4718b2acd0a05cffcfcd18ec8f49615f52fe809f4ff961410077abab8096fe17

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 10:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 3.0MB
Sample260801-mjn61ssflh
SHA256 4718b2acd0a05cffcfcd18ec8f49615f52fe809f4ff961410077abab8096fe17
MD5 d4c6f21fb3385ad825bff41f9a56774a
SHA1 ac033680f206dde688c6b3a65f49b44eff174aba
SHA512 03e0df0f75f5c748f61102abcab417b9079c5cb053b5f39bc81f82ac53be50da70d5b69df95ab433f608b985696b519e2e0c876d22e85259d6d1483548dfcd7f
SSDEEP 24576:abfbqs4YskoVVtE4i0ZJp0Rsivg+6h55H863IXSHa3sqjnhMgeiCl7G0nehbGZpv:ayHFVdDZDfivg+6h+SHaLDmg27RnWGj
TLSH
T13BE5080673F807D9F1F34B7849756A1598B6BCA9DA10C39F15A1710E0E32B988D72B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4960	elevation_service.exe
4968	elevation_service.exe
4404	maintenanceservice.exe
1040	OSE.EXE
2300	PerceptionSimulationService.exe
3100	perfhost.exe
3876	ReFsDedupSvc.exe
3416	SensorDataService.exe
3488	ssh-agent.exe
4684	AgentService.exe
2404	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ecd4d64d23e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f302b9fca021dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000035c994bba021dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	4684	AgentService.exe
Token: SeBackupPrivilege	3876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3876	ReFsDedupSvc.exe
Token: 33	2404	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeDebugPrivilege	4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4960	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4272	2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 3376	2404	SearchIndexer.exe	100
PID 2404 wrote to memory of 2688	2404	SearchIndexer.exe	101
PID 2404 wrote to memory of 3028	2404	SearchIndexer.exe	102
PID 2404 wrote to memory of 3348	2404	SearchIndexer.exe	103
PID 2404 wrote to memory of 4572	2404	SearchIndexer.exe	105
PID 2404 wrote to memory of 4040	2404	SearchIndexer.exe	106
PID 2404 wrote to memory of 2428	2404	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_d4c6f21fb3385ad825bff41f9a56774a_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4968

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4404

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1040

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2300

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3100

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3876

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3416

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3488

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3376
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2688
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 1884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3028
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3348
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 1884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 905c276c292a2a2c945c2f36a0b52df01a865c247879c9ad2e755cd3dc1b29bf
MD5 167702bcec390e9a55f912a7b5bcd9c2
SHA1 d4b709aca8e3c117de9301ed1043a5a8da131244
SHA512 d49948190518f1ae1f31247ea5bb0f21d35ca5b35cbb18f6199a038290d68bbee49bcffa78dcb7223facb78c3f3b214ef82edee5cb687aaf2adb0473d8dc66b6
SSDEEP 49152:8b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnVDmg27RnWGj:m3q6sjBeD527BWG
TLSH
T127D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4a92f229c4f6d73b2b3e066806073eff584671765d39262c7fccb2d5cb103274
MD5 3503e2868675270293419614eac162e8
SHA1 1d25dbeb46e836dbc604cda62dd14eb12c62dc18
SHA512 4817ff64bac8afb0d5db8cbc3a43fec8799269fd7abc215e273e178815762b09159e2217ef46b60c02a739f591a7c1b3dd2be535a4bf07b6c125af63672618fc
SSDEEP 24576:NXYfDtczA+sqjnhMgeiCl7G0nehbGZpbD:YtcbDmg27RnWGj
TLSH
T15805F129A3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 88b6bea0a9af05324aea72720ddf8f7fd71423bdd7447c115262c363b69cfbcd
MD5 f371857c888d3cfcdb4072174fee257b
SHA1 b34a38ce157ec28929aa2997de091a9cc1f821e7
SHA512 8cc1141c54eea8ef729f3876823d9f1e112b20a850b69e0bdc3dd47dd48e208b51de57ec29d0386ac380e4ef9269af8041d658dc56e5aaa3c2f37f23a1981fb8
SSDEEP 24576:I0Le5ji0hmxxrMpsqjnhMgeiCl7G0nehbGZpbD:IPji0Aj0Dmg27RnWGj
TLSH
T167359E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f56cba80b2d8ad17a0d0fe376bc8faeed8e5c44176043284b1b64163fc7ebb86
MD5 8b8d6da2b12331a7487697a6fe5c6602
SHA1 4feec8c2706abd64477b87cae9cdaf3aabe141fe
SHA512 a6b70fe604fc65ba4925a87bf4213e6694dd5acf36574a279a738f9807aa074aff110fbb4f0ab0a1b078f7a546765b707bcf446cc23cf6cb4ac91d1847344aed
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWn6q8wyu3sqjnhMgeiCl7G0nehbGZpbD:N/ezSC6vUzPveHjyIDmg27RnWGj
TLSH
T162755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 56c53bdc4d5a98b6ef47652104cca9029fa8f3620b7c4547b90e01ae05bbf69e
MD5 3d07d9a87841be73f880d8a2778d8ec3
SHA1 e825980a3c2d04bf5bcd46bd9094943ee7480f4e
SHA512 2952b799a182eff3aa58ddf64eb8fd561b806d43fa531037a572ad11ee928a345ec02ca23564ba13cc8eaa369d1c196766fe16fce578c626d1157b5cf96ae42e
SSDEEP 24576:bVbqPb88hv/l+Y6sqjnhMgeiCl7G0nehbGZpbD:bVO88hXl+zDmg27RnWGj
TLSH
T110559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 99150d48fca85ea5c83c11661ed2699c419436ce31dfe08e616ecc8a78064794
MD5 018dcc83d7ca4f0ef49be4a16b7ae70c
SHA1 211211fbd304a5601b09e675ebd8158027efbe30
SHA512 238127355519654e524692df54325a88cdb1cd7e696150688f855d64d1b2cbc030cae2ba55af4934c2720652b86c0a6264a12fe7897cc71db148a4012213d3ca
SSDEEP 12288:NLFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NLFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14BC423BF864C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 280c5e5806b84dc7793c22e2b0608cf2779db6ea577fb90182035b0ca6efda29
MD5 5c508643591de72fcb49063238bad90e
SHA1 963b30a97c73ca14a647a64f7695a92569107b1e
SHA512 396933570a91a43329e9069eaea793f8cf4954dbd7d60ceba4ef3dde12bd6b9f1a08a3eae02757117e789f47e344aac49d391b62fc8490597fdbef8946ce73fd
SSDEEP 12288:keBNUbTVO86UCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:kJIUCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C705CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7be7e37fa3a85e3a94a52923f04c8ced8583c4217730fa27ed99bd66aa795877
MD5 3224361d08356c303fce150a9d01be11
SHA1 5b7415cfa09d07f459a5d3f0eb82f4f9d7ee945d
SHA512 44dec40810adb496227ca5612b3170e6f886e1a8f33d538ac8f735e2413ef0c56a727c423e9fc3dd99a94c7525fc0d686f70048558d4c35642969d83d0e939a1
SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH1:/QvGAdlCEL8c/DRNw5C7D527BWG
TLSH
T117266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 d33f76cd50b987349c0cbc5fcc6930fed6b2c9775b13fc8b041c12f3fb16721c
MD5 3abf45580b53bdc83dbfcb9c361db2db
SHA1 61b6e2897caf8e7c6228f88cee2bd75eba0bc42d
SHA512 4df3206caf77ae65f90e3e0fe405a384fd1d777823bf93ffac8dc7f1a92481c1fff8761678d490522789bac3bcc65e856038d4b269056689a5ca6c62920adc6d
SSDEEP 12288:oAwSfxL/2Dc3RDLLmt0LDQewsAj4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:N0ewsAj4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DC15E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 804cd88cb408f5d7d7576a053929e5bdd954d9ca7e37f5d73b4fa325b57feb5d
MD5 45811d197946e11bba88b160a6cee5d7
SHA1 b5c483869a2aedc02cda0cbe64bde70c9e874c32
SHA512 c6de3bc153d2438e06906e666c83437f64685144ace5fba7a64536b0d3e8fd9a86766154958c2d61f6ca38955065b187992abd1c9a0411ca59fcaf13120db45f
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHsVQBWG:ZUEtQevvqc2W1cpV2tI32zB
TLSH
T114474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 08b3d4c01cd64daa5c40926204b48044096221dd48f9cbbec38b79dad934251c
MD5 a7156cd0fc19a16ab8474cdab12bd6c6
SHA1 460752774b60847cee8df07343e357a23742919a
SHA512 ecd0b37db2ac05d9e7726c5344237f3fd211dd044b45fe2ad98a8b9b6044291968cd2b51f1501cd4db0ce8886aa57c4c22ef9e4fce7dad31aec980c6309cb032
SSDEEP 49152:yCbRquA/m2yL5zTfFiV+XenmE3/zEDmg27RnWGj:XoquVjnmvD527BWG
TLSH
T18AD58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0780786dbb14c5a9e91e53634b729468cfca24ac5c0688f6439a7c831715eb0b
MD5 9e4d8fbd8da4d7ca39085afd490c0ed1
SHA1 5b89078d9bf5fe73e9ff2d331a766fbc95a81ef4
SHA512 4fd868e9144fffe01eacd471f85513095331d23fbfbf8ad454a8e8966d2c4c62ee75b8791e4f5825b4baa789e71237ca5de8c60a8ec6045447d436b2b36768ae
SSDEEP 24576:pAhGL3IFoiwtA5l7S53bsqjnhMgeiCl7G0nehbGZpbD:pAMUFoiq5fDmg27RnWGj
TLSH
T122359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 9528caf53dee42757220a8ff5c4981074f6d5ea0507ad3680d73a57eb8709436
MD5 b1bab33f2f725f61d00e76a4b7f201ad
SHA1 8ff920bd8768a3864a59db65a40d048d4cafded5
SHA512 20a4c53540c88edd18d225db79983eb4a19f0be867f3b02635c6b7039dbaf0ecc509e46dd6914bad70478fc9c3b1b7fd84d60fb5a676913949544f4eeb560454
SSDEEP 12288:Xmw5HEjsChNVBFgl0WDm+CXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:2wu4OW8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13B05F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 1c73550925cd4323334f2654449be1e483b2b5519bbd36712e7e4bbd71723a89
MD5 3dde6e609b69c755a4681e7e38bd5cef
SHA1 5681d4f02a9906ca91955cb8a3513bac01a7cc52
SHA512 782f11cadefd9c3713eefb5e4ca7b36348c1d36f4278ec08a5abf7d3a74993cc7cd68430b6b8f6188d8b1da9022cfef5a9d42f5fe4c78380241a15a67297230a
SSDEEP 12288:/eZ1IyoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mZuxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ACE412AE239820FAE1A3417CC5E5D609E7333C62673043CF166656AA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f921b44fd247c6986972f331e8592352277a1022d02751bcda9f7c9fed3e5adb
MD5 7b250dbd46e1d30c8ecbb82ce3e9d0c3
SHA1 9b100779e6fbb70d54d305a73086792672615e9e
SHA512 bf9fafe06bee82d4456607954442cb82c1150d2edac5746dc5d23993f71d1f772debeacf2d6e29e3db131fe04e08fa74dd132d372beee82d7a2fe4083ab29ae7
SSDEEP 98304:wQRQyi36YOcPbLvw2gAf+PN3qD527BWG:nQyiKa/X+PN6VQBWG
TLSH
T1A9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a7e0fda07b658ea5d141ae5577b4a16619bdfe4cc06ae98d4297d8b3ed970864
MD5 051967b0398389b35d43a23dc3d1d465
SHA1 cfe698f018b881dada6b61bd9fd3d40eff0aceb1
SHA512 9af2d106c3a2954f0dbf998f67231f7ca0a94474e82a1a29993182c40f249e3052951d0438883bed87fbe2879c00b9b899e78e0a32905aaed5047c62820699f3
SSDEEP 98304:YQRQyi36YOcPbLvw2gAf+PN3qD527BWG:PQyiKa/X+PN6VQBWG
TLSH
T100667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a66756c1e86068ae9a455950963ba667f062d8d411d01fb7fee2df54a6930ee3
MD5 cb16626bc66a065c15279857271f9ecc
SHA1 55e08cf27c79467eec1977f8e9dd6801c4a74345
SHA512 68b9328083ae5ab20886d57757bf3ade3226e9f6bb6cbbbcd0b240c6e40a2649b59264f7e0dc62c81b02ef5e24672afed1c52a756cb67e52101e2ea0c472bd30
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0BsqjnhMgeiCl7Ge:C68Qg55nhceWu7PNU3/0Dmg27RnWGj
TLSH
T1C2B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8de5063961f51450fa136d6ccafa044e069c5c96b61f7d700fbd5233ba042307
MD5 738c16de17adcd5e6daf6ae536264804
SHA1 847480c38fcf640a34abaaa6e4c6c50474de121d
SHA512 68e786c7e357d67f061dd6584bdb6194938bcb1d2009c0a4c0a611aabfd966cd481e26b4d7d2e945c0e5f552fdc5236ff50df9efa081842be11b2941aa7de509
SSDEEP 98304:Ry5112gYy5azzVvt69nLKnhZ5D527BWG:sLIHEWhXVQBWG
TLSH
T103167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5f5903b0aa70d149336197e1c12159d0f893394bf0fb0e0b554e147541935af5
MD5 14855746a82c7a30b0c0dba821951af4
SHA1 840fc01d033ca9986ee7d25215892fdab23366d3
SHA512 c350bd690501fa5643a5355472e5126c37cc1ec1dab17633ed2f07cfac21d88136444956446fae03e35671c1efddc6b97a3b57958a6fb9c7988c21c75e92bc07
SSDEEP 49152:zB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gliDmg27RnWGj:Fu6Jmdxd2diD527BWG
TLSH
T114D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f8a91ec286c3fb90a4101a7edff1d677c7e95f9efec64a766186c3f7bce9ee8f
MD5 6309e7cbdaa8706f35cbf48e2910e269
SHA1 dd4beffeacd73e40af46582bb982cfbd1da9ff8c
SHA512 7871665cb319bf542a317a12e30852060f5b56c7c1c8757b2801b43a6c83eab4c9164f1e80536c93fb814e9d62798ff49aea011f23606249d2edb912f061f9ac
SSDEEP 49152:R1hpsNoJpF1A63U44CwH7R4xmDmg27RnWGj:RmifPWRvD527BWG
TLSH
T12CB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2b27e215e39951d931cf4e3b5925433fad7d7500ee3449e197cc5e2b3f27759e
MD5 15aa1cca9950305a8f4426ed598a0da1
SHA1 ca13a6bdf1a156398b87e92184662404a8dde76c
SHA512 ad10a4b24b920ee973ee4e07919e1e36ac08ec17c4d9600f95399b0e30c8830ad761159a0e59ab45fe2d24c6cb9cd4e7381cccc331262987386e43a6ff0a3d96
SSDEEP 49152:QSuZQIY0Be2KcRVtOnks6NMHqFDmg27RnWGj:K5dKii61FD527BWG
TLSH
T199C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 301d124c49644746555e4eac6c445b44eef1d6beeb9fb617eb5fb3b3bc8dc856
MD5 3586517cf9246436a9c04ceddcbb2f86
SHA1 769685fea29ea21e987245ffb4131035b4eb7ab8
SHA512 4322ec15762fa862a148ab8ba9563ac4a4b20e7413c65b124424bc4b91cda34a15845a23e5a0c4f45d8c2f018c984d40f30fddc381073a22d442b6f567fd43b8
SSDEEP 49152:ohtSn8EApI0fig3giDn0AP5wSDmg27RnWGj:5X2imphjD527BWG
TLSH
T17795BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 2c5d8c0f524fcf97e0cf998e58d00146c2b57fb20ffba653e1d682d27935767b
MD5 2b1022b189785a08cf2e96f871c7ac19
SHA1 b86c197b211849d33e7f7e8223bd5dce2fc4fd7b
SHA512 43a824d17d14ea700116331d788fc15a94cc18b0aa0d620a5c548bc5bc751a4067bc949ab16b264ea3c5be1751e2270210e32a56c9b836d1c7acdf8721dcc091
SSDEEP 12288:DtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T167C423BF965C41CAE52648B5C3E5F14EAC073E57E92004837AAB7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 9b9d65dbd52e138151988e2bdef383c2e328cb6eaa935b23fce176c4999546a1
MD5 10ac5037328f5cd269eda77adc20670c
SHA1 c8f50d5306ec7baed8bd13adfcf6c21c9a64fefa
SHA512 db56d3a970ff3feb471ded1e95be3856d2b6ccd342604c6628f9915641b446bc26e12ddf2b3f036a4aa40c2bae5c615a4de09f5f6f2a123cbf768227afdd4f05
SSDEEP 12288:Y0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Y0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10BC423BF965C41CAE52648B5C3E5F14DAC073E57E92004837AAB7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 6e9bed1f2fcc1e87ba12eaaedae26e1a259de887a2787ae8d19e1c973544101f
MD5 243e2e93906bcd54167d86d5f172361a
SHA1 2e6c06f89f2e15d6d99172ce3cb5c0679de5b7cd
SHA512 04a63dc3b91a5a6173b22f224ff99e35474593f26bbed892d01be297958af4c7f236baabf14c49f60b4718a1db909943b3ebabe5f59ecd2fc0d442a0f62c1136
SSDEEP 12288:SKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T177C423BF965C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 3b9aa4d56e981bf369d119723b9cbdb720c005dbc5fdc3e1fb9744e925abe5b8
MD5 110b790f869fee58a8ce5d4caef914cc
SHA1 3a6ed4f610e90a21b8cf9a18b6e963d17c23b044
SHA512 32b10c7ef55dd6e07c0321b1f526cc84a17d0fec87a71abca7d49bd42f037a34fe8adb086f55d87a6a69af8727ffffbc80238a1ce0e79ff92b788b48522452c2
SSDEEP 12288:yV7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T133D4236F675C00CAD83285B5C2F5E11DE8237D96EB3005DB6B532CAD5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 eb18d233153541b2e9ff25c1af4a030cb02a3f426a43f09e7f5392f965897e57
MD5 6ec59c166800f3cfa4b15b86d15b2984
SHA1 e0ac4032502ab25b905270731fe59c5ea377c2de
SHA512 1674e187d2a571297a1b5a020c685ec6a6ea7fb72edcc95c6a2667272dfad1dde91b82684cd9956ff53c6826c8c6786511daa100a0e6a16e99c8ae9109c32dd0
SSDEEP 12288:9zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T175C423BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 2533a64968b6b30aea3ae59b79b5401df0d3b3e546ad9c7581e71f2d88ae4524
MD5 70e624435eeb056d3bfe747691310ca7
SHA1 25ab9b6e9d97230febde53a7330813e16e8d7ea4
SHA512 54a4a98348ee168754e3cee088ea02faadb0263f153c9b7ae798d5c6b300303194d626eb8aee3e04864c5215eefeca2590c05227f97cab83bfac555a47e944e6
SSDEEP 12288:+gXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+gsqjnhMgeiCl7G0nehbGZpbD
TLSH
T167C423BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 8f15110e064e9d77eaaf129cadbff6543f1c3873bd8423380074dd34bdb52732
MD5 fd2b6f18f0947a23a44b11c856ba27fc
SHA1 58ceb5d0365c8bfedfc210eeec9127e395ad1a8b
SHA512 f277a382fefd08127a96b64cc9d4791239c264d3d9cf18063329aa2dabe3af97f0f11d2fa4535ac40d337de62679246abbaad14bde92d80780d19dd26819256d
SSDEEP 12288:DMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T180C423BF965C41CAE52604B5C3E5F15DAC073E5BE92004837AAB7CB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 5124e40e588f1dc9e8215762387cbab146fb0771955f846389956ec345e19277
MD5 6fec64b96c259ec7a9167519cdf05a90
SHA1 d7f5ad096ccfdd3e9858c348b9c52730ae8829a3
SHA512 d0c58f8bf6ee041bf5db11ac3605fe0bb9f2a39a134c6c537cb0d11ab7f28cb1eb3344de6be22343014c7a2201722422a3bdb6c4ca80fb80cbd30248ceacc4e0
SSDEEP 24576:QZMRzFVSOUsqjnhMgeiCl7G0nehbGZpbD:QZMRzfMDmg27RnWGj
TLSH
T1D20501A9B39018F8EC67813EC965D90AD5B27C5A0B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 1e46d7f369df3b6fe3fd8e8a24d606cc21726f9c53fb9cf4635a817a7869161b
MD5 0b63afcf3e124d489e12e98763b51c3d
SHA1 13917bae4de73faea8c71ed319b99e9fe4754cb7
SHA512 7e4e8f82fdbebedb6aceb723f0840a6b8b005e5a8f812d561efc99181a3710c7dd2853b52aef7d4f4f3ed38815e15de10aa40ab4492bb4b161dda4ce61f69823
SSDEEP 12288:ghXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ghsqjnhMgeiCl7G0nehbGZpbD
TLSH
T146C423BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 70ef855579b3949b6f2dad108896056bcda9c8d445f73765b7cb017001278d85
MD5 89316f0566e887423628f9c2c071a4a5
SHA1 510b9f91b390bfba6e92afa0dbe0b33a931824c3
SHA512 6ba7c9bac329f433a784c5b8f8c246c6973b9ada12d06674721149d71e843b7b2caaa682c1f51434270635939f79ec46e6021d9e313546d61ca023b9ade5fead
SSDEEP 12288:p1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:p1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T116C423BF965C41CAE52604B5C3E5F15DAC073E5BE92004837AAB7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 3ec38d8276fb729d5b0905bd26dc5d2554f2dd6f6224f87f1496e7bd699067f8
MD5 5487eb846e3c77f35203bc1ef1034796
SHA1 8c9bb15ac40e2b2f750ba993f0db5b76fc1b3aed
SHA512 ea0b0292cce496f3442f9602e49b7798559cf6849d2b58d07ce76944cbbbda57f9b8b1cff815eef5d3e6f2da5576563abdbad2d412079b85e2541f8224c21684
SSDEEP 12288:CyPz5L8oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fzyosqjnhMgeiCl7G0nehbGZpbD
TLSH
T15AF4125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 98589e338cdddfbccd634ef5293963cac38542acaf2f8f2031246dee6134f3d8
MD5 34f48b54e26cb87efe90c973c8f9d17a
SHA1 92471a0f36143f61fa24a7bcb5e80d8572472d5e
SHA512 d301f576412862b59a901b485507a8d1086b773f33926462970159217deaf604011b82b03be97afbcf27806c6ce25b1ebd910e8d954bd70ec6da4c00f5788c71
SSDEEP 12288:9hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9hsqjnhMgeiCl7G0nehbGZpbD
TLSH
T138C423BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 26c6119ea84ab80f24899fd748ac84909d5cf97bf2c31d52507d33ad40fa4c92
MD5 a0b21c4ecddb6b124676be446e28fbcf
SHA1 a95e040e930a853d1b63f1b95a43cafb5d029f4e
SHA512 4036eb482fc51255f72a542bd259941e4023998bc28938f396aaadb2a297900a596dfc169d9e9ed309f3146b2f257acfd14c0a735bd3c659ede2ef889fdb545e
SSDEEP 12288:xhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DFC423BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 db72ae4225076fdc4ffaeb742b7970b8f2ad489a58d925fb560821af16791e4d
MD5 c15764c77e3d50d17721647d1f77e420
SHA1 afa45176d1242749332546c671280de694aef7dc
SHA512 6d1a6203ae058e1ded1ad87599c982836147f6ee83f1548075d0460ac6517ad90fb19315e4daa2f90a39c639057327d8b5c8f55fe3f672cfb57d5c0539423c9d
SSDEEP 12288:TyPz5L8oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ezyosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DAF4125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 8d051102fb212034a59dfbf011dd37ee41bc62e81f424f77e7d1f1b2e9d3b192
MD5 76212d696d8d23c6a121e0007a3316bc
SHA1 78f43b5841c8caa3118aec294311436f6babda31
SHA512 5aeb4a19159d54a7aed811277af0454df091bf6b90e4de2046037e184ce42106fdc2883912d313155c904d2d0e8e8c07a519e4256e1684ec78d9204b12741eaf
SSDEEP 24576:uTDaLl3z0zDasqjnhMgeiCl7G0nehbGZpbD:uTuLljLDmg27RnWGj
TLSH
T1990501A9B39018F8EC67813EC965D90AD5B37C5A0B70C61F13A5366A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 409d5f26ebf46290a25256b4c7d5cf353eb94dd1e679a2d6fe87fa0dd8114b17
MD5 27ea3317ad8a6134ff51267aa6d2f7e5
SHA1 4f922b1ceec5cdc3fefd908b74f73d2524d55051
SHA512 60f4c9b47323430acea585cff6913e020f673b795d0df4a4186233562c5117e395ea0861f5b70316dcc0b9280ae4266ad668856f6c914805670442998f376882
SSDEEP 24576:23vd9CHKy7GZGsqjnhMgeiCl7G0nehbGZpbD:Yvd9CHKyaMDmg27RnWGj
TLSH
T1AA25CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 6a31ed8f61c9ef44c7fd325237bbd8b0eaf13b4a2c4a564607132f17e007721c
MD5 d83b74c95a0f7c7380f8d9c39a2247f1
SHA1 8d7eec065f13589897490f6fc6f50c71a3a1992e
SHA512 9769ecd175f3bbe2f1a0b831f37b67a56d8e7cc58cc482d4d2673c33fa8cb4918b8b16f4d0e51bb60d2af82f3b2b34f16e65a7602b01f8b6d560d6a35694022b
SSDEEP 12288:SqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13BC423BF965C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CB9FBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 e7c8a55fd48e3ac092b0f6d00e93de836ff68a25171f37077d8d13bc05d64158
MD5 c864316cab1592a95109dee985f55aaa
SHA1 ee7311a7cd31e99d89f6c60b51aef76952fd0284
SHA512 7a54b633a09c1e1da5bae5386752c0313abf38eb94da3dd71287eef539b3911a5b9f1a1c33fbabc9827fe68cce83c9a905af64b7459380e4416a3c1081609d4a
SSDEEP 12288:eIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E9C423BE965C41CBE52644F5C3E9E10DAC073E57E92004837AA77CBAFBB54584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 06f0583c6702031d59fe397905ebcb0ef3fa5d593a2f1c032a7bb224acf46595
MD5 b13ff023758cdec1de9bd75df00148da
SHA1 4ef22d4435c86653594f31d883f5e04e5b81e1e1
SHA512 a5298bb9eb9ea59f9c372380d4396afa5c546227b528402103b7ee736fae4d77fa7a24fbe43b74e7564595370ecbb8fea3bf9e6ac541d0b6d09fbb757309c67e
SSDEEP 12288:vvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T179C423BFA55C41CAE52508B5C3E5F15DAC073E5BA9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 c648deeac1fa908de436900c979dd8485c3ce54e601bb49b56ca9cc67384fdd3
MD5 8e2c49311df0e221e2f865f67ef69862
SHA1 73de2ff8110a62c0e78fcc6ab8b4154efd382b15
SHA512 23f1c24b33b7f49dc596b7db5828131cbe841dd1c94535ce45d0f49f9d16c95c77f7bff254b24ec371fc6bbeb31237c9f7726861dfe26ca83164d918527ad257
SSDEEP 12288:0hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0hsqjnhMgeiCl7G0nehbGZpbD
TLSH
T121C423BFA55C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 046caf6f16ccc186ca17d9378c91948eaef6a70faecbfd96352d6d4c8653e9e6
MD5 b973cff6215f90593128b6288f99a417
SHA1 6a865af0ce67ec3a6e6d76633458037327f5706a
SHA512 df814a8aa06eb1f964135181fd606bbbb6e94fcd5fd0a4b7a51b4293013a99ddb9ca3aad92fe7ca5f1d11c01c0468a996b4a7bfefea6c9511b09b9bc64628b4c
SSDEEP 12288:MqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A5C423BF965C41CAE52608B5C3E5F14DAC073E5BE92004937AAB7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 2499a00f75c80fb42f01d93e7e22f19b9e6ad9c2e146b661648db5b55c08c774
MD5 716a6dca7df70e1c5022600459d9f083
SHA1 5de0d56f87cbd530f9de7d6c334c52281a516de7
SHA512 87d32c026e33ebb4b84ec472437e3419ae2b63e3affce11604d0cecbebff866e12bc5cd39a1b1fe3da864d65b09d9a18f0b9c570adedf1f480c27fbb69580536
SSDEEP 12288:W5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:W5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T179C423BE965C41CAE52648B5C3E5E11DAC073E5BE92004837AA77CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 e0c3206ef4c65a2a0b00f761e866a349bbc301e832b6290824ca5710b51b7ebd
MD5 92e2b73b1216a9a1655f5cd75856b0a3
SHA1 e177984690d8de70138ba93634e9f07e2c0ac1b5
SHA512 cb720b453423ae18430cb24e9204903b12debcb948db4c2f16d58258e61d1671b407ad976142ca0e7df089cadc6383e0476832c03202b8576134606cac7e9fa6
SSDEEP 12288:KzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18BC423BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 a61f18347c83e3cef8de27b5a4b463fe948524d140f65cfd16a9a8868d97913a
MD5 f7afe02419ac806f7bd143e718b8cdb3
SHA1 7a9dd5afe0ce032f2b8e61a51537b36ee8a97d02
SHA512 ccd9b2ea8d0b960efd507d88655ad344e3f56de84086600e82fdf30ea3c0b60ce35faff1f7309ccc2bee794aa18a54a057e337c16908e8c374539f096788eb66
SSDEEP 24576:DfwvUk9RX6wkyAIlsqjnhMgeiCl7G0nehbGZpbD:ZMnYIZDmg27RnWGj
TLSH
T16635D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 328188f0cf61017e57e6f8093b80b2eb71cd2e391a561ca137b056dc2f4bb0b2
MD5 27a96af20b0504c96ccdf94293dd79a5
SHA1 e42c5d4290c025f73dfb4652b107d7f67780e835
SHA512 3f1772118587cf3972c031bbcc9147e5c82beeb6345a51fa3b104b0b3e1920f27371f5507164f97b8e186cf8301573bdf2cb257045794f23b1fe9a0d2c6c6d52
SSDEEP 49152:oYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0yDmg27RnWGj:/ySzPKD527BWG
TLSH
T1B3066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 17cf9d2ff30ddbca1e707a9a90e8b87578579ba9bb4e10c6349c068370828c7e
MD5 bdceb83b84a57e005cb8e3ab3cd60a58
SHA1 e9246655d57eaa2440dc8e938cb11d62e72e53bd
SHA512 eada26bab25fc68a1a895fe1efa3a03789ed42696129f2082465a223739cc446fb3fa1a8d97bed39246d883707349fe716c0aa7d4f6c75cb5d9d3e43d30c104a
SSDEEP 24576:847Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYEsqjnhMgeiCl7G0nehbGZpbD:847JUQjTirIhCnDHUPfF/iDmg27RnWGj
TLSH
T15765AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 12b511bc435c0c197db1fc2be10af6acc052bf4caa62d90db63e8ca60819f098
MD5 6cee5101b5263ed20883c9408ac0a0d7
SHA1 f6a42e803193cb0788a2e541dd72ddb94871d902
SHA512 8b932a0478e9faa058fe8d5690ccca189d0335a4381cd891754e1a441e1c91a9a3faef4b232a467053bc5e9dd20026b4e7e77ee3b9a846a9c73c4b5814762d84
SSDEEP 12288:8bsfxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14CE4015AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 e48040cc1091b1c670dfebaadb9abf455871b72c04d0a8c5dbe9632ff4b6c32b
MD5 9bc55f0833b03b80882515bd2ca31344
SHA1 08ded444be181b8b19f9bf9d090ce8adb7c72b2d
SHA512 113a1e796d623832c3bd425846b6f8cd6fd3756f97c276a37b28531c7a88fbbbede9c65bfc263db4d0f407367dccf03d3b9bb0dcc56bf3d2bf20a01eca0f5cc3
SSDEEP 12288:M9k2U3fasT+BWivCy9t3uS+lJTusqnFFpTfxepP4:M9PUP8BZHXujlJTpqfpTfk
TLSH
T1253517117666D74FC66D40325E33D2CCAB707D01EE44AB0372C99B2FD5B6658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 01f35e0a6b05cabf7c9b8028baf4be023d4a35e0cfcb485d5c48ed7a7f31e613
MD5 cc66acb8ecd8eddb7900636298ff3b7a
SHA1 ffcfe8489ba33ea94793c5f89d34628d953f0eb7
SHA512 d4e4cece6e48c74b1db93460902cf3e5028761f67f836c83ebd6513b970b8442c8f60d6d00a8663260a4dd268ab4bd784f32285d6b56bfc9f78f31f83399383b
SSDEEP 12288:NtPCDWQpGN1802v6akpJ6pDooc2U9Ra+BSuOg/D4yL:NtPC+gv6akpJ6pDooc2U9ECSuTDR
TLSH
T12365F9406536A3CFC1BB6072072A6B4C7BB4EC16B7095F2673C8453AD86A716B1F83D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 5830cc4d32d23ac743211131296f0c1299b30c2c13651b29bfd26bd6500e9d14
MD5 3713f4ec2a4fcd1fcf9590b20e89bfbb
SHA1 9e3ff19486c19513c69572b8924968a22bed786a
SHA512 7f5b305afced0916ad4676e1bca1a2cbbfbe6548e489c09c070a32037cec59b65981a6276a5735b7dfffeb6278368fda0ebd8600b5c307aa03fb546f57d43550
SSDEEP 12288:K07JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CED4237BD34C518AE83609B482EAE12D681B7E669F1044C3B95778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d6cac0d1aa4093dc96c5575827be64dd5856bda689bc6c7494b47a85d92831a8
MD5 effa51131bf93aef23c4e748ede16941
SHA1 c91554cb9f7a49f36530b10f83b913e03e5dc272
SHA512 29fe52dc26c424959b22cd3938988e8b807797ba9e6364d394616df8404c96a850316a356c70442cb92b172653c63e94d97c05dca1e1b13fa6af670a9201dfc9
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bY3sqjnhMgeiCl7G0nehbGZpbD:igb4mBIBhGFgDmg27RnWGj
TLSH
T1B8659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 9e399cd41108dd499d2e30cda9ea631dbbeb0c669dce5e7bd91229585a6ae4fe
MD5 bfd405b73a8105971f8ad49005f8a839
SHA1 766c961d439475fc5f3b39827a1760af8cb1f301
SHA512 0b09ec40e0d0e1e7e2f779b2413fb5410e1bb55f8c7340130248f1528974c6def0ceb66c9cc2bc3dccf2c7e79f088e94fd0b936a53d21219ed34a9b0eb4216b1
SSDEEP 24576:yG88u8FpJqH1bzria7/mUsqjnhMgeiCl7G0nehbGZpbD:p7ZFPqVea7/zDmg27RnWGj
TLSH
T17135016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 a67619634f055058e3b0cc96341454077faa8e776c8cd472f15bea68a3749bf4
MD5 2a3b17c6788c156da0a7fd500b9af1aa
SHA1 d9c7f2c721b4412ca66fb616c8b2f28658d41cd9
SHA512 85e4e02ed9e4cf5c7c570621519b16ee244cb4842c72eea006f5155aee723caffd63f8234c755c7a079cc218b2a84391b94de5778844ec583962360f001201c2
SSDEEP 12288:sHvUrBFrEjwaQQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:sPUr+NQQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12705F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b4548e3f9b4b254179e6e64b40f9511bd352249f9846c1a08456d0da252d6bf0
MD5 31064d888100a5776297dea3554eea84
SHA1 1fb8a67ddfa0f96c498e99243344978d0824b112
SHA512 7b88a1c1b2b00941b29df5e6b6da86f581ed315b2b26c48b34132baae9dac3bce6b77d97425719680ab7779af30cb7c897ff00b8691c8e591df2d41ea1da43ac
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjcDmg27RnWGj:oG05lO43bBD527BWG
TLSH
T11DD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5e8ac0851a7393280910bc8bb8e31c48f1b5afa57a46a7cfcf3edaf94dfcfa61
MD5 be1cc4e22be63ba003c37594c4bfd965
SHA1 c7b76a7b15e7369e01f2f0045e6025357f9b5c61
SHA512 549c0f1b176a332948fc7d49bbf7da0037fb07e4114dff2cfe6329b180d103568d2bac9142d1a344113c4c8becc505830b96af87d3488e3aae840bb737258736
SSDEEP 24576:efa5POZ3dpuWVM50JicR2hG0lasx2+47eidnesqjnhMgeiCl7G0nehbGZpbD:Ga5POZ3BJt2pasx2+m0Dmg27RnWGj
TLSH
T15165BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7c5494f540853d7bf7696920c2fd508f3f920f556551497489b27635bb770e3d
MD5 f297922d1cd765b0686a9ef89f2d0ddb
SHA1 ead4f3510dce6e4258168f70194636392f22ed60
SHA512 a97e108653a47fa125d7ee100491b1d13f3b6050e02ab0150829cfbef13e4559676fd1c42724b1e9cd36dcb4df556cc8002808bd4679da76be8e7734535b427c
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkcsqjnhMgeiCl7G0nehbGZpbD:VNc/zEOVHFTDmg27RnWGj
TLSH
T1C3857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f875fd9463660e78d528cc83deb435959e8860e6bf8d88addcc20f18d7e836f7
MD5 469a6de663975b13b99eec23c33d9010
SHA1 364387fa6c684e13d223869ca84be7f0e8cff748
SHA512 c8c49e8597b4dd69e3a93d00a5e819af200d31b0808a59de976b6cc15e112543dea12c00bef73b0033834de0f7ec4b65e3b98a291bca882d1e05b52cdb86668f
SSDEEP 24576:rTkNvNnaFeYhJNtmZBmysqjnhMgeiCl7G0nehbGZpbD:rTMwBtOm2Dmg27RnWGj
TLSH
T18855AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 493c178108fa072f3f7e0d11db2b768ecff2df01c662536dfbb4c9f468bd65b2
MD5 b05fcc2dc6e01281d7bc1ec07dd5bbde
SHA1 7f460c018148688fdd899efba7354b6f6d87fa08
SHA512 304b9a39e8b3f060555b21de4da35f871a1dedd4cc4e21bcb7a1db6e74262654a3c736191239174fff0151b31b19f9de4f9482094ebccd571c8584f7b7590112
SSDEEP 24576:OD3FHshBIYQgANsqjnhMgeiCl7G0nehbGZpbD:ODVHeBIAAxDmg27RnWGj
TLSH
T1E125E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1040-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1040-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1040-270-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1040-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2300-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2300-72-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2300-289-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2300-66-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2404-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2404-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2404-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2404-308-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3100-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3100-301-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3416-305-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3416-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3416-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3416-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3416-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3416-100-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3488-304-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3488-105-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3488-113-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3488-107-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3876-87-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3876-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3876-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3876-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3876-81-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3876-319-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4272-1-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4272-0-0x0000000140000000-0x000000014030D000-memory.dmp

Download

memory/4272-76-0x0000000140000000-0x000000014030D000-memory.dmp

Download

memory/4272-9-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4404-39-0x00000000015F0000-0x0000000001650000-memory.dmp

Download

memory/4404-45-0x00000000015F0000-0x0000000001650000-memory.dmp

Download

memory/4404-49-0x00000000015F0000-0x0000000001650000-memory.dmp

Download

memory/4404-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4404-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4684-125-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4684-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4684-119-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4684-130-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4684-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4960-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4960-14-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4960-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4960-23-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4968-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4968-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4968-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4968-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download