feb2e137763d42c7298c8cfb543c7d6f5c00c284fffd037f9e72d289101668ed

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 1.8MB
Sample260723-ff3rnsgd52
SHA256 feb2e137763d42c7298c8cfb543c7d6f5c00c284fffd037f9e72d289101668ed
MD5 38aa6f8ac799c8e1abb87e723c749fe1
SHA1 b8f406b4bb5c5bde13a3b198d591dcdd88f2cf43
SHA512 f0a41a1f5a76d41137512428e60ae7f12bb7bb1cab715e96babbcdc337f2b7acaa0494498bdab71c4a2bb20f3424276fdc50a00c72a7c221ed4b960daf680f86
SSDEEP 49152:ph4RSEMBZLrpeI2pAgJKTqaB0zj0yjoB2:p9+STtB2Yyjl
TLSH
T1A995AE06626902F8D47AD07C8E42C58EE77A38A727756BCB0F9067563F23AD19E3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2916	elevation_service.exe
1052	elevation_service.exe
4488	maintenanceservice.exe
5060	OSE.EXE
4548	PerceptionSimulationService.exe
1096	perfhost.exe
1792	ReFsDedupSvc.exe
4160	SensorDataService.exe
1732	ssh-agent.exe
5428	AgentService.exe
4376	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8b21665d238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d4dd2bd5e1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3649fff5e1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff4f52be5e1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079236cbc5e1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
1052	elevation_service.exe
1052	elevation_service.exe
1052	elevation_service.exe
1052	elevation_service.exe
1052	elevation_service.exe
1052	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5428	AgentService.exe
Token: 33	4376	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeDebugPrivilege	2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2944	2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2916	elevation_service.exe
Token: SeDebugPrivilege	1052	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1352	4376	SearchIndexer.exe	101
PID 4376 wrote to memory of 4784	4376	SearchIndexer.exe	102
PID 4376 wrote to memory of 5492	4376	SearchIndexer.exe	103
PID 4376 wrote to memory of 1124	4376	SearchIndexer.exe	104
PID 4376 wrote to memory of 2232	4376	SearchIndexer.exe	106
PID 4376 wrote to memory of 3528	4376	SearchIndexer.exe	107
PID 4376 wrote to memory of 1196	4376	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4488

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5060

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4548

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1096

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4160

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1732

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5428

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1352
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4784
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1124
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2232
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3528
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4b9ce634fa98ebcb50383d97c072f5f277958b908f85d8956afe8fc5cc9d0d40
MD5 7a1ccc03f6c923f0278a2d2d52374bd1
SHA1 1c6e1821d8ebcd4755101a3bd3aea4e50ee37b8a
SHA512 dd531a175e7f49779b5f255068f6136615e6c6733756db47809571dba3670b1aeb106492e3b029de325dbacb6b660f28f04a80edb6c740cdb611f50de4a35749
SSDEEP 49152:cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnmaB0zj0yjoB2:G3q6HjB6B2Yyjl
TLSH
T1B2D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 a7703690d3d10a257893a1ac82c38c5222525a5cb39930c00849bb6f2e45f8c6
MD5 c04baf4df6bbda3e5d2d55e5fab33ab3
SHA1 0e444e7c2868f5742a1171aacac63314224e0753
SHA512 133673f58375eb08cb361d2cc5b973ff1afb43908123c76a7f2e6cfe762429b2b9f6a572e24a4f8a8b20316978657df007c3c373784f0da9d1049a257bce3523
SSDEEP 24576:8XYfDtczADatr0zAiX90z/F0jsFB3SQk9:7tcQaB0zj0yjoB2
TLSH
T1E8650229779504F9DC67823CC9A18506EB73785147A0E7CB03E4AA6A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 8ec1732c965455263e6085783e62ac75d4e104592d6ee24dfd367bc59014639b
MD5 4d57eea854f0aedd6fc75203299c182c
SHA1 deb12c327a8d769b539b38a3cfd6bbe3eef5bf4c
SHA512 057de290ba96dcc1c57ef3432edfe4d8caa12976ee6d0f9b7978777c6195cbf9d592a00f5c47eaf37a2a3bfb613ec294403f625dd3897b1d664a74bddd0b32ab
SSDEEP 24576:a0Le5ji0hmxirMeatr0zAiX90z/F0jsFB3SQkp:aPji0Ac5aB0zj0yjoB2
TLSH
T195859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8c887f2132e499129d1e81ce4bed9aa7febdad50114ae2a467db71c557c636fa
MD5 6420732369a5595b05d003c9c55cf769
SHA1 15e825f8dc285c805f1afc180441c42c0a68aa05
SHA512 6282d0889b61656ebd5aa6a5163c30ce3570210a6f09fe1cbe4d120c099566b3a46b7d75c7bbb438711876d6dd4e9a23c10b2b91b3d965134cf2d67470a276d4
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWE6q8wyugatr0zAiX90z/F0jsFB3SQk/:f/ezSC6vUzPvxHjy1aB0zj0yjoB2
TLSH
T19B755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1c7049184c5d9604910cf1fe742d7aa7313b503d96721b8c1d8b7bd229afe2c5
MD5 5cd646da3baf9da2e4b5c7aeeebdd88e
SHA1 91b7876e73cd649bcd2812ad6f0705fc00f45fdb
SHA512 a12c4263d63f4b523789ef3c6f68bd984a7391fcc216e37f3b21737b60960ead251a8ce0d32ede00087d2585f01ddbbf03a572c5998aeec4c5dcd599b7442ba7
SSDEEP 24576:xVbqPb88hv/l+6Xatr0zAiX90z/F0jsFB3SQkL:xVO88hXl+6aB0zj0yjoB2
TLSH
T1C955AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4099e30cb26c59d4030b11a2403b84b8fd7b246e60c0b7437550069fcd8a3ec3
MD5 dd5584999431bcc2beb40ff77e0ee902
SHA1 5bc0b228b6317690b0a7ddb51802b43d3c7aff1f
SHA512 db15e60d5f51a651dce62550e5e88a4c4248442c169488c712f08672b06a4e411e23bb8b8e68fe800a6c937c58a813010795f919268d7360799fe85a2d1ca490
SSDEEP 12288:CRCUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:CRCatr0zAiX90z/F0jsFB3SQkO
TLSH
T14645230B350E80F2CDC31B3566989C4B1AB99EB061E2AF45E2913F4F9D3C1C6D6656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9ba95b621a325bcc9ea5e63d8d8b6ca79e3757fa7c251560b75d132dc7f91ea6
MD5 b6b1f18a3c6c69dc902f684ff0133120
SHA1 c5e0732937ca34af7e20913baa3b2f106813c808
SHA512 bdd92c3fef572738851c16656f98cbe9b15de824271408f77b2716c60d6de34f112ddae567c814d003553496fd3661e4fef7e253f45587930dce4daaf5d0da4b
SSDEEP 12288:YeBNUbTVO86UvUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8j:YJIUvatr0zAiX90z/F0jsFB3SQk6
TLSH
T12165DF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 15729e8525cc832271e466022d72dc4df8281d793ec58082e20ae17f6229f42e
MD5 bde999d13e4019988c38dfd8d152f2e8
SHA1 b726b614691f083759238f42d496d2968ff21c05
SHA512 1573d40e051e2dbd94eeb0cda7bb9d898c110c9603d09776164018369ca7e4f0bb4dc53c29ed97b9c1989f2dec0ca6fe2ec8b30773be5174932ed94440d97ce3
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THZ:RQvGAdlCEL8c/yRNw5CPB2Yyjl
TLSH
T139267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 d11632bb2559090ae72626be306a5dadd678e64feaf949f9dd33a44a512a5148
MD5 ce8368115920640a4317ad93dd7ecb37
SHA1 df54d3078bf3bd1d83b4cec2ac7a07e7a2e2ad2a
SHA512 25c3796266fd972542e3fef9409d7d155456168c83e217d4695bf5d0ca4b635d3785acbb82b9e215bbf7ea600b55d0a7f4d5f489a424673b9794092a05d59f33
SSDEEP 12288:JAwSfxL/2Dc34DLLmt0LDQewsAjJUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHz:6dewsAjJatr0zAiX90z/F0jsFB3SQkL
TLSH
T12C75E031FE75D032C6BB0DB61B25C706147D7A204BA21AC3E3E86E8E59342D22776E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 17e1aceaf73a322354fd0ada8d3ffc064e9682b58b5563d88ef4b3da64aecd1c
MD5 209ffde024b61e2e856e57342b97077f
SHA1 c09feec93e2bf5b0098d356b7a52f7302135dc43
SHA512 1ef052b0a51efc3159a00fe9f35f17a093f20e6f15b23b7ddb420f6151848c0bcd91b4446b1c292e4735054eb112b88882fb62e585570e29fd6dacb8559fe973
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHYZ:5UEtQevvqc2W1cpV2EI32y
TLSH
T181474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ea7daf3aa9e9349594d4386a98e6021a4bb311160860ecf9ba17850772475c97
MD5 011b9b293eb0de24baea492b558e9531
SHA1 078f05ccf45f7148cd28f61106fab942f1b3b8d6
SHA512 8a8ffe69a3003f7c2795c1e531bde1306ac7081a47bfafb4a3d090063ec00228296a096a6ab2d8332ad073229fb5521c2eca59cadb800a1391b9398e69303802
SSDEEP 49152:HCbRquA/m2yL5zQfFiV+XenmE3/zpaB0zj0yjoB2:QoqtVjnmTB2Yyjl
TLSH
T1DCD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 aca6d869f6c3aef60ef3b1106cf8207b33c3fbe127f08147aa73faabe1050140
MD5 6d3bc301f3c1fd8d81976b663054965f
SHA1 246722eb50790296897a4c2820f5283977c9a109
SHA512 0a155d116e440d976e75b9fbb18d822df3a6194febe1d45eba2fb24e8b5744ad2b36f170c5befde48e6040c62427ebda207f16f1e1e0bfd89403e1e4d8697901
SSDEEP 24576:HAhGLJIFoiwtA5l7S538atr0zAiX90z/F0jsFB3SQk8:HAMyFoiq5saB0zj0yjoB2
TLSH
T147359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2fbc45dc5529fa40a1436c872d7304f6accc3b86c8a1189ee69f4206536a655f
MD5 69d17784432328a308f3b404c0a0ae10
SHA1 501572ca22653d9e838860e884440042cf206a39
SHA512 2482254a0f87061b8355b1bbbd1d1ce0989a75d67511ccbd2f7520bce4b6a5a68a4833b3d7546b1aab9468b53ec0b04446830d31abf940e74ca2223e9bba1cea
SSDEEP 12288:Dmw5HEjsChNVBFgl0WDm+CAUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8a:CwuoOWVatr0zAiX90z/F0jsFB3SQkL
TLSH
T1CE65F14A36A90CF9E9A342388587C536F7F2BC112A61DB1F1360CB5B5F37251AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 15b1112b450b004178ce6e919e33f8515bc4ad7210ac9575449007b116cd905c
MD5 4e54b085af74ca966d32425ae1774629
SHA1 be660b926e29463ecf7aba30ea872ec407d25145
SHA512 187acefa29eba4a94bbe63fe1966dbf46981269752245404bc31bb9f0c08ffca1252322ef81857fd96a07d047538a237ae190749fed9aa0b7fdc05dab7f6c63d
SSDEEP 12288:+BZ1IyZUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8k:4Zu2atr0zAiX90z/F0jsFB3SQkt
TLSH
T13F55124B32A960F6D5D3523C89E44906D7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e2a0c096ceac6f42b9d1418c2bd2cc343dcf5e018b64c19e0eea8c22a856878e
MD5 c62f591d2a28406fb50d5acda4807e3b
SHA1 c10b384ca6ad46c51e22b987d013cd21d9a17d39
SHA512 55aab9125d076371224d7a91d8edbce41661db1ba367bd8913910fed3b8019b53bb806030baebf348e58ea3e26a68d416357853c942fd44d9020aa81845316ce
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:AQRQyi36YOcPQLvw2gAf+PN3mB2Yyjl
TLSH
T187667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b03ec37036a476b9cffd3ad1c1d918a828f0639fc3ec9b61b59f7c82381991a2
MD5 0162a1f7a2040ede936cdec9167de644
SHA1 06643d3ed1a38e071b8b0f2544a36bf9a0be4d17
SHA512 48656bb15a16be827553adb7b0e9587926bc196f143534b552cf3c94bc6781063fe82c100f8a8a1ebf3f58356acfa80bb07f9b817caca8aa51969c5745a1b43e
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:HQRQyi36YOcPQLvw2gAf+PN3mB2Yyjl
TLSH
T149667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9455ef74cc780cf9bc70710f685f814729cfeeaa219a39342d281f74d30b502c
MD5 dffc71fe780d3522bbdc961efe2a8152
SHA1 6d7558d1b948c4ca1565d8fc8c794b95de9614a6
SHA512 59fcbc0fb48b680d030668f6350d7bd9f606ae10fdaafe7d744c59ae109956d02593b333617273e62a0d1bc3b6e33248991011acb6f6b72f666e0968cc1c0f28
SSDEEP 24576:kwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0matr0zAiX90z/FD:K68Qg55nhheWu7PNU3/5aB0zj0yjoB2
TLSH
T15BB55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f5bb3899a8807c18d11785722ae61a24e19f4f48728af014d5adac1b92d6c372
MD5 b1867b617c6e233fa2cecc31904b3397
SHA1 509d9c7bf29f5e8905ed65dd012845fedbf1d6f4
SHA512 3cdacf5244ff54c104aba59372546df80e4269ef8fe27c5e221aa14e1e55247ff2b60ed18378cc0e02ea850f428dbba235a329a011457c8e27e3e7506a42a4a9
SSDEEP 49152:53aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99f:oy5112gYy5azzVvL69nLKnhZFB2Yyjl
TLSH
T18E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1ebcf42eb38e77df0ed921402076448194805d0a0c66c8f267251b3abeb08fd7
MD5 53257bea83159843ad23685f904aad13
SHA1 6377b611fe2800d87b7827adfe0b31074f42dce9
SHA512 e6f22acdb85061006558bfee2ca3f5edffc328a05e7ddda3600c8ec8a10c32289a1f8a4310261dd5458ea40e338d9580976a1d339b28d76bd2df1ffef0942cfc
SSDEEP 49152:xB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glzaB0zj0yjoB2:nu6JmVxd2d+B2Yyjl
TLSH
T1E7D59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1e339f10f1bcebd078f03c934b0e8b84c79a8a1772c6b9f51509d73afd692aae
MD5 07278ad8acd71adfcf44587d3d204892
SHA1 714b4c5e4caa98914f642b67f944d9b67481fbe0
SHA512 844ed9f9bb63a6940f781ff795dba3a9e3646256f2733c50b73d20a612f5793c0f8fdba9b9f9be7314b20aa28b512d6d84ad1dfd15e1e67f1409467a1c83b425
SSDEEP 49152:K1hpsNoJpF1A6UU44CwH7R4xPaB0zj0yjoB2:KmifPbRTB2Yyjl
TLSH
T164B5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 da90edcb3b016736f5353aab01ae72ff11df76abfa1994f6dd692426465548d3
MD5 db4a1dc13f70376a1f17207e0e6b01fc
SHA1 6475b684876895f7a7e666d46063d3d685d26f30
SHA512 514c2e9414c4c6d249bc017ec2e28c03981c19e53148881a27473dc63bc72fec9fa375a31b39ba46b5f09ff1d3f1631f662162ff1b3c6f8b4243b90a1efa2a6b
SSDEEP 49152:ASuZQIY0Be2KRRVtOnks6NMHq2aB0zj0yjoB2:a5dKTi61BB2Yyjl
TLSH
T107C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ba93ed241bf08ab01ef32b3e670c1e04ec70367473a1e238edbe64572a912ccb
MD5 72fdb384ea8f2175f07b8381aefb7d26
SHA1 2aa287e3ea58c2ac6b5bcb91ee859885ec1930fc
SHA512 ca61e79cb4e9aa8fa44defe0bc58a600f5bf936cd09822dc6e47b931f866ba57161069480d0de51efb61167041cbaff91a49ef1ae0516f363707159d5539fa53
SSDEEP 49152:ShtSn8EApI0figngiDn0AP5wDaB0zj0yjoB2:TX2iyphXB2Yyjl
TLSH
T1B695BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f6e0d7f2e7c09803cdb3e31e29493014afab57a5665868dc316257fbea6614a9
MD5 e9a9fed7aebfa7c07f8ac3ee592a37e7
SHA1 b99c8ac5f205230b56d9901e841539b02aa8ba77
SHA512 889af6a0e11ddf6e18fa7911584b2a13b5afbf2a785c66dc8c99f2bc21f9f4433212d3fede6a79061ef622081bcb06223a9abc43e9d1b86a2f116d5e824f3a46
SSDEEP 12288:I6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8k:I6atr0zAiX90z/F0jsFB3SQkd
TLSH
T11345230B341F81F3C8831B355288984B5AB95EB4B2D36B85F2953F0FDE382C715656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7491a9fef9358900b465ec41591d74f86972e09b5817ec56522a409d463015b7
MD5 d60cd3c0b915ae2eb7d6894ee361b249
SHA1 9ee0263f4c27c31aff292c6445652fd4b50108bd
SHA512 fb86cada043d04d6be4cbd1d89bc580422d874d8e9f656390e3e745fbc43cb324c767b52062b938d323e0e18354bd2bbae630540015511eb52eef0d1fd5f393f
SSDEEP 12288:WdUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8l:Wdatr0zAiX90z/F0jsFB3SQkM
TLSH
T1E445230B381F80F3C8831B355284984B5AB95EB472D36B96F2953F0FDE382C616656DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 65523ae9324285bb818ef13e5a2d59c7b2daa29bcc1062835b72dac6259bf6e4
MD5 eea0255ebadd59dee8e96871b85bc60d
SHA1 14186980bc60ffe9a54205ea06ac56e5bb35ee80
SHA512 e398cd391a6f1b4be64ee26cce54b96fd47a174fa5cc0c4ba499ee72fba7074a38e77c4bd4438bb15c9412d759c657ff108236988932fe397348729f930dacad
SSDEEP 12288:LHUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8l:LHatr0zAiX90z/F0jsFB3SQkM
TLSH
T14845230B381F80F3C8C31B355248984B5AB95EB476D36B86F2D53E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 cdab9c190afdc031d69c3145200ff60437cc7904e06d40ba8536c6221660824b
MD5 2e88fe2e1ef97415f972ce655445a26c
SHA1 6026b12af54cd9dbbe090d8599048f26163b3caf
SHA512 1aac562f90a50f89a650bb91894f43563695719b4b7369f21fef731dd53a873b1361c803e39f69157a4a0acd08f8d0c857e1bfce1c6cc10b89a684c972af73f9
SSDEEP 12288:RVcUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8A:Aatr0zAiX90z/F0jsFB3SQk9
TLSH
T1A145230B351F40F2C89397358694884696B5BDB4A3F3AB9FA2413E0F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f9764bfe37185509e2f7fc7d066c7c9d0eba9e4f704283800b1e72419b7e671f
MD5 7afd2d3b916c1d37141a6d1c14cc32b5
SHA1 c1b7affcc4ff9402e82451d2ca2cda3a2f2b0330
SHA512 c9908fcd40c1b1a9ec8180484cec3bc3bbaef941d63b4c94a10bd647dccb2af0498fd19b5dd434b6baccedd02b2f9c23e5d91e234f915b10acac201d04863ff3
SSDEEP 12288:akUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik83:akatr0zAiX90z/F0jsFB3SQke
TLSH
T11C45230B381F80F3C8831B355644988B5AB95EB472D36B86F2D53F0F9E382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c7336af8dd0652e3211c807e3f135bcab1210068ca833688b385f3ec7d608372
MD5 a950da72c67cde512513879558ec69ca
SHA1 9eed2eca2a969ab2b0fc11f0b406f9fd62ca3d66
SHA512 9300163c3b575fca49df27eea762c3ffca289b7938ccf67e938d6985eb377a5460f2e42d9871ebf29de53ae39eeabe49f0144bbe5354d02faf4cdf9462285324
SSDEEP 12288:ZBUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik83:ZBatr0zAiX90z/F0jsFB3SQke
TLSH
T1C945230B381F80F3C8831B355684984B5A795EB472E36B96F2913F0FDE382C616656DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 19574bda48a2415f62831104390e4d44d93917d05252b5e0248f1251b276959d
MD5 aba62f66cfc2b833c680d4efcaaeea30
SHA1 47dcaf8c0fabfe70fbcb526e1132b2534baddda9
SHA512 6c2057f5115d4d31e5316bd05069fb66c096f65cace8ff6560e705ab589bf1f5818d92b83f46b1a6c5c5cfb25e8cc2f87907c195f02beddb6d66ecf30dbb6de3
SSDEEP 12288:pFUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik89:pFatr0zAiX90z/F0jsFB3SQkM
TLSH
T16745230B381F80F3C88317355244984B5AB95EB4B2E3AB86F2957F0F9E382C615656DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 c596b9ded124fd8a93ef2436cf22a28094976c4f061564278b7e62c81eb5dd0b
MD5 b80f13dfc6f171021e32481607cb3a43
SHA1 ce5e441d53a107d55fdd13fc54557520445b57b2
SHA512 348ec3222e5fdd2e7dd3ed03963138ddf14f10ede5853e866172f79fa0f7e884886e2dd7df76eb4f48e9f834c5736926156ff83c5d477db2212269661891947d
SSDEEP 24576:0ZMSzFVSO9atr0zAiX90z/F0jsFB3SQki:0ZMSzfRaB0zj0yjoB2
TLSH
T1F165019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c69ed3748d998e6bfbcbfdce72ed6f70a1431b1a5dad2057560d5f7d5d875cd7
MD5 672a1b62d53cf86bacd261432dea2a41
SHA1 f3813895ddbd867ba4288d6810481a837934f8aa
SHA512 7dfa875be2dce0bedab1a751a2fcea5a692076d9cacf68bda773bf5c80d2da4864ad544f8d8288aa83be79f1fa42592a8b7e8487c92a999640f67616963c2b20
SSDEEP 12288:1GUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8q:1Gatr0zAiX90z/F0jsFB3SQkf
TLSH
T13745230B341F80F3C8831B355648984B5AB95EB472D36B86F2963F0F9E382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7476ef2320f3da8df4c7fb38695aef938376cdc6745be62c799cbc92545c8122
MD5 2862a2e35258b9bd55fee55cf4c22189
SHA1 02c96ec3e6d49bba5968a35abba70bc0f43b30da
SHA512 6e9ee159655f2c0b2946866c9ea9831c09a50f17d5021804ff4c2fb39f46cc299858ba56f4201742461080b2d032d0189435cc48398922f4a179a6bb5b313d90
SSDEEP 12288:mSUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8q:mSatr0zAiX90z/F0jsFB3SQkf
TLSH
T14C45230B341F80F3C88317355684984B5AB95FB4B2D3AB86F2953F0F9E382C616656DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 dca5108f740519b2b09fdb8f5ec3cb297d6fedfb3ba6c036fb005797fe83fa4f
MD5 cfcb302b11736035d7039df930eabdba
SHA1 de3009939cd2fb46be992980a9c0f9b706185541
SHA512 4f5e6f8b684afa2beb5e5c9e6a2b7f768dbed12008486e7c95a2f1662bf29f5ea12926698a447a264ea430d9aba7d1a85b7bb40d7f6cf7b05b34b92e7612d0c9
SSDEEP 12288:EyPz5L8ZUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8V:dzyZatr0zAiX90z/F0jsFB3SQkk
TLSH
T14D551207326620F9C4639238C9911906F775B83117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9c8e9d2fd1d98c438185c28f5836d5fb78de303682f74b1d12b7b868689b8b39
MD5 f7b490ebcdfffe5fe70c257baaadfaef
SHA1 1058ab07663825dd2e53ed73d24e9a9399b75718
SHA512 3ed5f940f8a10fdfa7a9afecc71537ed6fa06ed05be0e4056e2bbda72fd12447b1b6cad28bf114eee271d4ea457b7162372b28f8c170d9624f1ab05a3824bcbc
SSDEEP 12288:qGUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8n:qGatr0zAiX90z/F0jsFB3SQkK
TLSH
T19245230B341F80F3C8831B355688984B5AB95EB472D3AB85F2953F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 458a71c00d152ded1683af4987f248b1a37192335416e604002dc914a366cdb7
MD5 c85ab7401f35c42cfff6df2fc9dc0474
SHA1 3c85a3fe87d3cf2a8ce298e94f87d92879ece37f
SHA512 ce2f7e0cf2fc00bc0879edbf2d19dd0e24f652c18cdd4e896d5f89b0a7511c2a949b5ce351521822c11fd881ced1da00307532362cc90d041e200e70f46e46ef
SSDEEP 12288:qGUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:qGatr0zAiX90z/F0jsFB3SQkd
TLSH
T1FD45230B341F80F3C8831B355648984B5AB95EB472D3AB85F2963F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 9149cee99105fc4d32a89d9690bf2ba70756e78895ccdf65b11ebb2fe843d71e
MD5 33b833a2ae9439eb92d6ed95f9581302
SHA1 4945e2b41b900c5b4d7ddde7405c94ff1bb25b86
SHA512 1d6d1978f5354036d1fe8ca5622bb0c45dc42fbd8298a71b209585b1a33507f25ed35e4735ea456fd960236acd22e2d8b04b3f23c33b2be44ae22acae7ce4b89
SSDEEP 12288:ByPz5L8ZUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8O:QzyZatr0zAiX90z/F0jsFB3SQkj
TLSH
T1A8551207326620F9C4639238C9911906F775B83117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 d6a0b3ed7fadf59fed89ea2b8a3d8bf998ac835bfa7b90792e20a2ad25ddf237
MD5 dcfeb8f235233c3bc923a944aa662de4
SHA1 de790119850ce341dc3c9bad880616495ba81e7c
SHA512 5d4658382a5ad93c4b7584a40a99e56a028b141b9833fefdf7a2f2ee18b81e9172cd94872ff2f5013b4371d52b1498bc1cd48f11619a4d2dd7ce619982aa139e
SSDEEP 24576:QTHaLl3z0zD3atr0zAiX90z/F0jsFB3SQko:QT6LljgaB0zj0yjoB2
TLSH
T180650195735018F4DCA3823EC9558906D6B27C6A07B0CA5F13E43A6B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 37c37e9f75444ed6767f3a410e411dcf9211daeae818152c6e32e501d4efea10
MD5 09bbb866999ac6bae58424106c851bd8
SHA1 cc13117f7cf2df6f7680ca75b70825e4bf037644
SHA512 8a13f8cc13364454dfa0a0536246140d29c6651bb2651b11111696f19fa5637f52daeeaa2be697a400f88547ef4f0184d646623c310fa7de06d34e4297586011
SSDEEP 24576:s37d9CHKy7GZbatr0zAiX90z/F0jsFB3SQkp:W7d9CHKyaRaB0zj0yjoB2
TLSH
T10E75CF91F3E810E5F0B39A3589758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 dec6e6b5d904896168c6baab56ea0b4ac237107ddb8a8ab4099e5a52d170bf50
MD5 fed82c21c31ed67401c23d1956c031cc
SHA1 e027226d02805b91021e2239e2d5e14e344095cb
SHA512 97c9ab393639ac52b671f8e43a18d81e01dd78431c4f99f5a18b38663ebe38fbc1838ab1670187a085fafd8d69251b1634d5cca95c6e4d1dd4aa359326bcd40c
SSDEEP 12288:0nUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8A:0natr0zAiX90z/F0jsFB3SQkp
TLSH
T10445230B341F80F3C8831B355248984B5AB95EB472D36B86F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 74e0f9dfce4e8a19d8aa7d4849a79f2b9d01ec6ce23600282702676e41d7a720
MD5 01819a55aac468e1d947c58cff4e8052
SHA1 af929af1a10f8b2c2964fa930eaf8559c57af2ac
SHA512 845d326e65bc16d8c491214c5b0674a906715947d96dd76541706de2c962715a0fc204c88447705b48b2f84ad90b22669966292d27c6065a208372d5ce5db5f8
SSDEEP 12288:65UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8l:65atr0zAiX90z/F0jsFB3SQkI
TLSH
T1E745230B381F80F3C88317755298884B5AB95EB4B2E36B95F2D13E0F9E3C1C616656D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ecf5259f05407e9804e25375b70592ae5e90ba7f17525f1dd21fcd26560a99e4
MD5 ea106106aa61f44ecb0ca8e259b1d20a
SHA1 c79187d52bde6d40423eac939e0373c00d1e4dc7
SHA512 f401f5c7ab65397e4abe4fff9db623bf35f15fa64409a14e135c5e5ff080de38a1eab3b8fff400766f89dff159d91f42756e43be5b0e5108d2bfc3ba4f149aa6
SSDEEP 12288:UoUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8h:Uoatr0zAiX90z/F0jsFB3SQkk
TLSH
T10C45230B341F80F3C8C31B355248984B5AB95EB472D3AB86F2963F0F9E3C6C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0a743d6a48dabb4d2c4d28d7703914b76e2783a333d87235bce37b5fbfe2ebee
MD5 b72ca3d35cedf5da29d2896f3ce0e387
SHA1 5d42aff4c3b57b3c77e1de3f68b3a2e698e92744
SHA512 ee7841dab65fff963a432fa2c63baeba84792802004a308013606e9236398bb4bbe07aa0aeb62a2f96e1dc4419972d37659349f2d11fe9f16913e0ae2630a74d
SSDEEP 12288:cGUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8h:cGatr0zAiX90z/F0jsFB3SQkk
TLSH
T14945230B341F80F3C8831B355248984B5AB95EB476D36B86F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e9bde9302f483bd063341dc3c0e973fadb4352b0f84651c0cec682349eb6830c
MD5 989db43bfd4243d821008fcbd7115758
SHA1 9055b2698db8c8309c383b17f0147584a9e26827
SHA512 362d5457631bda6c550f1d0274417bb6a7d2c3a2ae9d0cd9f42059d90590b5de50e6c51346ba04a76ac68dbed690573de72df06232ac9aea66179873db089973
SSDEEP 12288:/nUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik82:/natr0zAiX90z/F0jsFB3SQk3
TLSH
T1F545230B341F80F3C8831B355244988B5AB95EB472D36B86F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 1e1325238c2b242f8201c87206ef5d82be429b336131673f227bd806ad94a37f
MD5 b2d6e71f866f0a05869483aa722ebdcc
SHA1 f9b41dfdc22101c0cb3f03201845277d28047bea
SHA512 e1823835358f6a6af6f361677c557bb3539b17ffc690227efe3baa9a03ae305d51060b99e70bd7ae6ecc4bb7ce4d2e7e9b845a581d38febfbd0884ff5929bfec
SSDEEP 12288:vOUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8K:vOatr0zAiX90z/F0jsFB3SQkj
TLSH
T1D645230B381F40F2C8831B755684984B5ABD5EB4B2D3AB86F2923F0F9E382C715655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f76e17ad9001180b5befc213084d1788d6f12bf26ca74c9e073a7f3ecacffa08
MD5 ab34dd614c6432ffc64e55cd85f13994
SHA1 bcca1e430e185d914f5279b44d23009662e71f8f
SHA512 ee64367e795e9f9523b24574554a01f57b5efc0e3571fb52285bf89e6e29509c555baf13f9f0c31a47e38a3216e350061c05d77c7d593afbf6757811d396692b
SSDEEP 12288:lkUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8R:lkatr0zAiX90z/F0jsFB3SQkg
TLSH
T18145230B341F80F3C8831B355244988B5AB95EB476D36B8AF2D53F0F9E3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 0b393c347a1fd39576e238dc91772ef8c422c6c4b74e17d54a12eaa2489aaace
MD5 86ff6ab66d13d01c690c37055dea0820
SHA1 a2b2a674997f8e42f92f76be90c88cd996c6d263
SHA512 62be51913fe1763b8036b094d190e75ff6c348cc8cda88c0bac7331b3a091606bc44322f894d450272ffb79361ce0ff52ab342bb66da1df35c226cb14fc0789b
SSDEEP 12288:c/UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:c/atr0zAiX90z/F0jsFB3SQk0
TLSH
T19345230B381F40F2C8831B755688884B5ABD5EB4B2D3AB95F2923F0FDE382C715655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 fb3cd00aa35c8167ff2f8317f544cd25a13c7bdfa9f96ec174cda687cd8bf02d
MD5 4f75225bccc6bf6150d103a7b8f188cd
SHA1 6d5019d13c40d5c2bdc88adc66ba3bf5613d65bb
SHA512 9f35e24c9efc71b0470fb7c04bc206c31bf820f4370059eff34309c65340aa5fdf652bac235d919ab8a641fe1de05492d1a0c731cfecbe58797f8cbef8006458
SSDEEP 24576:4fwvok9RX6wkyAIiatr0zAiX90z/F0jsFB3SQkS:gMnYIiaB0zj0yjoB2
TLSH
T19A85D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 096a0a65c0ebf03847c3c737416df42686b9efa0f58b6835c6561e59c27e1db5
MD5 71861224379483d67fe557e28f37fef8
SHA1 66545bda0e67a0170050a9ddb77834ff4c6ca2d7
SHA512 dc6221fcb432cde6f3cacc1f375f7265c0e2b77739916657c1aea394c440456e5f70fad9dca20253f3cf79a3763f911acfd9859383e5dd18bab6eb6c01affd03
SSDEEP 49152:fYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0jaB0zj0yjoB2:bySzPGB2Yyjl
TLSH
T1B7066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d362815b3dc5f3fa13288d2f3cd8bea107dcce42de583d29f1d7c69f6fd7b2db
MD5 30dc6bdf3f18caddaa23e1758bcfe433
SHA1 3722a9c6beaa8b4a9f83df700eba5d1ea7778721
SHA512 c43506c37165f048b25bad23b32adb3822b0c11d56c50a167ecafb6c06f6edc181a2889bb52460d233aff625ba30eec873169814a85c418b639747a710b426f7
SSDEEP 24576:W47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYNatr0zAiX90z/F0jsFB3SQkx:W47JUQj1irIhCnDHUPfF/zaB0zj0yjos
TLSH
T1A765AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 85435c56b8871cb22e8e177f3fb5615ba29fc1171a7af5ba21d42d66b9283b91
MD5 9bb23daac1e2846476977cb26719c1f5
SHA1 0996144841ca8d652578025debd4978f0557d622
SHA512 0e60ba0d7e6664dabccc2c1ca2f0c7c8d741841dd84c1a49d4443cd905edb0a1a70e8580b58e9e6efe7fbaa7d73837b6a8d5f166a7ff87475d3846ad3193392c
SSDEEP 12288:pNsf2UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Q:u2atr0zAiX90z/F0jsFB3SQkJ
TLSH
T18555F00AE25801E5C4AE6235C7544A41B7777C6493E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 74dc2825d6035c485e97f694c4d4075c61904c4b09439bcec118419e15feaa83
MD5 e3a892f6676baa8b5f18cd6d96a5141c
SHA1 e875e62115ea5d87d6b9d776f1365322ca7526e2
SHA512 c9048ff725e3a3a0a5208ae6eb4e73fe2940dafca7f39c548f73dba12ef970f15c9a4f157ec135a3387ed7b9ec8f5d0b1da7b8fc71076c812f549b5040008112
SSDEEP 12288:Vjgvfy5Dgm/cgwbKrrM4RM+PzQ+GLri1:Vuf7gX/M4RM+Pc+Mg
TLSH
T185451800766BD75FC6AD40325E36D1CCAB707D01EE056F0773C88B3F9576668BAA2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 51eed13d83d1b352c01cadf0d3710520be733b8f6b4a6c52940b35a32c255ad5
MD5 19364dca6dd0a50ebceab783311874cc
SHA1 0f9cc6d4de702813e4747db965fc959032149eb2
SHA512 fea1778642997b6d8ca4d3de2500376489d5252ad0d5a8fb3aad5ba643cc46dac329dd292d97b1537b8bf3593cbfcca24fd1bb99dc0b30477cee4ce0d44f6848
SSDEEP 6144:NfINk1uaP4b0IYdc9dkkwrj8KDexHH/8KDexHwMUswHoNNdFssVtXIymlS9wEm3s:NW/2c9dM2cK33h7Vn
TLSH
T13455C8819137A38FD1FB6071072A5F4CAB64EC07B7096F26B7C8053AD86A715B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5c75c25a556a1fef4165b6f0f7498a4066eb06e9a70e4e1670d21910dbfb151e
MD5 9c20b795b4b402b91b09345b25dea61b
SHA1 4dd039e90ab7320ef53e3911b1c968a9e13684c6
SHA512 eb3e8677d46e01b28f71d9389d167e4f9b91c4f77cccf36d8ee4ef7769039210c1e3f9de0befc7c8aff79e4b8aa6d7f596f8f82f23bd0151c853ab1ab8721be9
SSDEEP 12288:YM7+UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8d:5+atr0zAiX90z/F0jsFB3SQk+
TLSH
T1D4452307251E80F2DCA32B3412988816267EBA746BD29AC7F1413F4F9D386C65E756CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e88c5045cc24decf48455b3dbf997da89708c55af09605aa2a1fa5e046dc66f2
MD5 10cb977bda98a8f8ce81da3f84e855c8
SHA1 149396a02c57fbdadab1f5d87e8b02da6c8221ed
SHA512 641dea11a87c573fd44cc768b7fffb4c50ac8b573d71270bf76db64edaca7e5c29b74d3b0ecc31f63a309622bc2d7e3bedd57fda653afa26247217dc2d5ab917
SSDEEP 24576:kgb6bmBIi49WNNFpg1rSvFv7bYgatr0zAiX90z/F0jsFB3SQkv:kgb4mBIBhGFNaB0zj0yjoB2
TLSH
T16365AF1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 a13173f0fad6b5403ece83740099fca4610d0a81572b1d4b1de3c50577093615
MD5 4d43b03c6719c5ef6b4c3e59b21f4000
SHA1 cefcddb358e3aa88519e88e59611be12ace576a8
SHA512 da4c043af8b0c10c6ce70e5d199e041224be599f398da6a31adf62041d61decc942081d4a56700774a9054bcc9a35b0ea50b5fdef029eaf4e87d003c33ba1502
SSDEEP 24576:LG88u8FpJqH1bzria7/m9atr0zAiX90z/F0jsFB3SQk0:K7ZFPqVea7/IaB0zj0yjoB2
TLSH
T14885016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 cdd21abef89ef30a59adb39a163f028e55af052f46c351136e02c3f510450fff
MD5 a9d2a88153bb5a3db9df37a197acfc2c
SHA1 7e1d1085151f77cc5d7cc02d559ca6f6f88a305d
SHA512 d6b52e019867722943acd38379e4137aed841dced733c6c2f7d3c7bfbb1ee9ab988388d6e753898a0292e1db9bbce2769e4e2f1c3e66dd6f8bcba51caaa99562
SSDEEP 12288:ZHvUrBFrEjwaQRUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik81:ZPUr+NQRatr0zAiX90z/F0jsFB3SQkc
TLSH
T17665E11F22AD18E5E677A13D85818609E772B8621352E2CF02E0917F4F37AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8787ca48e454604f9158ac5414b79e9b1a3e2319a7fd7f1a6b50acc46100a115
MD5 a208ea32bca81b455c8dca3a011fe108
SHA1 b63c2ae799114f509cbd2f14bca25c7ce372e03c
SHA512 d6b4c1c6fc876707d7b2d30c8ef0d13918a57278172f522a70bfd454a99a9d6f8069c0223c246e53418e6f93e05c97a5a0194b5b36fc15d784c4ec09f4922664
SSDEEP 49152:8BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBaB0zj0yjoB2:fG05lO43bNB2Yyjl
TLSH
T18ED5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1fb5ba34f2dd2ca17ebdaf8d1786a2ee54b9a78ce9013529489567c9196e735d
MD5 a3f964a27520c5a0f2556d8555d614b1
SHA1 6a1fd2886eae4416499442700f063ad72ebad0fa
SHA512 b2b0190091f23ba8caabd321660cc88fe97242bd954f1ce9a30e7b2829b655174eca3e3d0825194150469c2c644456e5eb8be042fa1f39f1d7f27183723f60fe
SSDEEP 24576:dfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnjatr0zAiX90z/F0jsFB3SQk/:ta5POZ3+Jt2pasx2+m5aB0zj0yjoB2
TLSH
T18C65BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 655d589c0d8669edda3e4dafd76b746d91dfd460758fbef1d97483945a5b2700
MD5 3492953b75ec025ef3ce526847d2c3e5
SHA1 4e6c8e93e979e578a557890ae5a0fe0453fa7ef4
SHA512 858fde3d5048b004d01c0d97c2c88ffd3b022381931e91279bbd4a09b4a3ad182f7d0cbd46fa2cdf86362e3baddf6fe59234f40d4e6ff36d4c87eda91be30d47
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7Fk1atr0zAiX90z/F0jsFB3SQkz:dNc/zEOVHFoaB0zj0yjoB2
TLSH
T17A858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 89bf2ef14ff745150067babb4b4d09c1d581274bcf7e0ea3bb1e51eefe541e0d
MD5 2981c716b32819d4c36128a91e04ffb2
SHA1 66e7395d1becc8f8cdd2f24736c2c90de33201b3
SHA512 4b66e74ad9eb7622954693aaa1867ee227fd16126ebdb9ea2c22bbce769d3d528de0131e676886382b8d6f237616c5bf4e0bd5025d0c5ac1f57ed39c2ba86e0d
SSDEEP 24576:08kNvNnaFeYhJNtmZBm/atr0zAiX90z/F0jsFB3SQkk:08MwBtOm/aB0zj0yjoB2
TLSH
T1C155BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 1e28f91ab8f373dc9c2c3b45eda2505e11029d59ae25420526e01af969bc7657
MD5 5ffd6acd3ba9f5cdddf69f76d8e9bfe6
SHA1 44733367512525a5ce10f8a1c1e752a0321eb2eb
SHA512 08ccd48324bc541bcc2f9ff2802473d39c6379e4aeae078725dd8bde02a2bf2e1e2a80dafe713222146fea91d6f86da8b61fc0e77abfec2c617a7844e0e08749
SSDEEP 24576:ZD3FHshBIYQgAaatr0zAiX90z/F0jsFB3SQku:ZDVHeBIAAaaB0zj0yjoB2
TLSH
T1FF75E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D491BA5F2BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1052-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1052-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1052-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1052-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1096-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1096-80-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/1096-311-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1096-85-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/1732-115-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1732-122-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1732-314-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1732-116-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1792-384-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1792-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1792-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1792-91-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1792-97-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1792-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2916-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2916-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2916-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2916-22-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2916-15-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2944-1-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/2944-0-0x0000000140000000-0x00000001401E1000-memory.dmp

Download

memory/2944-382-0x0000000140000000-0x00000001401E1000-memory.dmp

Download

memory/2944-66-0x0000000140000000-0x00000001401E1000-memory.dmp

Download

memory/2944-329-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/2944-7-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/2944-8-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/4160-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4160-103-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4160-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4160-315-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4160-109-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4160-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4376-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4376-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4376-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4376-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4488-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4488-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4488-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4488-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4488-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4488-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4548-68-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4548-69-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4548-75-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4548-310-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5060-62-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5060-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5060-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5060-295-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5428-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5428-134-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5428-128-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5428-137-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5428-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download