2afef54b43d99a4af1bce6ccf7543f230f92486900
SSDEEP 24576:MD3FHshBIYQgACxHfJaMJWTTXPPC1X9qSH9Y6VyP:MDVHeBIAACxHfJvYrPs9HHC
TLSH
T18725E13DEA9D04E4E57AC2BCC6538606E67138AD032256CB0194D1BA1F7BEE46D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/408-124-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/408-264-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/408-118-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1552-294-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1552-263-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1552-106-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1552-112-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1552-292-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2644-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2644-262-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2644-102-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2644-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2644-342-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2644-344-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2724-269-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2724-65-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2724-71-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3316-260-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3316-82-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3316-76-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3464-8-0x0000000140000000-0x0000000140232000-memory.dmp

Download

memory/3464-328-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3464-259-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3464-258-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3464-45-0x000000001C480000-0x000000001C488000-memory.dmp

Download

memory/3464-44-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3464-55-0x0000000020E30000-0x0000000020E6E000-memory.dmp

Download

memory/3464-56-0x000000001C4A0000-0x000000001C4AE000-memory.dmp

Download

memory/3464-15-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3464-267-0x000000001B2B0000-0x000000001B2C0000-memory.dmp

Download

memory/3464-161-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3464-331-0x000000001B2B0000-0x000000001B2C0000-memory.dmp

Download

memory/3464-23-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3464-27-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3464-12-0x00007FFDAF6AF000-0x00007FFDAF6B0000-memory.dmp

Download

memory/3464-42-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3464-327-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3464-29-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3464-30-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3464-31-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3464-32-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3464-9-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/3464-11-0x000000001B230000-0x000000001B266000-memory.dmp

Download

memory/3464-326-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3464-0-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/3464-325-0x0000000140000000-0x0000000140232000-memory.dmp

Download

memory/3620-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3620-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3620-268-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3852-86-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/3852-91-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/3852-261-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4652-63-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4652-53-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4652-61-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4652-48-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/5340-24-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5340-266-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5340-18-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5852-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5852-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5852-330-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5852-265-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6072-129-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6072-141-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6072-135-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6072-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download