ffc8098d4ce295046de3f2779d8a8b2cf82b8e8c0374ad06763723491a33ddaf

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 1.4MB
Sample260804-hc54qstbja
SHA256 ffc8098d4ce295046de3f2779d8a8b2cf82b8e8c0374ad06763723491a33ddaf
MD5 80ce7e05a74eadeb1efa88307a19ca84
SHA1 18630f333b60924f02405c9a8561a1069cf13d23
SHA512 ff5053670b2cd011fd13d2240a18bc3535804b494ff5d67cc7a06d32d4d67de7b557ec6e77672e6106a7eb28b71f755c05eeca4db298d6b0d4fff2e862cb2745
SSDEEP 24576:M5vG8T+KfIGI9pZcTy0rtKbqiGGC5SYCJmb57GBiOl6a8JTth/RWZvR6wQQ92pN9:M5vG8jG9pyW0rKg5b5+Pl6bJTIZ5jdgd
TLSH
T10C65AE2DE6A801AAF06A9239EC554706E7B37F05137156CB32A0756A1F376E0CF3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2384	elevation_service.exe
3304	elevation_service.exe
1384	maintenanceservice.exe
2648	OSE.EXE
5596	PerceptionSimulationService.exe
5572	perfhost.exe
5492	ReFsDedupSvc.exe
2804	SensorDataService.exe
4784	ssh-agent.exe
2592	AgentService.exe
6024	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c7496efbc618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8ac47a3db23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c67da9a1db23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044f5e9e3db23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003032bea1db23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005af1cfe3db23dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fdb5e5e3db23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2384	elevation_service.exe
2384	elevation_service.exe
2384	elevation_service.exe
2384	elevation_service.exe
2384	elevation_service.exe
2384	elevation_service.exe
2384	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeBackupPrivilege	5492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5492	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2592	AgentService.exe
Token: 33	6024	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6024	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6024	SearchIndexer.exe
Token: SeDebugPrivilege	5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	5576	2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2384	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6024 wrote to memory of 4704	6024	SearchIndexer.exe	100
PID 6024 wrote to memory of 5824	6024	SearchIndexer.exe	101
PID 6024 wrote to memory of 5200	6024	SearchIndexer.exe	102
PID 6024 wrote to memory of 4796	6024	SearchIndexer.exe	103
PID 6024 wrote to memory of 2628	6024	SearchIndexer.exe	105
PID 6024 wrote to memory of 2296	6024	SearchIndexer.exe	106
PID 6024 wrote to memory of 3008	6024	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_80ce7e05a74eadeb1efa88307a19ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3304

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1384

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2648

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5596

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5572

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5492

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2804

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4784

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2592

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6024
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5200
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 684eeb631f991d032f2cdbc1be69fcf11680e8ac9b949e5b4ae0a3d31b723ccc
MD5 f780a250cdad45861b338f2125dff2b3
SHA1 8156fbb50fb0415a8c81bf300f761c0828cab5d7
SHA512 d87db79df7b1b711b2496dbffe344128a706ec915626cc064c36b592c0c37614a44cb1255c279fbb31fd8c2b360bc73f7d08a6eeed7ac47b386570994e505711
SSDEEP 49152:gb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn5b5+Pl6bJTIZ5jdgpx:K3q6mjBkslgJTIZ5Bgp
TLSH
T121D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 7fed5a88eb7ffc036f4190099316d98d24dc8c17085c7cd5a678e7a7fc4e784c
MD5 ea3748e330ef5f0ba3467085dae01109
SHA1 4aed90299fa8fc997aff60d5b94dd2d275b668bd
SHA512 f2dfb19932d0cfaee8e9b2d9dff876c00054fcbc2d2aaf4817d0afddf0447dc42749498666cae414cb75a6588b30963deeb8819c7875c1d92720b03d9dd6452f
SSDEEP 24576:DXYfDtczArmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:GtcXb5+Pl6bJTIZ5jdgpT
TLSH
T13085F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 38e2c30a83cfc2c5edf33475f8a4932ee5bda14aa126a0fc17c468ef0584ebe9
MD5 2a2426c3a2997d7699dd974140df2f69
SHA1 2062c022b9f81f13d6ae31c2166dd3c1f7334397
SHA512 b1443b72e5bef7b3b9d663a287c74e3c82063b230e1352f23d07b3a755b835880abec9f170505275c9b83a5eaa2b6e43dbf5602df61a6434f8849f3a8b56c9bf
SSDEEP 24576:Q0Le5ji0hmxyrMemb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:QPji0AIsb5+Pl6bJTIZ5jdgpU
TLSH
T18895AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 11e52df614841e7be1f54a7adfa11d17b2b65a7ff88550d80219a360eea2e944
MD5 a6411546524ec94e955d72fe0dd11e73
SHA1 0e53014a40f31f9576b7b2188e5844f33b328a8b
SHA512 65afccd9914c9df590776874cae875a700b47b4b868577acc19cc32e96fbb2adc25f85414f060457a4ccc4d648ba754d6734af32e4e49f8350c5a96301bb84a0
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWj6q8wyuwmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:1/ezSC6vUzPv+HjyAb5+Pl6bJTIZ5jd9
TLSH
T18E756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6f96785a2f44488bebf6cac395f50ed41c6d692b97bf71e1c992aad89616b5ec
MD5 6bb482ca0779190be8ee9d075fec0b92
SHA1 222222d9dd3c26fb3ec685cb537ce0a86dbbc017
SHA512 ec5c722531bc54d3dc7fea5ecdd4d48fac30bb941a861d334b3ae955279c0792c2ed236c955bf0e7361b9f622e162116b3a737f42fa0cdddbe13c5f86fdbfd9b
SSDEEP 24576:zVbqPb88hv/l+Bvmb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:zVO88hXl+Mb5+Pl6bJTIZ5jdgpl
TLSH
T144559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 c49f5a825003365c4389d38285eeed6f55c8cb675a4f97274b67bc41e4e49667
MD5 b793f3589c0fa8000106759c00bdcf30
SHA1 687223096dd0ee827f45cfb871187a0fb4c2c683
SHA512 b1f38ca2886de2085467a0bf5267d05e5da7e58d129ddf69f4f4b1c0587a4b113f0180ddb56ed32755fed6af00ae00c5b09aadf1d0f4b3a6c38c20e7ffb1edd1
SSDEEP 24576:NFimb57GBiOl6a8JTth/RWZvR6wQQ92pN3H:1b5+Pl6bJTIZ5jdgpV
TLSH
T1EC6523834B6A30C5E5AB1739D9CDDB00F879EF55CD866BB6C575282BF034389B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 538c29dbbc0f88abfbfd54cb33ea3ba01785f5d9874ad3fe08c03c0ff883cba6
MD5 3c1626cc2c3e42e9c5be17adda56139e
SHA1 ed9b74af50bfba6ea60b446563c3d38ca9fab898
SHA512 ffea03f227e54b9878b83b9ce9221cd1e0ec2c89fc1093497c61605784d78b2a97f8c40b09d14144c990087cb44ae9a93cc6b38f6aff56934610f1a1f5568c0c
SSDEEP 24576:eJIUXmb57GBiOl6a8JTth/RWZvR6wQQ92pN3H:eJIUWb5+Pl6bJTIZ5jdgpB
TLSH
T1D585CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4036f31134604a9ac1714b327bc100e81529897586ffd3bca8cb15587a5023b1
MD5 cb103d9cdbf785206ea53142abc98f2f
SHA1 0e0d1eb6016a902c8b331433099652971f10db92
SHA512 b310826f3f7307fbb5048de91c34741315ee5fb3812c37e921930027ba217ae60df310a2a2cdc2db46e80dd952333dffe3b2caa8c07cf4d7c061569395733f9d
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THF:eQvGAdlCEL8c/WRNw5CLslgJTIZ5Bgp
TLSH
T1A6266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 5e7d55b29fd074a0843124f958fe00b7ce5e744294957856ab75194e11ed402d
MD5 eef53f0904692262ec64b89d411b7750
SHA1 a342aec96aaea4e2c4bb7250da5f7b6bd1fcb8fa
SHA512 15439388b618e43016da47591b9d15d2ce6e25bff7ab107b2984c2022c8abbb7149ba4a98f636f2b1ff027925488b62c9a9c92d89e4fdf28d6d81562d4bebb94
SSDEEP 24576:aOewsAjhmb57GBiOl6a8JTth/RWZvR6wQQ92pN38:5lj8b5+Pl6bJTIZ5jdgpW
TLSH
T14A85E031FE75E036C2BB0DB65B65C706647DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 505557e85e948782aa4083d66060274457b27905c2f3c02f41f1f13a3595c888
MD5 3978c68d9ed7682fbd00f365cca95158
SHA1 29ffb807142f8fc7444e6f2cea5b6784eb9e7781
SHA512 7725d32edbe4e6f73c6eab69d512a42f6c3ffed2cc244b750fa9d110057f7d260d1c97e96da76b02fa3d90311bf497b47cf872b6f1d5d1099e529450ffb9b67f
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHisT6p:7UEtQevvqc2W1cpV20I32is
TLSH
T111474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 94af8f630450c8310df06c8a42e9c3e1e57532f806c7b38f257d697abf764b0b
MD5 38212f9f90451ec2a058cab5ae625d80
SHA1 9b41b8343793115cec719c4f59fa17485afb844d
SHA512 fdb6d9de6ef449f84a64cf5c4d1e05dc42321dc2b1a88305a08434f7a88535a23a3ceba04d59c18cf8a3c227156529f036958fa58823d59b6ef2e79a7d4ee2df
SSDEEP 49152:OCbRquA/m2yL5zQfFiV+XenmE3/zcb5+Pl6bJTIZ5jdgp9:joqtVjnmvslgJTIZ5Bgp
TLSH
T11BD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7e23f3d03f3497947ee69a5e0a241606f528f9026856aab0b854addaedd5e693
MD5 fd046a0398dfec084987072605d981aa
SHA1 7cf3d017f119bc1ddbd5a0f9056a9b4b44d0136b
SHA512 a94ee8cc1877573a73ea8b8403da13171231b7694d1c9d78f0182298c1c2c25ae6bf805b28289cedd63687f6f7f68ee67e397a697e6b5a6b4bd690f258bba419
SSDEEP 24576:KAhGL6IFoiwtA5l7S53smb57GBiOl6a8JTth/RWZvR6wQQ92pN33:KAM5Foiq5rb5+Pl6bJTIZ5jdgpB
TLSH
T192359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 3a662cd08cced7b2849d68055cc4f5336b1a2f31832e62306f1a5216bf81c3c5
MD5 9750c211b14acca3cdd8856b17fd674e
SHA1 b48632140560b820c2b59cd9bb5392bdfc5bb20c
SHA512 5fa6adb66289fd7f90e740b9e94289576be64b4a5a32e01aad3957969426716c933b8c94ccca22f7e04f9dfee6f97107011fb461aae7714f799eaa52e7b2e535
SSDEEP 24576:JwuGOWdmb57GBiOl6a8JTth/RWZvR6wQQ92pN3i:JwNOPb5+Pl6bJTIZ5jdgpQ
TLSH
T1CF75F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 e49fb22558fc3237e0c8ff711093f6fce3efffa97bd558bbaa051b0c04a0909d
MD5 95b3d28133dd05116bcfe96845ca2a2f
SHA1 16ec2b7d84f9cb493fd068477a7fcef39eb1b8ec
SHA512 a07005b210fe3369c5f2fe09e71fe422835c60f587c97a54c421afc414bc02e0345ef93d0fc62478bcfc17c8892cfcd5276df95cc6820e7e4a1560e077c57fc2
SSDEEP 24576:0ZuGmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:bb5+Pl6bJTIZ5jdgpc
TLSH
T1EA65128627A830F9E0A7533DCCE58B01E772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a20c2d8bb05a7cffce9bc5b571e220c4deff317ce14be6176ea19a830d0653de
MD5 684ffc39f579aa5ca34beb9ead5ebdc2
SHA1 6d7dfc0c0b96a3d48300903e4b659235623ff1ee
SHA512 c681829b9911f5b22b3581a9ef607eeaad7b62430bb8e7c7dacad32a145fd2449a204d408e5b5a9601d2bb449bb2f5de1e82999301391a9116c824c6ef1a44ac
SSDEEP 98304:/QRQyi36YOcPDLvw2gAf+PN3AslgJTIZ5Bgp:OQyiKanX+PNQsT6p
TLSH
T11C666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6f35e42a91eecc394c19747e29cb928432788c231129d9dc976d2a32d59aa3a9
MD5 130d8327ec980c56ba88c2e2cca5c68f
SHA1 36b14ed3104029dfd9b0abb0da106c9f53ebc77a
SHA512 74e4d98acbefb8d8c661c5fd9c339113b58c69a50e44506c0f4f40e9a60ef0074a832049110097363d282618056a269dfd2082874d3682b16bfc26541f348d64
SSDEEP 98304:JQRQyi36YOcPDLvw2gAf+PN3AslgJTIZ5Bgp:gQyiKanX+PNQsT6p
TLSH
T100666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 548060deb25621abeb2e884b2aec774b535a3a4b9cde644d918778a6fabccbb1
MD5 9ca4a5a9b46aba9ddf7c8d872da06b03
SHA1 6fd89738c196f519f111d001964895793752473b
SHA512 5d4ee9826b2ddeec3fe9240f631a5cf8752d99257f1bbbe5ab2578b943dcb0d2dd840c98887cac4b19eed52b593e16cfb1ee2038c3a4f8aa1464928e5f48d0d5
SSDEEP 49152:a68Qg55nhkeWu7PNU3/sb5+Pl6bJTIZ5jdgpF:IthTRc/KslgJTIZ5Bgp
TLSH
T102B55A33B2F60099C44DE1769F4A872196E27C71CFE1E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2f0399f0452f4cf97cb601b2dc6a24ecede21f7d87ec2ee954af939d77d126b8
MD5 e71e984bcd27163e3917c81f5a7eebd2
SHA1 30189d454da906e4c93d50eb7daf10a546bd7c1e
SHA512 e4f4683ec5aac476eba0f4066cf293625025a9611ba587b0bc2b8129fc4ec60c21a760e1a7ef3e51e396c6f8e7d07791577c3c6e3e4bd303c2e16df9179e2d94
SSDEEP 98304:Ey5112gYy5azzVvU69nLKnhZ5slgJTIZ5Bgp:FLIHRWh3sT6p
TLSH
T192167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b224def96faa6337d4ab530c48cc05f0797684cc938cc7a5fe1bdacc14443014
MD5 0215ae1e92afa1598ee4ec1f09162aa4
SHA1 732e58ac21c6bd33c64500976e7fe326dbda4ff4
SHA512 be58e726e61cfc86f38f4d3ce8cf3facdce101672ce2fb48f5e41eaff3399c25950c083eb8c0dc41d9fe110481238918f1e79afa1551a6db07aa65681969e697
SSDEEP 49152:fB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glSb5+Pl6bJTIZ5jdgpe:hu6JmIxd2d4slgJTIZ5Bgp
TLSH
T1A4D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c882bc42bef09107d33ed5920e9010e635179bc7626fc4cbe22c31998d6b9e22
MD5 cb9a40315745743da5e01002d8142b63
SHA1 afb6a280878f2931cb37f45dfb2214d16449ec7f
SHA512 a4d84c65843d00d857fabeb6d0c5bc3e20df89f4c2324ea6b7ad34a9f28f50d9dbe9760725e0e737bb2caef791e09280e19b1fd2ef63423536eddfbc799ffe21
SSDEEP 49152:h1hpsNoJpF1A67U44CwH7R4x2b5+Pl6bJTIZ5jdgpm:hmifPqRvslgJTIZ5Bgp
TLSH
T1A0B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5623a559a12a0a1a5a804fea67ba7828c02f87bc07f6f7ebfa720385d68f254b
MD5 dc8f61db3ea1d38bd4db5143755e4394
SHA1 566cdbeca16f5e698250d7642d2238e36a209405
SHA512 c4fa1c87d95ae70aa56bc3ea6c43428c4f67fdc4fa2adf1b46fbf7c1679391f26c6fdcd5d67d0a1f92d17bc8ed85edf54a0847d7cbcc275873c2adb3cec03e45
SSDEEP 49152:BSuZQIY0Be2KkRVtOnks6NMHqJb5+Pl6bJTIZ5jdgp+:P5dKqi61VslgJTIZ5Bgp
TLSH
T11BC5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8825c10d3256afa214ef030aed696e84094d81494e61b14f20e4c8c6ae73bdcc
MD5 9680a45a699d50ae86fee9a98f33cba0
SHA1 d8badcd2d911a984b2c56f8716391dea7e8d49d5
SHA512 d3d1068a19c83f82ecdeeb49f614891ee6eb52de23cc7e6c6f245de18af7fa4b1da593c668049f19d48ebbc2222d1b3908aed1d06940dd03be9d013b9e6b4f91
SSDEEP 49152:lhtSn8EApI0figjgiDn0AP5wib5+Pl6bJTIZ5jdgpX:UX2iWphTslgJTIZ5Bgp
TLSH
T10995BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 4cbc04c5629d1e0ee38031093dbaf85144594d8c6e42a7c63360dfa3fbed6823
MD5 eb306dd994ca231d82507d46da40f816
SHA1 bd441b2e484bb1414ad0ec5200be4d3f6c6fcc76
SHA512 3842e6c2b7004fbe2b51b1126d47a2de604552ca1d0b181309601e11f0dd266f96e180b78e15bb5c90d682480f303dac36ff09a5ea737bc7a5618e0686d9d382
SSDEEP 24576:1Kmb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:Lb5+Pl6bJTIZ5jdgpJ
TLSH
T1076523838A6B20CAE05B5779D9C9DB00F87DAF56DD8727B6C67D042BF134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 76a5c139470bee1a24b4770af1d9275c15a4d209a482bdb18c6a0d4d1e37c0b8
MD5 73d48d333b524407334f1790f3a83ee2
SHA1 f3ece8b67b4456ce1f330a27ad115965acac67bc
SHA512 43127e9190bd9c64b79a35d98d132830a239f8837715fb51a63c80326ed2cd56f30720d82589abb62708245a580e9523681fceb3e994171e2c1e93555e5b9891
SSDEEP 24576:wVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:pb5+Pl6bJTIZ5jdgpJ
TLSH
T1C56523838D6B20CAE05B5779D9C9DB00F879AF57DD8727B6C67D082BF134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 794a5200cb948244e3b01d651867c660dc45288fe13e9d94a65ff6d6a4133dc0
MD5 8539724ea88f5a2017ff3c530fc69ba2
SHA1 c0ac5472ecbadc4a02b8cf58796eea0236ac64b4
SHA512 d9fdf9862b78b93319b99f985785be217504bd5f9d50307acc7f0b8a70c34bf6a78e1b58262cd1c4b52187008880092c606e59c6f19fe672f1fb682c6e7b23d2
SSDEEP 24576:ifmb57GBiOl6a8JTth/RWZvR6wQQ92pN3W:Rb5+Pl6bJTIZ5jdgpI
TLSH
T1EA6523824E6B20CAE09B5779D9C9DB00F879AF57DD8727B6C67D042BF134389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 d3823248e2d1d2d554aad3288c647593eaa3c6f2a323991da869d4b13f0d33d1
MD5 5c9576d4e226e94d014e98a3fe70e382
SHA1 b383ecfe367c71dcd292b60788f44d124ba6d77b
SHA512 dd4ff68129c46f4137f70bee491d17d3ee1492bc1c90e95430e7c28f683c2c8e2ac16019863650414dbca249622c8b2ac01865e8a6c2509d1beda6d394c01b88
SSDEEP 24576:Pmb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:Ob5+Pl6bJTIZ5jdgp5
TLSH
T1EB6523424B6A20C6E4A79379C9D5D700F4B9BE96DF5267FFC675082BA9313883C3134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 7e304d0c442d8fcfb9b1a9a81db26d77744ad1e38fee06047732158e55ae59ca
MD5 7b9cb5a7bdcac9d408a7ee49bf7fdcc9
SHA1 467d128085ca25dfb873df6283595f9a255b3f01
SHA512 b3f6b2c873358d460f4fd9f618bd06264b4dadfe23a49f9e77f2d86445f68a048c0b3f24c73c8fb920cac392553f0f05c1942774acb15e47da5841dd52fb23c3
SSDEEP 24576:eEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3y:ib5+Pl6bJTIZ5jdgpw
TLSH
T1566523828D6B20CAE09B5779D9C9DB00F879AF57DD8727B6C67D042BF134389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 69b36697a460553b1b4082974840998270d714d0b2bb06492809f3fbb59d5a3c
MD5 e2563068987a1c68d402ac1ce2e3593d
SHA1 7888b245fd0f6cf52e57b76549f2c481b21de598
SHA512 5acff9198ac7c88ef21faf5cd536eb0c0255514e1550f527eec932250e9d4e90f6cdfc2ff140b9745541a3905269c0ab653509926999840d3303c85bcddcc6d1
SSDEEP 24576:kJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:Db5+Pl6bJTIZ5jdgpm
TLSH
T1436523824E6B20CAE05B5779D9C9DB00F879AF57DE8727B6C67D042BF134389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 9e9c8ecf98744e2438e871eb6aac09d627d89675c1d11c5ec94be841a3d5375a
MD5 680dcaea0afbe3ac82de967eb9515033
SHA1 7211916a073aba5755c36176a307abf31f85ddfb
SHA512 b38d7f00fe43ac86b9434f30f235ae8cace6f042a7388a19dc8a184e509f0d9940f314f00c80afdd88d7a6895188691a928dd531ea667d2411ed24cb0b4f8333
SSDEEP 24576:CNmb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:Tb5+Pl6bJTIZ5jdgp+
TLSH
T11C6523838E6B20CAE05B5779D9C9DB00F879BF56DD8727B6C67D042BF134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 3a3eacb4b5832640e76ba20024007d491179d0d3224f55686f1d1cab9b9f4ac4
MD5 37062d0347c452c8d428ebbc44f03da2
SHA1 9c50154a9746a24428b60067948bff1940ab8ab5
SHA512 a088c320ec964fa2546e592c3f71dbc079470d09785d3bebefa5a3f68600ba1ea96789b0a9fe7ce5867f15a680ce68a4409203b97aaa3ddabeb7e61a728b02b8
SSDEEP 24576:OZMazFVSO1mb57GBiOl6a8JTth/RWZvR6wQQ92pN3M:OZMazfUb5+Pl6bJTIZ5jdgpO
TLSH
T12E850295B35018F8EC67823ECD958A05E5B27C5A4B60C65F43B8362B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 33f836d68b3e57eb39d21248a7f48a269bc7a536787aac9f6ff0a577f1d37f8d
MD5 bd2cc18b7ea777f4eec1615ea64c8264
SHA1 a0a61790495a1493996b4b2a8c103a618dfafc0a
SHA512 0426dfac1fe871db57f1ae82ae03811a0ff470f0a4ea2d48d7e679c6bbb9c135d29cc309c1568b4655d4788eb6d9ac131328845bca4628de182baca33ae2e332
SSDEEP 24576:DWmb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:Fb5+Pl6bJTIZ5jdgpX
TLSH
T1A5652387496B20CAE05B5779D9C9DB00F879AF96DD8727B6C57D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 be661a398d4e9bee2ed0d600b325f958507b6e94ef1e8d69815d344acf521b09
MD5 3b377a04fabaf4f800596c40046925c0
SHA1 d8be2d23b888d3ea50026bc68096c4716a244758
SHA512 b3b9d31810f8a3cc21a8c55cf0d1dc645ab1c5e6f50c69ed0fd14be53e42dabdc23bb4f6d5aa53747df47a6d26b08c828f59688d84c9d5b5f487161a3a3bb52d
SSDEEP 24576:gymb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:Sb5+Pl6bJTIZ5jdgpX
TLSH
T11D6523834A6B20CAE05B5779D9C9DB00F87DAF57DD8727B6C67D082BF134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 e1b6c09adfa0557ad06516e5002921b2c1bb4aef02d4cad674cf7c723286d1cf
MD5 36d6584f41f2e591ec0743ef6f5d85f1
SHA1 8874692005100cb5d61e36e5d22e3217442a4681
SHA512 d9ab03a89b832f2fd4fb92d0937a817937a90bc942bcf12bc709625f0e3144ab6b83a5f1b856d682d9a36f8ecaceeb00a2a01c8ecc487c7a60bfdecf3b492b6b
SSDEEP 24576:Dzyxmb57GBiOl6a8JTth/RWZvR6wQQ92pN35:Dvb5+Pl6bJTIZ5jdgpv
TLSH
T16A75024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 52a1c42cb0813878a5a93ce685a701da31d6de94de9cb51a97662c675c3359d9
MD5 8d02e6bbb74c5d6dc22370fc28a20d87
SHA1 5a06ad785e1986026f989415d611e002fde72cbd
SHA512 c5ca9f531cbdc4e4fa11851afea8518d63a43416b61f7ef551b8a44731088b322e2a875f5eaca4075f887771740bdb5a6fb27cb1a85d61d66048f9364be2b8c1
SSDEEP 24576:yWmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Z:wb5+Pl6bJTIZ5jdgpb
TLSH
T1E6652387896B20CAE09B5779D9C9DB00F87DAF57DD8727B6C57D082BF134389381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 1acb69e834a622eb60e0db68040816bfb59e87b7969d23a0da5352a8f7da6db0
MD5 b3c4810b34cdae87b5cd1f99e2ab203d
SHA1 7d2d2e099d5d943840e2d7249ff063bb7de1e016
SHA512 43e8168ca0a329c225254d3b6e447c85a192c13d9be562ff010ff3a209c9f8e7c7b362cf2b41d736d27883064f443f55ebeb66222bf79c5bb66f8e8550c135ea
SSDEEP 24576:oWmb57GBiOl6a8JTth/RWZvR6wQQ92pN3f:ab5+Pl6bJTIZ5jdgpF
TLSH
T11A652387496B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 67d4a03993beca162b417e57bf0a09e984e717b0e1ce75fb75d10899db904df8
MD5 20c1949b161eedff1636a1e4a2b27172
SHA1 fbe250e97b4194518a92416d63d920a508ca6a0b
SHA512 9e7281869d4634b85e905b114f923f8f6a54b56030813b5863936b9d8a89b43d160ec79fd8c8d97299a51062c774db76ff7328979294d0f9bab7a5222f612911
SSDEEP 24576:Jzyxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3L:Jvb5+Pl6bJTIZ5jdgpZ
TLSH
T1B475024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 9594423c49c284359d8f7a8f26f786ae54436ffca7addc70290601d3ce7af6e2
MD5 069ccd8f51090115ccc12a21e5c35db1
SHA1 551f3a9413a4c806b4117f795e0a7f4a37b18170
SHA512 22b24b6112d15634d48c97ef5d187d480967ca1c8fec3e1e2a09a0f33271cbfe603e4b33f50d6cc58a179fe788d650f117c000de82661590a5d67b7e8a2d860b
SSDEEP 24576:xT/aLl3z0zDPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3z:xTiLljnb5+Pl6bJTIZ5jdgph
TLSH
T174850295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 fa6c1e2f015cd28194ef984bf0cc001aca70eeaafb125a4b9a6f1ad80910de0e
MD5 736ac8be087c90ceb2082091c5467862
SHA1 9f9eaae9899dde1a48bb30e0d10340556932e60f
SHA512 a53dc992dddd4d7fbcc62962327c9c7da5630fbac0dbcb3d707b6e52a1ea3871903262be74370cda2faa28a7ee6fb092784c1c718821de910d634e7bdff8d6a3
SSDEEP 24576:z3Ud9CHKy7GZTmb57GBiOl6a8JTth/RWZvR6wQQ92pN30:TUd9CHKyaUb5+Pl6bJTIZ5jdgp+
TLSH
T17295CF90F3E410E8F0B79A35CDA68611D9B67C5A5B21DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 58c1738eba3dc2f994b1ca79cd554e3604fe237c9a219adef8229c6e796ed959
MD5 b9c99dd85ef570200fff30b2ddaef1df
SHA1 379ce88a38c92ef3412ae5a84a44980b06f51d1d
SHA512 561a4c27a829ea80301cfcbf1577e961addd074b089d27ec86d3b7a0192f21f0df361f6baca4b64bba19c186dfca645d61cdcdafc37e56aed46e0574ccb9853a
SSDEEP 24576:b/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:Kb5+Pl6bJTIZ5jdgpW
TLSH
T1976523828D6B20CAE05B5779D9C9DB00F879AF97DD8727B6C57D042BF134389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 047ebb4455e25647391eae85175d5cb2c691cfa4f11612112d831ff67a0ea1b4
MD5 5eee4da63caeb0ad2191eac38f04bcdb
SHA1 6af42147ab442f3ae4c3cccb9ea7097d40ef00a1
SHA512 c90d7900abb1e81653d0e55b09e1751c689e1fd3fc7b440f2870ac5edc7bea97665b81a6fb65fcd09dc047d641bd4a9ec176af8ba0f9c4cf7ee3f14d7df65acb
SSDEEP 24576:+Rmb57GBiOl6a8JTth/RWZvR6wQQ92pN3g:7b5+Pl6bJTIZ5jdgpK
TLSH
T13B6523824E6B20CAE05B5779D9C9DB00F87DBF56DD8727B6C67D082BF134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 bcb5267755a927427b73cafb86f87bcc2db9c1111efd360bab4b33cd57bb97bb
MD5 79f4ba3777962ddc3461bf0e861b7397
SHA1 251fa24bc4ec1878b9b44da4f8354fd1e32a47d4
SHA512 c6582c17034b7732141443eb980bb6d9b03acee740e3baa5550bf09ac7547bf0877015e1e9c16d46d0b0566bc9d3458cf1c6d4dd95b1595ab83d80f2331446fd
SSDEEP 24576:/Imb57GBiOl6a8JTth/RWZvR6wQQ92pN3g:3b5+Pl6bJTIZ5jdgpK
TLSH
T11B652382496B20CAE09B5779D9C9DB00F879BF57DD8727B6C57D082BF134389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 76cc138c88efd458c97d8ea2bd20fd624748d8a8eeb2b3057f36545156bb1a27
MD5 146dcf7f1751d75e19dd0b4e569dde84
SHA1 8a9d35e708a0b762eae8d6b77a0e3e4b862faede
SHA512 35709263d6a37e5bd8d7d34b1a305190719f1b85283bdd0506cd092ad15158c6587e245b445da03e7701c47de037ac9b6c5fc3daaa3df0774776ad8aa884481b
SSDEEP 24576:+Wmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Z:Mb5+Pl6bJTIZ5jdgpj
TLSH
T1B6652383896B20CAE05B5779D9C9DB00F87DAF57DD8727B6C57D082BF134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 87eedfbedfbc03ec238ddab48054891b27a2b51a689e6b116ced0a11d9e4ddc6
MD5 7caf2e3d0813cc4a87d04c93bbcdfbce
SHA1 b8a3ef0e718b1c939efaa85459afd782cda7b76a
SHA512 0753476c410b1a515aa2b26be942ba4fab456ea03a5b85c00bdd80da3a890d50a0c0d2cc85ba49b9d7e2ba8dce238636f9388e4c91ff61e3d8b79e5b61148c02
SSDEEP 24576:o/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3K:fb5+Pl6bJTIZ5jdgpw
TLSH
T11E6523828E6B20CAE05B5779D9C9DB00F879AF57DD8727B6C67D042BF134389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 19237ab865e685d8c10108ef07ab44b703621451dde1fb2924259f875b194d1e
MD5 59572db6e9d59eb16fe581202f8434fc
SHA1 d4fd5cfb3b75e09afe4627b072e9a6d679fcce27
SHA512 7edd16eba3c42a4f39bfefa5046ada609ec47daa5278fcaff8c0d6f8c58b40666bb4300cf4aa841861f2c7e92954c8fc41dbdb320d999e9642123f8271db45c9
SSDEEP 24576:BOmb57GBiOl6a8JTth/RWZvR6wQQ92pN3W:Pb5+Pl6bJTIZ5jdgpE
TLSH
T1BC6523864D6B20CAE05B5779D9C9DB00F87DAF96DD8727B6C67D082BF134389385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 0de20d5d699a87f93ae5582e2cf5ab993d66a0fcd465b52b2001fb0f53427708
MD5 82b1e21ca7927c0930ddb32422ec79bd
SHA1 a987b022c5fb70b3a66dae237109496a9a21a310
SHA512 0ff2b0613b70cdc6e0f2b2a0d17aa253f5655c1bd140be7a5c00cef8463c6137a2dc0b2ecaaaeca263921031e5176d1deb9d461e16563ea28889a29f13c28667
SSDEEP 24576:4Emb57GBiOl6a8JTth/RWZvR6wQQ92pN3l:Yb5+Pl6bJTIZ5jdgpH
TLSH
T1666523828D6B20CAE09B5779D9C9DB00F879AF57DD8727B6C67D042BF134389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 91c47226b2de7be12d473d11c88724444266d786a592a4cb77d478dc74a76f89
MD5 1bf03834209a318495056110c12d0458
SHA1 5e2ce46dc0c1f53a35bfe400684d2aaccd1f36e2
SHA512 600e6eaf474cf634e6b4736c9fcdd1e81434ac300468333622b481c3334d7c4349654f8a2f4f1a1ebef89a46012a37b1c368d07a4440c610f0723f26761bbe63
SSDEEP 24576:hfwvhk9RX6wkyAICmb57GBiOl6a8JTth/RWZvR6wQQ92pN3P:mMnYINb5+Pl6bJTIZ5jdgpR
TLSH
T12595CF29EBDC04D5E0B7923C99E7460AF6B178595B31C6CF02AA536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cdaadc28c63435b915bcbf33a293ff9c76e5e40c24596bdd99828158e33a8339
MD5 bec101f606d070449e4347dc63ba3732
SHA1 5d2e9885e77ae6a9ee6ff6e4bcc7942fc7c9152d
SHA512 6038c5bc35d7af21a7d9e35321643aa3894f968f3a543811d62d3886898d63402c072c7168a2a355578554cabe5fc144ceb9c4b06a43d7a57a8a3d354507ac67
SSDEEP 49152:tYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Cb5+Pl6bJTIZO:cySzPgslgJTIZ5Bgp
TLSH
T1BA066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 100e48101dac302e171b7b03e6f5fb89ee19fb99dd8ff4760371ac569884c378
MD5 d5a8a02f34cc5e16e9b8a80002c932db
SHA1 5d2c3a42d1f8fd929bb23f54af47b2a3d9b75079
SHA512 4724a482ffc2d210148de97f045583dc920fc186bc9c824bbfe1067748e00820e973f633bdb36b8e4447697125a53687773e401cfb0bb8c0006babe8e073359a
SSDEEP 24576:e47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYFmb57GBiOl6a8JTth/RWZvR6wQQ92c:e47JUQjqirIhCnDHUPfF/Sb5+Pl6bJTo
TLSH
T14565AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 b10d3f6ad9378dea946474a4ce796b383093a99c83d6131089f94dfbd8e41a97
MD5 6a4f2637704e8c48c4bc4d146fdc1250
SHA1 630f21df82460370ef01ad54982153fc61794ac4
SHA512 9c4dc57915dd7f0218bd750d67e1440e6f760545e3cc35fa3faf803796526e9d3ca94eaf53342388861e5c7ca10e68eec89d22d32d5a8d790a625e1808d1ab44
SSDEEP 24576:1Gmb57GBiOl6a8JTth/RWZvR6wQQ92pN3P:bb5+Pl6bJTIZ5jdgpd
TLSH
T13E75F14AC29811D9D06E6279CB858A00F7377D65CBE193DB46E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 968KB
SHA256 30d9b825651ad79caf8d3f97fd3c1c03e9d034c873b7732b78407e39568c6dc7
MD5 4fa22525e1101e60454d7a243dfecf01
SHA1 c57f8beed2f4ea526f44406153726c4391e4de74
SHA512 96be1f10fe99c8a655dc7b281b4c34cc2f6cb36bf8a91e6f725bb8c0cce67cfc664024aab8d61ef12278adbd4ab0f6d29a9e1377cc0c3edb41dd3ee21f894a51
SSDEEP 6144:W6sBC2naY4otEFagzRZotMxj6Z3U3fpktTAXVoktuQPcupSMIeyuuZdLXJG9nP9y:W/rzlU3fiUuQy9vk9V1ZOuhST7
TLSH
T1DB252850762BD75FC6AD40322E33C2CDAB707D41EE059B0372C8572FD576669BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 0a5c4c076983df3861798a3f984c161d29905742f6ec6dd8d8259e9bf7306bba
MD5 1eee92536f36645d574563efc94e003b
SHA1 f662d4c261c0ca42452b43e19e46f4b55e1fb55b
SHA512 f51be24a320c7ccad3a1d39cde3ba006a153b76748e62b84f4febb77bde1fb77983161b68fc4417ace97a62347de605030a7e30f0aefc7fe1cf5f1f01fb93219
SSDEEP 12288:3UhhXojl3C17fk2cVcAcFcgTcTc5cTcdnzV:3uh4ZypfR+fCFAqY+nz
TLSH
T15555B6816137A3CFD1FA3132072A5B4DA764EC12B7095F2663C8053ED86BB65A0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 99126d8288b44d5fafdf74ed97859d06c5c6da0c2f510b300c2dfd12c4409808
MD5 fd031a9bed55888c522e1f87ce62bd78
SHA1 789b4fe297a1b39adb7e91988df5df4a4b47e07d
SHA512 29602a605ac843b2bc6584e52b34d5c3c8a8f2b41c3f3cee3224774f530f0c7cb8b16481f8af619e637764827165fe310b9b432d979c99b61f75576d4afa4329
SSDEEP 24576:9+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3/:9hb5+Pl6bJTIZ5jdgp9
TLSH
T1AC6522428A6A6086E4BB5778D8CDD710B83EBF65CF8566E7C529142AF1306C87C7220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6413d3bc9ec40a8d4f30a9ff90d52cb4862d88ad1bfc8dbd4644f7f21efd4be4
MD5 af5e31ccaa3a57e251b22d812fc0c6ca
SHA1 31301573903c5be5573d3ccb863c282fcf9c6ea8
SHA512 274cc607624bb45280d36d56ba5ed7991359ad99137f4abf865de199be5eeea61366f169465b1782efd398329ebe1896e1dbca0f3cc2c06d4edf7c48e1c88790
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bYwmb57GBiOl6a8JTth/RWZvR6wQQ92pN3w:tgb4mBIBhGFIb5+Pl6bJTIZ5jdgp2
TLSH
T162659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 85c0e54c7545d2a2d2641cfb34589a074e449a87d4159e6eec69b0de490880f2
MD5 b0e1a7cffcc3a3474ee3c2a7dd4c10d2
SHA1 33f3c2557aa003acc614d73634fbb7085097ea26
SHA512 15122c3fc1b80977fc05e97cef8f343cfaf303c6b489fdebdd7a55b265cf8ba48a44f07dbf709430353a6132e7b7953103d17a46b692fa58143b63a94c5db012
SSDEEP 24576:mG88u8FpJqH1ozria7/m1mb57GBiOl6a8JTth/RWZvR6wQQ92pN3b:t7ZFPqVXa7/fb5+Pl6bJTIZ5jdgp9
TLSH
T1A395F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 fc11948ec0d776e41aeae57fbfc71a16a491343daa20bb2452441e5758db8a14
MD5 0eaff19e72bfb561d65a6c6c88b807a7
SHA1 b37b837bfc210482e8c848dd60e0da1866da31fa
SHA512 fd88d1edeb26da141cff1d260da7ff24d5df243bba269c2ad8a0b49999951100f76a5aad1cfdedf29aab211ccaec62906346ce4b05d576ae20b987669ca19e4c
SSDEEP 24576:7PUr+NQZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:7JQUb5+Pl6bJTIZ5jdgpb
TLSH
T12D75E11F26AD18D5E67AA17DC9C68709F771B8624712A2DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e308d11d924b11e52ac6a9bf1d7c4122eef74b91d103a8e66a8fe2b59b6be119
MD5 9b2ad216867d195b5b39eca733bda326
SHA1 7f3965df1db7f9117f19749990354945c4109d12
SHA512 51a62a2b6087c54a06646c6477f1b2db29cd9d70a2317b8e4e9565e9d8576fc073ea5d16bb597cf96839b40a1a8b976bede2044de3261f772aa4d4d64b8e5091
SSDEEP 49152:kBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjEb5+Pl6bJTIZ5jdgR:HG05lO43bBslgJTIZ5Bgp
TLSH
T12FD5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3d7ef1261eaa6aed44c90bd415f1500f0d4bc1288944fa497aa09364c3dfc2f1
MD5 08bdd65165b5458600c763f1d605e76a
SHA1 4abd847bd7304f42df33dca7a74e3cbc03fd555a
SHA512 7ebdfaaec079fbeb837a3ed4ada5279d7325b5d75714deb237f2e93f2127d542dca15198fe4364a93fca305ca48a7cfc771ac0ee499656ffd7dc292b1f2f1f40
SSDEEP 24576:vfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnLmb57GBiOl6a8JTth/RWZvR6wQQq:Xa5POZ3lJt2pasx2+msb5+Pl6bJTIZ5s
TLSH
T12965AF5EA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 12725fb86f5b0525753819d8d2ac0f03ac06e45bb2f23bc696bf3a20a5684cb2
MD5 951ef6816de0d8f1a4e15d3677a810bc
SHA1 5155138b58cb7783188ee8f967ce6c8457e0ad64
SHA512 e6f53c2fb0eb762b807a0401062389a453afeef31aad5b088345f908dbc40e19b439f5722fab781274668ab1fc346d5a44ca3793c53eb66fe525063260416c8e
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7Fk9mb57GBiOl6a8JTth/RWZvR6wQQ92pN3L:9Nc/zEOVHF/b5+Pl6bJTIZ5jdgpJ
TLSH
T1EF858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ad0fe8eb3c9b3014bc3dafbbc08da38db3f1f51aeba9f25623bfd685251b3117
MD5 b7a1dc96793ae25b6be8b61d1d3a439d
SHA1 ed27ec3f1aae1065b2378c878af62f127ff8c8e0
SHA512 acf263b73f4c024a6e49abda545a8241034ddfc8c568f2fd385d0119a5700e4b254de13fc82aadb8b8d5f280ff21c7454994f773c9bdd515c13b3577a8d7c391
SSDEEP 24576:QzkNvNnaFeYhJNtmZBmnmb57GBiOl6a8JTth/RWZvR6wQQ92pN36:QzMwBtOmmb5+Pl6bJTIZ5jdgpY
TLSH
T1C755AF6EAAB805E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 13310932ae5bc6b26f1994a788f49d6af0f5bcb8a92aa614e3e7cf5ee7182731
MD5 4c506396e4df52279c6007a3cddd6e1f
SHA1 46eee64027d95989368bdc95e2c19b5356a94654
SHA512 b62672586b0fdc7b226279058e85217d86476ac40d842b0d6ccac1f26e700aab31dd0896ef02e752ab88034f86cdc2fb21a7f714c6e4541c1f09e85360f8f386
SSDEEP 24576:wD3FHshBIYQgAqmb57GBiOl6a8JTth/RWZvR6wQQ92pN3p:wDVHeBIAAVb5+Pl6bJTIZ5jdgpD
TLSH
T1B585E17ED65D00E4E47BD27CDA938A06F67138A9472266DB02D481BA5F2BED43D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1384-51-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/1384-49-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/1384-45-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/1384-38-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/1384-39-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/2384-23-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2384-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2384-15-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2384-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2592-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2592-131-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2592-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2592-136-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2648-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2648-53-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/2648-275-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/2648-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2804-312-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2804-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2804-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2804-100-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2804-106-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2804-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3304-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3304-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3304-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3304-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4784-120-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4784-113-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4784-311-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4784-114-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4796-396-0x000001C08CF30000-0x000001C08D0B3000-memory.dmp

Download

memory/4796-326-0x000001C08CF30000-0x000001C08D0B3000-memory.dmp

Download

memory/5492-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5492-94-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5492-327-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5492-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5492-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5492-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5572-76-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5572-82-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/5572-77-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/5572-308-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5576-1-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/5576-9-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/5576-0-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/5576-86-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/5596-293-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/5596-72-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5596-66-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5596-64-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/6024-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6024-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6024-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6024-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download