8e431568b8a843ceb2cdfc2b2a65311b2288610efdeb55c7c2be0f722a17a1ad

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_edcee4d1a09b3ffbcc802915ee3310cd_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Size 1.5MB
Sample260723-fa1ecsgc73
SHA256 8e431568b8a843ceb2cdfc2b2a65311b2288610efdeb55c7c2be0f722a17a1ad
MD5 edcee4d1a09b3ffbcc802915ee3310cd
SHA1 9b54e717744ff94550a6e34af9dcf91d06fb394c
SHA512 4b1ec6423ffa29488696915e6af2479809dc46eb3e5d12556d6eec0d8d55959a7ea9ba60904c7483dd5fba6716c87e70a4685cf4feb129c52f5df26bd7accbb8
SSDEEP 24576:vwjRqvdwIwpe5atr0zAiX90z/F0jsFB3SQkd:yBpe5aB0zj0yjoB2
TLSH
T18275F106F69A00F6E5A782388A424506FA727C6657A1A6CF33E07E873F237D05E3D751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5904	elevation_service.exe
6036	elevation_service.exe
824	maintenanceservice.exe
4128	OSE.EXE
780	PerceptionSimulationService.exe
3456	perfhost.exe
4828	ReFsDedupSvc.exe
6116	SensorDataService.exe
4600	ssh-agent.exe
3860	AgentService.exe
4416	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_edcee4d1a09b3ffbcc802915ee3310cd_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2c5196d209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_edcee4d1a09b3ffbcc802915ee3310cd_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_edcee4d1a09b3ffbcc802915ee3310cd_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_edcee4d1a09b3ffbcc802915ee3310cd_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_edcee4d1a09b3ffbcc802915ee3310cd_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087b4377d5d1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061c4d2bf5d1add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8cbdbbf5d1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ef4597d5d1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000157c4e7e5d1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079dc7e7d5d1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a8b317e5d1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fdfbdebf5d1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d7c4c17d5d1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5904	elevation_service.exe
5904	elevation_service.exe
5904	elevation_service.exe
5904	elevation_service.exe
5904	elevation_service.exe
5904	elevation_service.exe
5904	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4384	2026-07-23_edcee4d1a09b3ffbcc802915ee3310cd_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	5904	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3860	AgentService.exe
Token: SeBackupPrivilege	4828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4828	ReFsDedupSvc.exe
Token: 33	4416	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	5904	elevation_service.exe
Token: SeDebugPrivilege	6036	elevation_service.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	3684	firefox.exe
Token: SeDebugPrivilege	3684	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe
3684	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3684	firefox.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 4668	4384	2026-07-23_edcee4d1a09b3ffbcc802915ee3310cd_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe	88
PID 4668 wrote to memory of 3684	4668	firefox.exe	89
PID 4668 wrote to memory of 3684	4668	firefox.exe	89
PID 3684 wrote to memory of 3316	3684	firefox.exe	92
PID 3684 wrote to memory of 3316	3684	firefox.exe	92
PID 3684 wrote to memory of 3316	3684	firefox.exe	92
PID 3684 wrote to memory of 4444	3684	firefox.exe	100
PID 3684 wrote to memory of 4444	3684	firefox.exe	100
PID 3684 wrote to memory of 4444	3684	firefox.exe	100
PID 3684 wrote to memory of 4444	3684	firefox.exe	100
PID 3684 wrote to memory of 4024	3684	firefox.exe	103
PID 3684 wrote to memory of 4024	3684	firefox.exe	103
PID 3684 wrote to memory of 4024	3684	firefox.exe	103
PID 3684 wrote to memory of 4024	3684	firefox.exe	103
PID 3684 wrote to memory of 3116	3684	firefox.exe	104
PID 3684 wrote to memory of 3116	3684	firefox.exe	104
PID 3684 wrote to memory of 3116	3684	firefox.exe	104
PID 4416 wrote to memory of 4280	4416	SearchIndexer.exe	105
PID 3684 wrote to memory of 932	3684	firefox.exe	106
PID 3684 wrote to memory of 932	3684	firefox.exe	106
PID 3684 wrote to memory of 932	3684	firefox.exe	106
PID 3684 wrote to memory of 932	3684	firefox.exe	106
PID 3684 wrote to memory of 2284	3684	firefox.exe	107
PID 3684 wrote to memory of 2284	3684	firefox.exe	107
PID 3684 wrote to memory of 2284	3684	firefox.exe	107
PID 3684 wrote to memory of 2284	3684	firefox.exe	107
PID 3684 wrote to memory of 748	3684	firefox.exe	108
PID 3684 wrote to memory of 748	3684	firefox.exe	108
PID 3684 wrote to memory of 748	3684	firefox.exe	108
PID 3684 wrote to memory of 748	3684	firefox.exe	108
PID 3684 wrote to memory of 5144	3684	firefox.exe	109
PID 3684 wrote to memory of 5144	3684	firefox.exe	109
PID 3684 wrote to memory of 5144	3684	firefox.exe	109
PID 3684 wrote to memory of 5144	3684	firefox.exe	109
PID 3684 wrote to memory of 6156	3684	firefox.exe	110
PID 3684 wrote to memory of 6156	3684	firefox.exe	110
PID 3684 wrote to memory of 6156	3684	firefox.exe	110
PID 3684 wrote to memory of 6156	3684	firefox.exe	110
PID 4416 wrote to memory of 3840	4416	SearchIndexer.exe	111
PID 4416 wrote to memory of 5748	4416	SearchIndexer.exe	112
PID 4416 wrote to memory of 768	4416	SearchIndexer.exe	113
PID 4416 wrote to memory of 6336	4416	SearchIndexer.exe	115
PID 4416 wrote to memory of 7016	4416	SearchIndexer.exe	116
PID 4416 wrote to memory of 6380	4416	SearchIndexer.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-23_edcee4d1a09b3ffbcc802915ee3310cd_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_edcee4d1a09b3ffbcc802915ee3310cd_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3684
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27019 -prefMapHandle 1972 -prefMapSize 270249 -ipcHandle 2060 -initialChannelId {4093f735-3fff-4f15-92f9-b86607039788} -parentPid 3684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3684" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:3316
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27055 -prefMapHandle 2424 -prefMapSize 270249 -ipcHandle 2440 -initialChannelId {a29f3e5c-6d54-40bb-a179-bea9257fa5b3} -parentPid 3684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3684" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:4444
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2972 -prefsLen 27196 -prefMapHandle 2964 -prefMapSize 270249 -jsInitHandle 2968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2960 -initialChannelId {eca3add5-0dd3-420c-ae1c-494be5c91e70} -parentPid 3684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3684" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:4024
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3832 -prefsLen 27196 -prefMapHandle 3836 -prefMapSize 270249 -ipcHandle 3844 -initialChannelId {e61b3531-b6cb-4b05-9b83-7ffbab44d38f} -parentPid 3684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3684" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:3116
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4400 -prefsLen 34695 -prefMapHandle 4404 -prefMapSize 270249 -jsInitHandle 4408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4416 -initialChannelId {b95f3c1a-a14d-4154-9ae0-3697ee0fe88c} -parentPid 3684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3684" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:932
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4944 -prefsLen 34851 -prefMapHandle 4948 -prefMapSize 270249 -ipcHandle 4900 -initialChannelId {6a72814d-e18b-43fd-8c82-790cd4f7ccf5} -parentPid 3684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3684" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:2284
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4968 -prefsLen 32757 -prefMapHandle 4972 -prefMapSize 270249 -jsInitHandle 4976 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5044 -initialChannelId {e220f4a4-4318-4f45-8d6e-6c007e4c7164} -parentPid 3684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3684" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:748
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4968 -prefsLen 32757 -prefMapHandle 4900 -prefMapSize 270249 -jsInitHandle 4948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5280 -initialChannelId {1953c283-33d6-4889-984e-454b2c705fca} -parentPid 3684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3684" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5144
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5644 -prefsLen 32809 -prefMapHandle 5648 -prefMapSize 270249 -jsInitHandle 5652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5676 -initialChannelId {18f60c97-77ef-4b03-8a58-f1cedbd5e1ed} -parentPid 3684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3684" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:6156

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6036

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:824

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4128

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:780

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3456

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6116

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4600

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3860

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4280
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2708 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5748
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:768
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6336
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2708 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:7016
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 773954ac14e06419b0a630f89cd91a4a4e1abec2d823b21c33e5da8851acda1b
MD5 8da980c05343771deece9b3ba7361dd1
SHA1 223caf0c1e014a654f154f9db3e93bfd6e571b13
SHA512 c3c66cf8818dd26908b8202838e8863b7d2535036d6f0d9cc9e0c88ce9cee503dc1d0a36d273d7b5344fba674c8af665a9edf5a3d0b0cace2fe1408036448f67
SSDEEP 49152:2b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnkaB0zj0yjoB2:o3q6HjBwB2Yyjl
TLSH
T168D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 031ef5278310b396941cf8953fb28b7996b93f92d2e787d8d23f0e88c5510146
MD5 92943490b915ab62c7628a4e3cc0a07b
SHA1 85a098774d338fdafd68e5d83edbaf83e343d91d
SHA512 77858d709805be780129e20f4018e2e811fd0c9f00f814e226d01b3a031010978f5e715407aeeb424dbcf64e3505744567bcc509dd7c43f0326e1816dc86f774
SSDEEP 24576:GXYfDtczANatr0zAiX90z/F0jsFB3SQkN:ltcaaB0zj0yjoB2
TLSH
T15F65022977D504F9DC67823DC9A18506EA73785147A0E7CB03E4AA2A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 8e578e52abd33da3f44cbeb57b5e85c486b857e6a2e9096f53ecb4d0dd7a53f1
MD5 086a1f05abccfe6aa2d28b641c04914a
SHA1 b771bfa52ac3af62e5c418de6cfbef0107bba68d
SHA512 c3a762f35d71ba50c2a76f6077d6802c3cc85c03d37b514e5834eb057caf6ac9a3962debb1a3c8f3ce4668caaccabaabc73122b88b9a5b8ffc6b94677317e784
SSDEEP 24576:g0Le5ji0hmxirMCatr0zAiX90z/F0jsFB3SQkz:gPji0AcJaB0zj0yjoB2
TLSH
T1EB859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6786b4b731b9cb29cb9b234671ebb26c9379e0171ece1d7d47033fcabdf5edc5
MD5 dec55fd3f641cf7078eb2bfef538486d
SHA1 544831209d7772458671f950ba3f5738c49a032b
SHA512 e0f38432c2caa1c9f01329f8386e60234d5416345db4de42f7de8775fc7f22de88acd079fd62adace61be5e7fa8fb0c82e4bde8b101122b8e7df4699bb46d1c5
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWE6q8wyuYatr0zAiX90z/F0jsFB3SQks:C/ezSC6vUzPvxHjyFaB0zj0yjoB2
TLSH
T139755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e94203b295cdb0498af8a2c286c76a899095d2caa2e3cf7f1b30d2be8f1f490a
MD5 856cfa2444b2dc2a5d93268a0b3ae9f8
SHA1 c02db9c6819df025ef46ef50082da8d4c11bbcba
SHA512 533106d11493e2862a1a225a013d221709924bd63bc89892ef0c0f673da2994e37f14b7a19cc9da38c3832c7f08ef16dd667d9d994b8671e790c1310ab987a91
SSDEEP 24576:eVbqPb88hv/l+6Tatr0zAiX90z/F0jsFB3SQkn:eVO88hXl+eaB0zj0yjoB2
TLSH
T1F755AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9d4a45bce68ad7073e9c97d165f7dd77be2bd4b87d55ed0352fcad29fbae7164
MD5 14d12aa8e3d7401d3ea0224d3d36e338
SHA1 a7e14947c9ff66b618f84e5bf2a49efae98629b0
SHA512 a92e89d523a910cbea5154b7a727dcab88fb720fcede35c78640fbd45af7a1ffcf6d541480d8ac5e42937cbdfc88cd64d3718b6d8ef58bc48df994034631f8f8
SSDEEP 12288:tRcccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8U:tR2atr0zAiX90z/F0jsFB3SQk/
TLSH
T1CF45230B340E80F2CDC32B3526989C4B1AB99EB065E2AF45E2917F4FDD3C1C695666C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9a696f88b3616704e48e194f024533876886d29d06b91411c3e11b1849439079
MD5 75d9ad4d91812952e97b777bb8b56d82
SHA1 27650366751581d1ad26c877bbf43422caca6957
SHA512 656e8c6ea417a8fe9d8b27b46347ca1334812ee680ddda8ad96c341cd8b4a648dbd4e58cb21bc1a3a99f5ae3ef5933d8588edf5542b793b1ac2c9fd27bed1ed6
SSDEEP 12288:AeBNUbTVO86UbccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8m:AJIUbatr0zAiX90z/F0jsFB3SQkr
TLSH
T11965CF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2acccff768efbc005e3cefc344e47493312df5a1f27e2ec0a4474f9f11297c67
MD5 549be8197e4caa787b882991e750f3f3
SHA1 bd0c771efae803a30d78fd2058699183c7692e3d
SHA512 07437e989c0e3d9b82ed77822fb024de7d4fd25b4ccd0f7b7c28d016ef1badb8da86cd20897d202e6461759028b10761f1723d2e6845ca57b310257ef51afe2b
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:UQvGAdlCEL8c/yRNw5CHB2Yyjl
TLSH
T135267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 bd0c6ffd05c796d2d5131443da0236e2aeda7b461e40505e879ce35e5c63788d
MD5 194bfac7cf1998b0d2d401d67336935b
SHA1 cd063849d10292c087e91b0e9811c972dee4623b
SHA512 4839bac491823ef28beb1c7ac49862394476b57bf17480efc4702fe68ebbdc38a13fbf3f27d919bd54c19d604e98599b60b5f334ea857025af4f8d0ee2db5d71
SSDEEP 12288:YAwSfxL/2Dc34DLLmt0LDQewsAj5ccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZQ:9dewsAj5atr0zAiX90z/F0jsFB3SQkB
TLSH
T18C75E031FE75D032C6BB0DB61B25C706147D7A204BA21AC3E3E89E8E59342D22776E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5dfdb9e007e1172369eb9ca29e7521fdfab3d9c6073417ef6667fe003cc85090
MD5 0eb71982de5f3eb68fafa26659a6a9cb
SHA1 bfe6ce8d9b15445fdbfa490eab266f2b5529ea16
SHA512 29e411c70e47d2b6d0c3bdfe28030d1f84408e8fc1aa4f9055a07836870c70878711fb9ae391230bcb09a94f6c19fbe5c07b59d2701a75877349b4447694b921
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH4Z:8UEtQevvqc2W1cpV2EI32S
TLSH
T1FF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5c50bcf6c4f1f61e5127eaba1cec724b1af41ce7b39d0554c0eb279d8059978c
MD5 12bf3cf7f58727d54048097b365b499f
SHA1 71673fb99fcb9e65591b1a96ee027cf4dddc27fb
SHA512 0f052cff5de9a1a7c9b417d9c5a238850a3a963d774374a0ff53b6cad97198e55f40a0c6461c46ef091d26f2020aba905bd4acff9b4fdef5fbd378af34bd340c
SSDEEP 49152:JCbRquA/m2yL5zQfFiV+XenmE3/zZaB0zj0yjoB2:GoqtVjnmbB2Yyjl
TLSH
T1BDD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 506ddf2fb807654e52f6eceb073213fc48687184602016d5bb881a2531d99230
MD5 e6f0979d12a3b0f0d2c3e8c2684cd431
SHA1 ecb0d027bbc0f0f625780a752f754558ba9e5731
SHA512 ec167607a7feeed7c89bf4028ae4ba673aceafcbd96bc423b27b235fec965674aa6ba64d22173dd532d8e718e309464af68d7e3da2c12ec84579efa21ea5ffab
SSDEEP 24576:yAhGLJIFoiwtA5l7S53Eatr0zAiX90z/F0jsFB3SQkc:yAMyFoiq5UaB0zj0yjoB2
TLSH
T14B359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 72f47075f28d18fa7f719c7e2e4626cdfc30b752f6674bc6e892b03c27eecef0
MD5 79195ec2af60f56d7970aa5e15d43e72
SHA1 7cdd6e6bbbb04f2b56a732ad9949374e521b3826
SHA512 0583e282c0f5f69fef9fcc7424f041bce353f1852d8a6f92beb325e643b9e80b03714070248f1ffb47013d242223bc09c88683934453db17111613a66b63df1b
SSDEEP 12288:Tmw5HEjsChNVBFgl0WDm+C2ccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRikd:ywuoOWlatr0zAiX90z/F0jsFB3SQkd
TLSH
T1C565F14A32A90CF9E9A342388597C536F7F2BC112A61DB1F1360CA5B5F37251AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 630faf74cbba12b38dd67007318149a39cbbd81a65e31526a454c4ca17f20819
MD5 6252f718a3e4ec09a4607ba7e8cfbd8d
SHA1 78c6f850687d915ff8442f3f079b0afa381f17e2
SHA512 d8ea8ec203b606dd7f6c3e2d08276a26a8c4b9a4f25d78fb361575ab61915f16b7638e490e543b192fa3ac559dff72c442d1d5bf2fa4110fe58eb46783c0fa96
SSDEEP 12288:OBZ1IypccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8G:IZuKatr0zAiX90z/F0jsFB3SQkf
TLSH
T11B55124B32A960F6D5D3523C89E48906D7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2c9192d2140036b6c20f239766a0b1ee40f4ab75ecd0901eb7af72eda96604ea
MD5 a178906514a95f8a7fe0115d5774a650
SHA1 3fe3a03e06ea100a1c9baceee04fc336325ff0d6
SHA512 43c0e6cb094021998e936b296344644557bb082e7d73660087313f36a2a260230fdab7d21976a1cdb91ca1d2de56a4d9a715610a30f48cf9f81992177dfbe71e
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:/QRQyi36YOcPQLvw2gAf+PN3aB2Yyjl
TLSH
T1B9667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5d7ed74e3c7277c07b432a7a4093a8012a71e5668017879d41a4813c847f0fd8
MD5 9b62147d6ee348316f5222d38e53577c
SHA1 deeea0e1967cac9fb09d546c9b06ad15f8ce5def
SHA512 fdda031bb4a045caad27a53b1a3483713df44ea118ebf11e8c929b66c9c9bc6485e360a8402b8f9df23fc036c736ef33a558f5789c1ce855c9f5faad6e856ff6
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:vQRQyi36YOcPQLvw2gAf+PN3aB2Yyjl
TLSH
T1A1667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 59352e5e96c90985369d7d4eb140794732254c469417230e05463df52e26fb50
MD5 f1c72db168994e9be4ece2d6f8c1cd1a
SHA1 94e2882ecbb00314127b1b74627786eace5dc48b
SHA512 6354a80d9393fab5aacffe3523a086af110792258637e85cc44cba2a55cbf56354d4dc24e5b7f04300acb0ae6f815d179841d3cced5150d6cfc5aaf7f8d014a5
SSDEEP 24576:KwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0aatr0zAiX90z/Fs:k68Qg55nhheWu7PNU3/JaB0zj0yjoB2
TLSH
T131B55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 eaa7178193510935a8b1dfe2735d300d061fbc506388c3a33094d97ecaf83fdf
MD5 fe200c308d206193e57fa7579faa9fd8
SHA1 c3d6332f6f159c5ba0baebeedccd81705a55562b
SHA512 fd859b7cc110df9fcabf93edcf1080ce612086383dc6b52909e3a703fd40e7ff8269062aa2a33905fb52e2c396679de3aa8768ed6243eb67b601cc6f5556ded2
SSDEEP 49152:m3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99P:3y5112gYy5azzVvL69nLKnhZBB2Yyjl
TLSH
T1C7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 557a4900ac7b9a453ac1b9738891d54004f2cca4c34acfbed48665848a59b11e
MD5 01bd920493e4b50c48a91d89be8c809c
SHA1 fc572ebe86a96c979325cf24e3bbe522493ac96e
SHA512 7bc6ded39c5aa00e438f283c81d91c4567d0cb619904e8d47aa841d9c71652e36422dcc46a4b8fe9910ccc68c15423e6a285c6dac1ec082ac3b8150c0bcacbbb
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gldaB0zj0yjoB2:Ru6JmVxd2dMB2Yyjl
TLSH
T1D2D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b29b0ee1aa88aab13a2010b9f056c99dc269a9a5c7b130a8ca56e45d92082fe6
MD5 c27ca9738ddd353b5f815c88a5de2226
SHA1 9c9af15e0b6eeba4f293e7100506a3a3a5308084
SHA512 aa0520e79ff9973d375ea4f27dd6f9cee22d53879232a01adc6212fb04f359f9c9ff613635ae943558efe6c809045a680a9f67d165bf48d9e1096d49bc6e5775
SSDEEP 49152:z1hpsNoJpF1A6UU44CwH7R4x7aB0zj0yjoB2:zmifPbRbB2Yyjl
TLSH
T12EB5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bd075851601316da61fd0c920a99514ae7e1ac734c57ed55fab5a16b44fd8ec8
MD5 30819ac14c8d297b42beb82fe86e221e
SHA1 a4901d7d25696319d2bd970ff6bff298dc8a7487
SHA512 5304a0f8548fe958cbb065982dac146ac4e27a67c8963aa79dedf70c4369db4102030300e5dab9cf7cf53c09b322c0af080fd5f345683cec06815a66d0ceb50b
SSDEEP 49152:zSuZQIY0Be2KRRVtOnks6NMHqKaB0zj0yjoB2:x5dKTi61NB2Yyjl
TLSH
T190C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9da59b74ebd9727bb31c87e02c33c4091a9d8ee97ded3beb0601af71b502c635
MD5 753300e64a517114b6ffa90ec49ab152
SHA1 c1680e0791c70f5986290f876bb50a6a3b7af3ab
SHA512 e11898a29f41acb2de0f6c728dd4aa618aaf7aaa803cf18b16b8d5c02b02b36b36351ae335621ea223a4e299c0878c143efc7d0ffbf9293a486c49202bf7fdd5
SSDEEP 49152:chtSn8EApI0figngiDn0AP5wfaB0zj0yjoB2:dX2iyphfB2Yyjl
TLSH
T19E95BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2a15f5770a43e220060396866186fd610d34883ad8f74b88354f26ea2188ddff
MD5 0370438efc5dc379d52da7f0f5f9db76
SHA1 a31aa4315c7fba4e1ca3ec5dcf0731d43da77810
SHA512 7bbf62e83a9421f7c927e2fac14e2df0e60faa00ac5470f2de03d744de530fc77aca878af8a2696b986cda47f9eceab5405840cd36e0c70f17342864aa9d7409
SSDEEP 12288:+EccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8a:+eatr0zAiX90z/F0jsFB3SQkf
TLSH
T14E45230B341F81F3C8831B355684984B1AB95EB4B2E36B85B2963F0FDE382C715656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5061aff70f3edf686cf4f3865f160ae8d66a26f4b6d3e35fb8d587d0e21c7953
MD5 4b96519630bfb05ec7a88dab0c9a20b0
SHA1 a22eb9095790a85b198959f77e698c7e4bd8b044
SHA512 faddaf4111da64843268417bff7e58f6182431eacfa1a268cb046e1788525ca5a33ebea28345d428e3a823ef01e6773705ae81f5baa4c43fe0e7a7b763dd29f3
SSDEEP 12288:FVccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8a:F9atr0zAiX90z/F0jsFB3SQkf
TLSH
T1A545230B381F80F3C8831B355684988B1AB95EB472E36B85B2957F0FDE382C71565AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 77db9f234e1f0b048c9b4d1aee7d4750518be550c723ddc8a7964df15f8599e1
MD5 a36437213013f7376cb5d365d0a67cba
SHA1 536ff2c8cdac358c68e25642a6c7d5eb8db5ae14
SHA512 b4f1107279a23d759fd565190634414af25095046e0049921e436a0ca77495ba048018de559df5f482f7a4abec5b0a0bfdf15299dcca450ac78a2a394500d80b
SSDEEP 12288:tjccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8H:tjatr0zAiX90z/F0jsFB3SQkC
TLSH
T15D45230B381F80F3C8C31B355284988B5AB95EB476D36B85F2D63E0FDE382C616656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 2efdcbe9fb72392be70ef2b9da6e9f16f332416dd71a81f05624382744a667bc
MD5 a51f3000d04e384b1b6eb469af88f5c9
SHA1 2abc06d52632e919cbde9fef17322c864ee9f04d
SHA512 ddd7ea31ab2c6d162e06877f1466298480a1d558abd792e527de7e071aae382f335177409e2cffd2ef396b7d00ba04c2599882be4735a825bf58903ad0baad04
SSDEEP 12288:OVKccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8A:Zatr0zAiX90z/F0jsFB3SQkp
TLSH
T1E145230B351F40F2C89397358694884696B9BDB4A3F3AB9FA2413E0F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4e23816ce2d048911186754185166c5f86814489ea98a523194a4668e2c489bc
MD5 f4044b2e0a48a1439cff37fc0ddbe8b7
SHA1 3aa4eb3e4a49aacecf6d809ccaad10e06604b3d9
SHA512 0978731b93e849395a2e8d899c3715cad6402294d17864fa2c6a058611bbad7dd59af4d5ed6df73afe3f9868a6a2d97ae8b31919f27a5536565872210533734c
SSDEEP 12288:BiccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik87:Bcatr0zAiX90z/F0jsFB3SQk2
TLSH
T13945230B341F80F3C8831B355644988B1AB95EB472D36B89F2D63F0FDE382C616656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7cf1ee7c94b0d6580faa9f337eff647c8f56f49d3b33ee3ef735804bbbdeb232
MD5 0170058137e042b38127a9bce84fa13e
SHA1 5c2e981394bdbd5a73178b4efaa5b816e36cd8f1
SHA512 16fdb0df9fdd8d1da16dc8ac14907e175eddbf9f66cf7b68372b8ff1c78e67b78ba2cf2387b232b69933c81c49b82702e4f3ffeb885e154d0445624deb0e2882
SSDEEP 12288:BBccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik87:BBatr0zAiX90z/F0jsFB3SQk2
TLSH
T17E45230B341F80F3C8831B355684988B1A795FB472E36B89B2957F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f22e2286feb1430ba4abb1ee973dd4fce2917440871cc169280c9d3a0a220590
MD5 efcfd5100b2af191ca859f11b7268950
SHA1 4d6c0710587abc7f15cc75e1a06c2771e3aa0738
SHA512 575f113dda886299105278e57d3fa970e688b74257cbb45b17fee011d02b2595bcb804c6c195c0558983e24a9043be0ad29b11c0e801705858107a40a9975067
SSDEEP 12288:CNccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8X:C1atr0zAiX90z/F0jsFB3SQkO
TLSH
T12645230B341F41F3C88317355644984B1AB95EB472E3AB85F2957F0FEE382C72525AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 65dae66cc704d131628644c06d82f49db1ad8dc43057293f83eeead521f56541
MD5 4edca2d29b17caf7811d2c98ec4ff0a1
SHA1 3de13ad7e2551c0ba9af259484ab2f06bf7ef220
SHA512 de3350e70fdef1bf399e65d7bf1334ef277e4468a87f5779a350a48c4f9ed771eb1f83233e294e164eed6dbd07e824f9db50f005b6bf240b0fded3e4aa63ebd2
SSDEEP 24576:kZMSzFVSOdatr0zAiX90z/F0jsFB3SQkX:kZMSzfxaB0zj0yjoB2
TLSH
T12765019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2fba98b9221d01854f2fa08de8d4467a7656510f547a907efb0b6b7a8e3f5f79
MD5 0c00dfca530ea6a49b64ade571ec763c
SHA1 23d4b2de15927e9930a31e91515c3bad408bd523
SHA512 e81036ee0854f24f6ca65874c90fd7aa3f23d7454a8f965bcb6a7837e23f8dc477299620ea31bfd4e7082478b1b6dd31af87b43d9c655e2e612cb1bb05a5f6e2
SSDEEP 12288:4YccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8b:46atr0zAiX90z/F0jsFB3SQkS
TLSH
T1DB45230B341F80F3C8831B355684988B5AB95EB472D3AB85F2963F0FDE382C716656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 567ca3e870369a34c9329f4c0b98ece5f0642af001714bc1cafdf1abb78bc85a
MD5 c3678154da3de404729775571ffd675c
SHA1 d80f1f6b19c6b79557ca29006191f4e86186106e
SHA512 801eac7c6d956b10af80a24781827f5a03c0233b1a54ba6243951efafa2b614dfbd98b6ad7d291b38b45c37115868b0bfa489256d2a679587032324919b370b0
SSDEEP 12288:9MccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8X:9matr0zAiX90z/F0jsFB3SQkC
TLSH
T1A845230B341F80F2C8831B355684984B1A795FB4B2D3AB85F2967F0FEE382C715656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 19cab9b8871da6b4520234286c4171e903e4bea915dbf52be8e4f248383bb88f
MD5 9f6cf781e83741e71ff9de0fd4f64c23
SHA1 ddfa59c38d3617defea317dd664191cc8bb43272
SHA512 904569c8dfb662ab4c241258fe8df4440e16124d1bdf7224c17ee2c6b6f93f912aa0fa0483b0574d79fed25e5152dd06833d4a1fc2775b513397ed40fdd36a48
SSDEEP 12288:/yPz5L8pccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:yzypatr0zAiX90z/F0jsFB3SQkQ
TLSH
T159551207326620F9C4639238C9911906F775B83117A19FAF53A02B7B6F372D15E3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0e527e92297144b8201c6dd1a00db1a162cd37601904b136ce6bd57e84e8da73
MD5 2c2fad7aa76eafc041f724126e014cf8
SHA1 1162c3cdbbc8ece79c44ac8ba6934cdfc4812935
SHA512 9a3da7c10f1587ccd69d042a94245726853c6cceb7e5000bc88ae0140dba3e67bfa70f77b8c0a6ebfc3716b230215dad54e00bafbaccd8380d90fd00f100d99e
SSDEEP 12288:FYccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8U:F6atr0zAiX90z/F0jsFB3SQkt
TLSH
T1F345230B341F80F2C8C31B355684988B5AB95EB472D36B85F2963F0FDE382C715656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ef18ac3dc2b136ae50c348c5908415b44b41b7d2b19ee2cb708f1a265252c5ba
MD5 bf62370cb59c52e928adbec2d80c30c6
SHA1 82b289dd5f01e7ea1d09ec648abc6095c3e76322
SHA512 68b5d00a47b74af90d78fe600180cc3c35d83b33b022d6aa9a5920ccb9f2837fdca2ff5f2c1f82dade28b1e4d961ccb74c400059cd42e29750df1d125e282971
SSDEEP 12288:nYccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8U:n6atr0zAiX90z/F0jsFB3SQkt
TLSH
T1C145230B341F40F3C8831B355644988B5AB95EB472E3AB85F2963F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 aa8a686e0c9fed49213f0a089a514eadc6958131c36ab2f2d86acad6bd5396ab
MD5 7996608caa49baf25d6cec5a3139903a
SHA1 903144571b5da1b3cb4579d8753b0e5a863021df
SHA512 ab39b34ac17f1f10cac506849f10a393e176a642586759e485aa1f5c7cea76b04d3e1f255d364efe09b4824260c9b8c9510d521d7eb2afcfd3499e0258105175
SSDEEP 12288:2yPz5L8pccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8h:Lzypatr0zAiX90z/F0jsFB3SQkQ
TLSH
T115551207326620F9C4639238C9911906F775B83117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 8ede122d680fe8065955fb0dbef484bcc2de5c494b173e3c5e16fe198c2d65f0
MD5 1a787614f46282f326ddf942d0b658ad
SHA1 4dc8829026ae260ef575b165510d5fc7aa2d3f02
SHA512 a2a2dee7d946cbdbfa4315cf7a08267b0deccb74236af38e048d51d4d0c0a1f3cecf49d9bc8c0c18b6057cb2ea3762d0675c65661b46d1fcf1f2fbd9c9b77036
SSDEEP 24576:zTHaLl3z0zDzatr0zAiX90z/F0jsFB3SQkA:zT6LljYaB0zj0yjoB2
TLSH
T1CB650195735018F9DCA3823EC9548906D6B27C6A07B0CA5F13E43A5B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 3a14a2b4b76b5d9ee3a2c9489bb0e8a65b1de23b0053c3aed28b96c4fb160c63
MD5 80178d54b00fc305d074a8989a5388e3
SHA1 4de9b22e3205e90de552a235161d752c8107192d
SHA512 476a6602157f3848fead0fd9bdf92d49afd9c0830e392224cb2da27409c48249be0c87de5a1da1e409fa5ef8356fbbf2744f37ac03c5b79b4c3c1112e292e809
SSDEEP 24576:Z37d9CHKy7GZHatr0zAiX90z/F0jsFB3SQkR:p7d9CHKyaxaB0zj0yjoB2
TLSH
T16075CF91F3E810E5F0B39A3589758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 160e1cc0d17ad1a7d4821e635dd2c315eae59682ad47c45cf2b3539b58ddb842
MD5 261a2383ed812936e58631721d599c60
SHA1 8f1a32745603970357b9fea2693a53c48748de82
SHA512 bc30286580ebebcd3c440f2db70673c8e7ce6e2dbdd25aa6efab2cafe0f6184d3b341143f8a7ffe6e551ea98314a40d74c6b5a3013b2be86f0a1ca9f48cb6891
SSDEEP 12288:+DccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8E:+Datr0zAiX90z/F0jsFB3SQkd
TLSH
T18A45230B381F80F3C8831B355248988B5AB95EB476D36B85F2D63F0FDE382C616656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ac75773be40e90b4a125eace85fa66c65ef8e5b8407faf293b9fadd3ece12dd8
MD5 d0aa7d380d67a68d034e24e6f16247aa
SHA1 fce91684859254438ccaf618e26ab457ace22075
SHA512 6aceef64831f216a08c146434fa391ded8a094ed4437370a73e50ee39d66754ba1b199111fafc3b983e8f1740561a059fc914b676845c46b1c2b7da951a6888b
SSDEEP 12288:QJccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8d:QJatr0zAiX90z/F0jsFB3SQkc
TLSH
T12D45230B381F80F3C88317755698884B1AB95EB4B2E3AB85F2D63E0F9E3C1C715656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 776397525d335eddc11998e9d13640855057d8c2a3e8aae7b335c5d52e97258a
MD5 2e6a69028357e763fd42f7d8f41a7c15
SHA1 da18536534dd9af2c5162594cffd8bd9bc2a834a
SHA512 ff828af1cac730b43a818e0c7153626add3c571366b93f4a78256040cc4e004e3ef19947c3c5e837f598b3fc422bb7d965086f8dd98cecfe10cc38bf0463a9c4
SSDEEP 12288:FuccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8e:Fwatr0zAiX90z/F0jsFB3SQkf
TLSH
T13D45230B341F80F2C8831B355684988B5AB95EB472D3AB86F2963F0FDE382C715655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 019797f0b66dc421bcc9fac7de6aac63e00c7188a99322c713170d962f383365
MD5 b7db3aa7b6142758d0960f4be27d1026
SHA1 72d51f0c5bfe0984beaffa120ec93aa9735e8f95
SHA512 cbe1f3710c03d9893a37b8e9738882b7ab775d15319824dfb41fede1455eaa701617677134c488ed575172741ab47a7b4c518945c9b1dcab3740fb72ba1fb1f0
SSDEEP 12288:DYccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8e:D6atr0zAiX90z/F0jsFB3SQkf
TLSH
T18845230B341F80F2C8831B355684988B1AB95EB476E3AB85F2D63F0FDE382C715656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 8b995d610db20c431e0ca460614ca44d69f8614365500e139db01aa8d91c9806
MD5 d243595fb7611d4589f8a8c49dbdeda1
SHA1 204bb079b62d5aeb8b13224ec514659954eac051
SHA512 a859f1cead9cf65f7e0146264ab3de6ed5173f3f20596a263f5052be9ce15ff5bbdbf04354d2ecf3e94792333982976a669382ddb1987024112cdb9bcf388ae8
SSDEEP 12288:ODccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Ce:ODatr0zAiX90z/F0jsFB3SQk6
TLSH
T1BD45230B341F80F3C8831B355244988B5AB95EB472E36B85F2963F0FDE382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 301ade37e80df8fc2165f9e7cbc95ad389739a6b3b75cd42021add6431d60a11
MD5 6ffc8a307db9931bd7d96af5085a8667
SHA1 369b66f9f36fff8d31ec36c4e55fc814fca706ff
SHA512 24e9a9a2be05895f604ebc35859ac2028c63500305088c074c91beb03fd3b246fc2f671d07c361ef64d90f3f23076371df88d94625e354bd0140ca4029de87f0
SSDEEP 12288:QQccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik83:QSatr0zAiX90z/F0jsFB3SQkG
TLSH
T11B45230B381F41F2C8831B755684984B0AB95FB4B2D3AB85F2967F0FDE382C715256DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 9552a673e02c83973b526c3b56677ec5378efabc9356d62398150cff028ffa0c
MD5 65baac1e7e4011da665a6a8e9576f93d
SHA1 ec8d4c6f1411684a0bee68ffe90ebd82124b1160
SHA512 e8bc90d100327a7ad458df2e52dc3ffae5c60aa7aae0105b34f2fefd05707f436060332fb0a6ceecb7b8b02d1f903071947be7323156768c664c4d7bb778e7c8
SSDEEP 12288:xiccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Ce:xcatr0zAiX90z/F0jsFB3SQk6
TLSH
T19F45230B341F80F3C8831B355284988B1AB95EB476D36B85F2D53F0FDE382C616656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 b005b4b33611043deea172bf96004608f2bfb4cee161f565d0dc2c1d41e8b05e
MD5 bbbb8d7bc6e5b3c4ba0fa8d7da9df665
SHA1 eb671cb7fd0ebddc677cc110f6b287247918def8
SHA512 bb37179189a93ccfac7784b5fb444867db663dcb251ea2420c6cb0a943d18f0bce4449a5f1d616c92f5fabde9ea2e2a860dc16b975b86bf66cec49e35f510a29
SSDEEP 24576:xfwvok9RX6wkyAIWatr0zAiX90z/F0jsFB3SQkd:XMnYIWaB0zj0yjoB2
TLSH
T12085D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 425b7ad4bf0a53d147101a3ccf15afce8ad1737de7a8acb1cf158d3b3c7f0721
MD5 0c9bfe93d32a757f67c1741d28a86cb3
SHA1 ec39a69c5e4646a1bd5e0e8c208473528cf667f9
SHA512 3a69c94f1d53079b1fd3f815b00c0bdbd45205c362679d5cf29a9c29198b166f33fd5a8c796e13774080d54357fd30ac441b823c9a3a0e3de189207149594468
SSDEEP 49152:MYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0/aB0zj0yjoB2:yySzP6B2Yyjl
TLSH
T1F0066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3e216ef7abddb86caedafc6c651b07302f51ccbb932e59b2d7b6a45128ea4a5a
MD5 ae82848b12883bec6e638b34746c78cc
SHA1 a8070c1aa29407900fbebecb5c6d5dc86d9e46ae
SHA512 b45417e5488d19b06e8376db2df2c14e3ed1f807feebaab6cd5dea9305cb862fd35e451252cc99dd711bc925260ffbffeac2821a4bae155aeaedafd622ab2d71
SSDEEP 24576:Z47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYNatr0zAiX90z/F0jsFB3SQkz:Z47JUQj1irIhCnDHUPfF/vaB0zj0yjos
TLSH
T10A65AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 01f4ee796f38879e9872557bc7e4926772426d3110b30e4ced6dd8acd9fc877d
MD5 c7de946e05b9af0f5a9536ec76dce3c0
SHA1 cabc133afb811086634e90d04ce021ac27d3b7de
SHA512 9a0392abab702416184a52a8760d0ddc835b163448bd08f053197bcbc80539bb0a3906e37130aa31e650fb685123e17bdc31282d9f6d14c2551935aae168d86a
SSDEEP 12288:0NsfoccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik89:FKatr0zAiX90z/F0jsFB3SQk4
TLSH
T12A55F00AE25801E5C4AE6239C7544A41B7777C6493E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b26af70850bd1e741e4dd30514451022e81fc79af661f84dad718b1d5ab5837f
MD5 db6f53d62ba36fce4cdf7b16e865eb74
SHA1 09359cf04a84f9a454703f1570d9466a81f6f176
SHA512 926c3bda906bcf137cb0d59424472592ab05660dcdd6e1faaa4c7b81086a918ed6df6770bd248221d11401e2f7dcdf007fbb18a508d35e6fccd947632867a429
SSDEEP 12288:j/kCU3f75bjF7tFO2PkRRW6UkhzqxL5XI8y0oQiaR5BCL:j/TUPbXO2PaUQW548yTJaRP+
TLSH
T1AB352850B66BC75FC6A940325E32D1CCA7707D01EE056E0773C98B3F8576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 450KB
SHA256 dce1aad52a4df4efd4ec477f236c6a8ccc37ec48dacdb76ee3e59e25a3d64038
MD5 f0a809ddf0e10b3992a93b180eee07b4
SHA1 dc60bd49189d6031190a05627d189da03c0c2b6b
SHA512 3150e5e008e4ea002fc2235d1036d5ee6dfe3ed979270a39651e416f8e0133a5ddb510838c8aa3269fdf6760347c5ccf4cb740854b1b3f970803210ffac47556
SSDEEP 3072:IR/yL/HDKpJa7gh83DEdzh2gC4gdRyxe:TD6wgh8TEZhc
TLSH
T169A42941B369A75FC5BA8077813082CEEB357C12AF42320377C44995DCB651E7ABABD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 d2d5ddfc38fc8b1639121c51ea589802095e280138a1f9547dca32e208edc764
MD5 1e8423dfb7b77f8d7abe40a90691fef6
SHA1 ed4dac12da228c4e500e28146fb95d13603c91e6
SHA512 62d92afcab8d01f2ecc346f5e2ef077f6fb94fb5ddcdab15d6855a962464d3db61b835a795321750a94cc5c88f8a333ed5e1c567484d85ee2fc7bbfce93a19fa
SSDEEP 384:HwCe7iO024Y5dcs3hk2nhfdDE2Ba/rIVy8eC0+G0+i:QqZY5dv3hk2nhfS2sDIVy8I+j+i
TLSH
T115729EBBDF416C5D1957D985C8AD8369DD05F9B7CBF690B608243449CB84326B0FA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

asrouter.ftl

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
TLSH
T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 0e602081541877259941d5a95b614d5e434afb3be5fd99f9f7af34a101c9e1f3
MD5 48564df63a568885e773b4e9e9c81217
SHA1 e0a2d41c80b369a77d476322800ef196ef288d16
SHA512 7070170ef160c6641bb2a2576bc3b8dd44d95e6aa0162ec6b31e2497c7daf4236dfbec3c97353b120b71322465bdb5c8c0300bf761811013dea085614ba15141
SSDEEP 3072:j3lyEouTMWjVTEb+OI/iBeo0G74jaMFJ3:py4MMQb+DqBeo0nae3
TLSH
T1AAA3BFF6CFA28D3D54FFD42DAA82C93EFD262440B3A73419C823631561C6BB87674649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a93377db746bb6496366b1d10c8040bdde87ef6d74a8f8793f862312ee15dbd8
MD5 8a8b020ca449b5671c9c9b867677e4bb
SHA1 bbdb09b5a45b8eeed44d95bb193e4180687276d4
SHA512 c6f42c008de88ccff72fd9c5a175b7dc118b6f9535f508d7bddc3ac997874487c35b79a84535a164b8902021ce589d2f64de810696941ee211090cc99497b25b
SSDEEP 192:4ToOv5zbo7ZZAyuyjNqOeOvp1d66JoztdzgCl6mc0dz:4bolZAnyjuyd66Joz/zgC1jd
TLSH
T156E12F54E628863FC458427BDDA21B804F35388A9C8E3F19359C751C2D572DE76CE2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6ad4bc7dbc02d5e38b643b49d3282faae2b30d5512388bba6fa146916e7673a6
MD5 b0a579a4c24714f20bed4ddb079759d9
SHA1 732d3fb4bcb8b60ea5042102d2da5751db1ab4e6
SHA512 dd15d179133f3ca730f9627e918dcbd678e103ea34b8f23703c2951bbbb4be594ed2638fba0ef34204130d1e853f1c7ddb3c6af67882f41f9f6db98a8eb5212f
TLSH
T1932148AC7AB94D5A988BF29CB450128E53098E0304971D430D12FE8DCE86ED9716E43C
MD5 SHA1 SHA512 TLSH

Submit Download

1e06b48a-5c50-4ed7-8faf-0fde4e93dc65

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\1e06b48a-5c50-4ed7-8faf-0fde4e93dc65
Size 886B
SHA256 f72b981ecd187395bd5fb58245e1cc093fdff49a37c4a32c2fe5057d3421e79b
MD5 dfdb50c9f9275858d0ada77a18e661f3
SHA1 e7e77c21e4f28525f91f29d00d34744731476d3e
SHA512 3745787d129863df1273d8a36d171435d2e909a80d88ad05504101a03c7c1d601ec9ff841fe4164acdb38dc5ffe07a6555e54c324f06cb28d3ea8c9030a08a50
TLSH
T1B9110440CB7875B2CD38D14BD6E277458BE4341780C908147E546F180DAA55E669B717
MD5 SHA1 SHA512 TLSH

Submit Download

435ef5d6-7f01-4855-8366-f7353fa8686f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\435ef5d6-7f01-4855-8366-f7353fa8686f
Size 2KB
SHA256 50ae05365816f3640bd633306ee165a302e6db14c892a3ad6deb817d61f1a90d
MD5 7c6df7d650ba7ab941a22d47d66c17d1
SHA1 bdf3b41075127fbca8dbb336379189ed27672aa5
SHA512 819d937db830af85411bb4b9f010a21e5eee20371a406b7055dc9f8a772676a07ad507e47fea27fbba7bf3fdd90d8cc6162d4a3a137e6e4c8d108262d7cdfbac
TLSH
T17641335C36785D7B9CDAF18D948332CEC775990708C61C436E41EF0C8E926DE23AA92B
MD5 SHA1 SHA512 TLSH

Submit Download

9ff88591-0e84-4a62-be83-9baa9ddb7855

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\9ff88591-0e84-4a62-be83-9baa9ddb7855
Size 235B
SHA256 babc0d96e26d87780ce4fcb6b2d0a967bd2e1564ed30cce70cf7b1783eae241c
MD5 5d0b8e1ec7029a61a8728eea1fc8ae78
SHA1 6cbf73074c74dc83df971b7b9a96628bf206ba20
SHA512 f4cea3b4b0626261147cf896692825d9b0a15c54f4ff4b482b1ada975ffdb099114033ba7a827c3725c2e2f70e99263a4fc481e81bdd9182ece06720e49714d5
TLSH
T191D023C0688C332C0800AF07F1E07DC230894C332470AC20D5D1063CAEFDDC4C2A281B
MD5 SHA1 SHA512 TLSH

Submit Download

a84b7090-6dff-4dd1-a6d5-53beb3affe9b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\a84b7090-6dff-4dd1-a6d5-53beb3affe9b
Size 15KB
SHA256 0d987e11454ff0e0e7ea8fb90917ed3ca1a9b1dbbd8ae738632e2469c6692d40
MD5 06b3b57213b4099866c2d44092c07653
SHA1 cc155f38333c3461b0708444e8c1226f34fc01b6
SHA512 31204844b63f0f34eafcb89cb8a3fedbebfd9db1c5b2361f69d426a4996f0ccef0203d15d87751fd5098a9a587b654da4fe40556f12c40dfb05f6c171b763f1e
SSDEEP 192:VbAc51oSibKmJJDpqggrSzxR7i5a8Uu72M1BTDmW1apyAccwbvZa/S0a5e5JK9Ge:JX51oOgtgrSlR7i5kaQwaK9Ge
TLSH
T1AD62D855646049BE8650E368D8EC7FC7E2F518CB4C019FCE9BD4BE0859EE0AD5127C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac35cc9e-1f07-4a28-91e1-18915ac780ec

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\ac35cc9e-1f07-4a28-91e1-18915ac780ec
Size 235B
SHA256 5a4e44bc1feae94fd69aadfc882e48e93343563a3f528a62521d87a4a464821f
MD5 9281c0dc0124188e6e78f99a07582fe9
SHA1 41d4f954d3296045d07eb5cae2388682176ee589
SHA512 cb0056cfb160d284949a4dbb5d3fc53b3654af2815614bb7948d406df80e6300b5034e29e5060211ecf57581ffde746126178fb00f6ac12ddac1325ef3655806
TLSH
T1BED023C4A8D9B76D48184F0BF0E069D63195CC3324B4A870DB75567499FDEC54173D1B
MD5 SHA1 SHA512 TLSH

Submit Download

cefcc2b5-50d4-4202-b2d4-e3fbe87b628b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\cefcc2b5-50d4-4202-b2d4-e3fbe87b628b
Size 883B
SHA256 a64ee8b269af4ebda0e2873ba21bb63d690bde99fdb79343b695282bf8915a6d
MD5 05929bb713eb600f79d81b1acc8170ca
SHA1 72784fe0d30462b15794f71dec28723b4e161138
SHA512 6d855d6bddfc11ef1f06f0a68c18a03828b43e2e3cd3ac3252e65164098b3deb2f0a5444d74442ad7038ecfdb93bb595dcea83da6bdf7c5351ab9ec1679208da
TLSH
T15B110440DB747576CD28C24B8A5237418FE4742780C944043E955F180E6F61E979A71B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\extensions.json
Size 16KB
SHA256 e34d2603bd00b0f75c3873f66ad2d153782a5b9cb9e03e238911f288fb9455a6
MD5 ee343a0a365cedae1d1b72657804206a
SHA1 531ed2ee4795904495be545fbb43799ea436025d
SHA512 73b2cf6115493a715e0379d6b31c4ae679bac1696acd59d5f87138f6a3cc6387e079ed42653c4397ca4ba28f9fd8707e064baf72485b21f30af4ded242c18d78
SSDEEP 384:ISkI4v5UmldvG8dhW094zM96o+L4HXqL4PCL4HPL4HeL4HRy4h5:8I4BRfLXd486P4I444z4E4047
TLSH
T13872421545049EB8298EA79AEA367E01C37D533B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs-1.js
Size 6KB
SHA256 1adb334a80ea177a3c8e754c7e84af503c3a3f268f39decec4c18d37273190a9
MD5 cb5311a699ab7bf811eec78347535cf5
SHA1 619e864cc634d1869f7694967f576713155c07ee
SHA512 51a00b9ab9ba38cab0c2f9b567ac0fa7a196a1a9363b93124afdddcbeda96f1eec533f58b11a23d9656f07a8c1013a74cc1ecffad20989b2df5f4c24b0c51bd4
SSDEEP 96:xHvUTUNqGqCf51zSbSSlvdv9jjnsRHrDqBw88u8L4cn+VLe5t:9ARCf5CSSG9rGBw8800t
TLSH
T1F9E1107895088F7F64B6776CAC6488316AB2413BBBBF28D750B954C5010CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs-1.js
Size 8KB
SHA256 842cb24b3c903fcb281eea6f0d2be5b25b6688966631e638aa920217ca70ce6d
MD5 02a9c4fc131df5e872c15a29a0ee9cb3
SHA1 0746168cbad151f1fa0940890021a4a5cd9f0c18
SHA512 cb4291e2d3dbccc5532373dcf6bd7e19cf1628cf6cd6fb7ecaf6e8ddc3b703c560b4f12abebd10a6ea6f6e8e81c818f7ae26460087e6097f7db7878b879db7d1
SSDEEP 96:xHvdTUNqGqCf9ObzSbSSlvdv9jbnsRWRLfDG5Bw889Hz8L4cn+VLe5t:9JRCf9NSSO8Rj0Bw8890t
TLSH
T128020F385504DFBF64B6776CAC248D315AA2023BB6BF68D710B954C5014CF3482FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs.js
Size 6KB
SHA256 4a579f5c88ec57c7c1b4ed2729923d18cb833e62ccd9dcf78b55dc90a5478379
MD5 2654af0b9b8080fd712019a673275988
SHA1 ef23786032a20e170946bdfe2af77b6a8a0c6f61
SHA512 573360689fd51a23ace5a4a2f35db1b62c4127a3e367d2571529aa7e83ba310911642a2175784d00c82cd3ca076c49fed4e7f1a2b1d08e5f5299fd7a96530dcd
SSDEEP 96:xHvUTUNqGqCf51zSESSlvdv9jjnsRHrDqBw88u8L4cn+VLe5t:9ARCf5xSSG9rGBw8800t
TLSH
T15FE1107895088F7F64B6776CAC6488316AB2413BBBBF28D750B954C5014CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs.js
Size 6KB
SHA256 0d575cf05407ef116843c8b47aefc46d4f38af34309ac3581cadf2ac883b64c9
MD5 98a25eb358b1f658e6a23feff834d0bc
SHA1 8b0edcd8b0a329cdee21c01ff3d1a7d3ec9a1566
SHA512 cf42c6b4423d1a4e5e428f62aa871347959efddb097e5dd8dfd8a7d5879aab1f74aebeb2a2d44e984d12a85cb32b394baedd64267034243f2f154eb66b2dde12
SSDEEP 96:xHvUTUNqGqCf51zSbSSlvdv9jbnsRHrDqBw88u8L4cn+VLe5t:9ARCf5CSSO9rGBw8800t
TLSH
T12EE1107895088F7F64B6776CAC6488316AB2013BBBBF28D750B954C4011CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs.js
Size 6KB
SHA256 729b70c101c0e6bb50dc6fc70b5fe11defc3462d698fc5d8926ce99743839143
MD5 2cb2413937e289dc73cb88089df0aa7b
SHA1 b8e1c1d18ed1b195c11cc4d28eb376447fce877b
SHA512 8e982c840c62c336df3ae7a8009d19d61b9032a6e955826a388b70c7106e59c2d2b24cbc796c51480e62fc01a0b8098ee7cd6f6c3a5c359285932ec025246a2b
SSDEEP 96:xHvUTUNqGqCf5ObzSbSSlvdv9jbnsRHrDqBw88u8L4cn+VLe5t:9ARCf5NSSO9rGBw8800t
TLSH
T1EBE1117895088F7F64B6776CAC6489316AB2413BBBBF28D750B954C4011CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d6c0375b2970e32903bf640d644863bedb1ee689ea86c5f6990491d403fbb27d
MD5 5401b998d11de1aed02939a312793c7a
SHA1 6bd5c1ee2eab2e908334d33a46c6a14bf93def6d
SHA512 73d2de293820308c8603480d143a0ed4c0f18af70cf4ee440047c3cb7614677c8986a7409063c9f85c89b14b795fd9da57ccc2d78ac00422423bc650e696a898
SSDEEP 12288:LM7gccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8f:Qiatr0zAiX90z/F0jsFB3SQkA
TLSH
T1E3452307251E80F2DCE32B3412988806267EBA746BD29AC7F1413F4F9D386C65D756CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 376a02512d712ae62081c59bf20423f29c8f309b1656c0e2f5b16e0392f76ed6
MD5 181ca484e2d89bc68220a26e15e94ba0
SHA1 16726164228f184a5157bc0efd8f5ad4848886c1
SHA512 9da2ab089337063471a9eaa201b1be93686eb2e0ceb130862c227c3fd2721659dc9230c921ecff2279bce6b13181c3ccb7a6604057b6e60e4ad80495f47f27ca
SSDEEP 24576:ugb6bmBIi49WNNFpg1rSvFv7bYYatr0zAiX90z/F0jsFB3SQkt:ugb4mBIBhGFNaB0zj0yjoB2
TLSH
T1A565AF1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 420aac4bda68c7121146c8e40d73a4a28ce18f16f60a3a73f5f53dcd85d789fc
MD5 c52f16d3f75d5d275b05beb66dbbc4e3
SHA1 2cad3070e203f9fecd34f75285c18c68b07b070a
SHA512 bfb2b05aa73ec362b75b35eab699e95cd595fcf441cd6d546ceddf9a3d4f5d5bf283357995f507963256aa89d41116da7218c09c0c53ad3d73c511f3cad72eb7
SSDEEP 24576:EG88u8FpJqH1bzria7/mdatr0zAiX90z/F0jsFB3SQkV:37ZFPqVea7/QaB0zj0yjoB2
TLSH
T15D85016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 ab94cb0fa5f97bd6947ffc9cfd5dedb02efc26a7546555020fe46be36b6b7984
MD5 fcba0e4f3c272781b2c10ce344f2601d
SHA1 92f29ee1826266fbe9b49ef34cb0225c77119cea
SHA512 29c7e299162f7a447b130f317084c55df90c0e3c58ef116c09e49fad00c70356818969e84360d38301bc7f3ef265f73e45629a1f5e7f535e7d9c31a3796703dd
SSDEEP 12288:lHvUrBFrEjwaQxccUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8x:lPUr+NQxatr0zAiX90z/F0jsFB3SQkM
TLSH
T1C565E11F22AD18E5E677A13D85818609E772B8621352E2CF02E0917F4F37AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0186b22196a66956a2db6e46bcc4781e68b2909879a7032529b0ba74644d4734
MD5 0bdba515fa35cc70650e2f67e0a1d8a5
SHA1 0a27d23b491bd9b91e69d76795fdfa08a5c55a34
SHA512 543ee3bc9ec801e516515452cb45f9ed68fd86cde4b51bdb6145c62ec4127e2c375cb7c8869ce9231fe122fc3c0335af8d3c91ca43f82d2025712dc5df61dded
SSDEEP 49152:rBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBaB0zj0yjoB2:0G05lO43b5B2Yyjl
TLSH
T17AD5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5293ff777e0e031c2eb8678bd380bafcd5af62724b34411a3d028cf1b8bb8cdd
MD5 7fd9ebd65a03889b471702a014b94770
SHA1 716b4fd99bca15baf89db54b54fc9d210c8212b7
SHA512 05919fe996674a1c0f485d5398b73172f5bfd6a5a7c546e0e975ed6375adbdba5138d6a6ef288add3878bf9bd50ffa8194b74460a637cb0484db73068ded0398
SSDEEP 24576:Mfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn/atr0zAiX90z/F0jsFB3SQkF:Ua5POZ3+Jt2pasx2+mJaB0zj0yjoB2
TLSH
T13C65BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cc4cc2b2cace0d3d7e239eb8a07e7dbd364b808e88d9633054e0e215c3cb060e
MD5 4f216495605f47f62dc0fe70deeaa158
SHA1 e5a08a92f07e484fb944d29e2a32531c0aaf0a2b
SHA512 516db4bc3e5fcdf532138d1ffedaf11b92acee8deebd366e5d03dbf6d6d43521994ee015c85b6a47e7dce1f335f2a6603851291d5785977f7f97f9014c56376f
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7FkFatr0zAiX90z/F0jsFB3SQkK:dNc/zEOVHFwaB0zj0yjoB2
TLSH
T100858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 240bcf79414145b60208b4e3a1f3ce9e740090eb16cedcf801051f7fdbe4d748
MD5 df891b403cd03b5a4ddc70a65d145f50
SHA1 5e4d2620edf3e6cfe5c164e283c9f750d393bc2d
SHA512 2eeda8dc03e0f6d31083da86581680a30b12c34a55d00f6e66e7f5c0e616b86105d5e98822a900442c37e7a7a005057dac09084db5674490b901db2b1d473b71
SSDEEP 24576:88kNvNnaFeYhJNtmZBmBatr0zAiX90z/F0jsFB3SQkI:88MwBtOmBaB0zj0yjoB2
TLSH
T19055BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 391b6edc3a3e8f95a4994c42689191e809b730c9ecc4d65d1361c947be4ef0c2
MD5 aba3eea83a2d425b4ddbd22ec2a0a990
SHA1 8414bb9a43054d2bb21cabc3750cee4f543ea36c
SHA512 dbfd2c609014d5a64ca2bc28ecaab06ad06848a7636151b31a80d5dc168892ec3b53295026f2a3aeec44ea063f12b6599742bf2a5a34d09d3506dc6935c25793
SSDEEP 24576:PD3FHshBIYQgA+atr0zAiX90z/F0jsFB3SQkn:PDVHeBIAA+aB0zj0yjoB2
TLSH
T18C75E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D491BA5F2BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/780-83-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/780-541-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/780-77-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/780-75-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/824-70-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/824-57-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/824-72-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/824-51-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/824-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3456-634-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3456-88-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/3456-87-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3456-93-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/3860-138-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3860-149-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3860-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3860-147-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3860-144-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4128-67-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/4128-251-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4128-60-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4128-61-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/4384-43-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4384-7-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4384-6-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/4384-0-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4384-44-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/4384-8-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4416-689-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4416-161-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4416-155-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4416-154-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4600-123-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4600-130-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4600-124-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4600-679-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4828-98-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4828-104-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4828-660-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4828-862-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4828-867-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4828-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5904-23-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/5904-15-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/5904-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5904-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6036-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6036-29-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6036-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6036-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6036-153-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6116-675-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6116-116-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6116-110-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6116-676-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6116-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6116-678-0x0000000140000000-0x00000001401BA000-memory.dmp

Download