d15aa7d548199e5641638edb9494863b7b7ef5cc769e06794ee4ad49c0bf287e

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Size 935KB
Sample260810-hat9fsshjc
SHA256 d15aa7d548199e5641638edb9494863b7b7ef5cc769e06794ee4ad49c0bf287e
MD5 51b15a91ee3f103b1892571bee8eca78
SHA1 30b50f325d293347e4e34233de75f563ec541fdc
SHA512 573706c2656205a5fac51d84799d9971209880c4d5136d996a9e0ade8cb23ec488a7a60e4a8100a386ae72db6b7b629c85f42a3ecabace64f4d6f5932fbc8813
SSDEEP 24576:iQ8n4a65wpePMWuGMF36YKN4B1Jdi5hbKFlkJtx:iBpePxu37BvdebQKl
TLSH
T179150142F2D610F9E56B9178CA124516EA327C160B60A6DF33D47E963F237E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2444	elevation_service.exe
928	elevation_service.exe
908	maintenanceservice.exe
4152	OSE.EXE
4112	PerceptionSimulationService.exe
5800	perfhost.exe
5988	ReFsDedupSvc.exe
2536	SensorDataService.exe
1500	ssh-agent.exe
3788	AgentService.exe
2400	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\efb633da5387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000071a0d539228dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045b9af109228dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019a94f0f9228dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036050d0f9228dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1a8f60f9228dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b49ffe0f9228dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2444	elevation_service.exe
2444	elevation_service.exe
2444	elevation_service.exe
2444	elevation_service.exe
2444	elevation_service.exe
2444	elevation_service.exe
2444	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1936	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	2444	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3788	AgentService.exe
Token: 33	2400	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeDebugPrivilege	2032	firefox.exe
Token: SeDebugPrivilege	2032	firefox.exe
Token: SeBackupPrivilege	5988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5988	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2444	elevation_service.exe
Token: SeDebugPrivilege	928	elevation_service.exe
Token: SeDebugPrivilege	2032	firefox.exe
Token: SeDebugPrivilege	2032	firefox.exe
Token: SeDebugPrivilege	2032	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2032	firefox.exe
2032	firefox.exe
2032	firefox.exe
2032	firefox.exe
2032	firefox.exe
2032	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2032	firefox.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 760	1936	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe	89
PID 760 wrote to memory of 2032	760	firefox.exe	91
PID 760 wrote to memory of 2032	760	firefox.exe	91
PID 2032 wrote to memory of 1676	2032	firefox.exe	94
PID 2032 wrote to memory of 1676	2032	firefox.exe	94
PID 2032 wrote to memory of 1676	2032	firefox.exe	94
PID 2032 wrote to memory of 5468	2032	firefox.exe	97
PID 2032 wrote to memory of 5468	2032	firefox.exe	97
PID 2032 wrote to memory of 5468	2032	firefox.exe	97
PID 2032 wrote to memory of 5468	2032	firefox.exe	97
PID 2032 wrote to memory of 3676	2032	firefox.exe	104
PID 2032 wrote to memory of 3676	2032	firefox.exe	104
PID 2032 wrote to memory of 3676	2032	firefox.exe	104
PID 2032 wrote to memory of 3676	2032	firefox.exe	104
PID 2032 wrote to memory of 1772	2032	firefox.exe	105
PID 2032 wrote to memory of 1772	2032	firefox.exe	105
PID 2032 wrote to memory of 1772	2032	firefox.exe	105
PID 2032 wrote to memory of 3060	2032	firefox.exe	106
PID 2032 wrote to memory of 3060	2032	firefox.exe	106
PID 2032 wrote to memory of 3060	2032	firefox.exe	106
PID 2032 wrote to memory of 3060	2032	firefox.exe	106
PID 2032 wrote to memory of 3596	2032	firefox.exe	107
PID 2032 wrote to memory of 3596	2032	firefox.exe	107
PID 2032 wrote to memory of 3596	2032	firefox.exe	107
PID 2032 wrote to memory of 3596	2032	firefox.exe	107
PID 2400 wrote to memory of 5796	2400	SearchIndexer.exe	108
PID 2032 wrote to memory of 2928	2032	firefox.exe	109
PID 2032 wrote to memory of 2928	2032	firefox.exe	109
PID 2032 wrote to memory of 2928	2032	firefox.exe	109
PID 2032 wrote to memory of 2928	2032	firefox.exe	109
PID 2032 wrote to memory of 4532	2032	firefox.exe	110
PID 2032 wrote to memory of 4532	2032	firefox.exe	110
PID 2032 wrote to memory of 4532	2032	firefox.exe	110
PID 2032 wrote to memory of 4532	2032	firefox.exe	110
PID 2032 wrote to memory of 616	2032	firefox.exe	111
PID 2032 wrote to memory of 616	2032	firefox.exe	111
PID 2032 wrote to memory of 616	2032	firefox.exe	111
PID 2032 wrote to memory of 616	2032	firefox.exe	111
PID 2400 wrote to memory of 5656	2400	SearchIndexer.exe	112
PID 2400 wrote to memory of 1088	2400	SearchIndexer.exe	113
PID 2400 wrote to memory of 6108	2400	SearchIndexer.exe	114
PID 2400 wrote to memory of 4512	2400	SearchIndexer.exe	116
PID 2400 wrote to memory of 3236	2400	SearchIndexer.exe	117
PID 2400 wrote to memory of 3312	2400	SearchIndexer.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 27097 -prefMapHandle 1992 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {97df8fba-f5af-4673-8bd4-3a05285bf151} -parentPid 2032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2032" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:1676
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {61696554-b080-4fd9-a804-8b0396f52315} -parentPid 2032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:5468
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3564 -prefsLen 27274 -prefMapHandle 3568 -prefMapSize 270279 -jsInitHandle 3572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3580 -initialChannelId {e5ddb995-92c2-4833-acda-ca603f5c7192} -parentPid 2032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3676
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3716 -prefsLen 27274 -prefMapHandle 3720 -prefMapSize 270279 -ipcHandle 3824 -initialChannelId {8955ea9b-c246-4eb6-a512-644ab2ded01f} -parentPid 2032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2032" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1772
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4412 -prefsLen 34773 -prefMapHandle 4416 -prefMapSize 270279 -jsInitHandle 4420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4428 -initialChannelId {9434f3d7-abbd-4d3a-acf8-593b5543c641} -parentPid 2032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3060
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4428 -prefsLen 35010 -prefMapHandle 4980 -prefMapSize 270279 -ipcHandle 4964 -initialChannelId {ccd0faed-0e4a-4ddf-be75-c2ed81b65abe} -parentPid 2032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:3596
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4260 -prefsLen 32952 -prefMapHandle 5480 -prefMapSize 270279 -jsInitHandle 5504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4716 -initialChannelId {ab254ddc-d28c-4913-b4ae-1d0d2847baad} -parentPid 2032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:2928
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5516 -prefsLen 32952 -prefMapHandle 5520 -prefMapSize 270279 -jsInitHandle 5524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4668 -initialChannelId {192c84f8-9574-4baa-9407-12ff68b30f3a} -parentPid 2032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4532
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5828 -prefsLen 32952 -prefMapHandle 5832 -prefMapSize 270279 -jsInitHandle 5836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5520 -initialChannelId {a2b16cf3-535b-4807-a105-05860c16dbc2} -parentPid 2032 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2032" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:928

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:908

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4152

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4112

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5800

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5988

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2536

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1500

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3788

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5656
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1088
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2764 2716 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4512
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2764 2716 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3236
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 50aaac3e82ec5c27da16b287a1f8bfd46ac134ed61e8319183c900a4ca90750d
MD5 2b2043a9dcd7fc678baff46021c2c110
SHA1 66d08a3117c9c7d15a5c01c6d7aabeca9a65978d
SHA512 7f213cbd8650b8ed155db869b4030d28e315fe04ad88dd2d2883d8940c564633f647dbb3a75f71fa7333dfa1b803c7fccb6da3aab9399256683a28d85c27a191
SSDEEP 49152:1b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnJxu37BvdebQKl:L3q6mjBhv8Ll
TLSH
T1A9D59D03F2D900E9E069D1B8D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 ee6ec1b8b1bf066cb7c5e21d0eef5fd85929d85cba00c0aff7cb91221a3f5667
MD5 3c0453e2d3e85a8813a44d0f6e766981
SHA1 691ffdf9806b2cbc5b1e7a77e4abf2f2868f2f41
SHA512 8861c95ee71ee48ff80926370507de5f05e088a338a56ed3dfb6ae258bf24ffad7bc8ff6efca5f302c3f9f8d61b342c084658d7f5731b56fe9ada3b8cc3a561a
SSDEEP 24576:3XYfDtczAkMWuGMF36YKN4B1Jdi5hbKFlkJtx:itcLxu37BvdebQKl
TLSH
T14905F12963D408F9ED6B92BCCCA28516E6337C510760EADB03E495391F233D85E3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ccc0b3a7734b591031fecf6e6ae146ef32a3ef4de6ea0e2588f75cc0eeba865c
MD5 d9a4ce6a2baab63cbfc8550226b72b74
SHA1 6d1762fc1a93afb91ef6b8e6e23733027cf662c2
SHA512 e72891e077a32e8b46e13926012bc3cdfdb08306e23866e92b8a4beca5363bb5a8daa2415e66b97982e6650c2f21e0df7e742ff650d1ef6e020e0d9cd0514565
SSDEEP 24576:d0Le5ji0hmxhrM5MWuGMF36YKN4B1Jdi5hbKFlkJtx:dPji0Az6xu37BvdebQKl
TLSH
T19D359E16F6748331D073C0B9C5D2A69EE97234861B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 625673cf5dd69cbecb94a19afc92b2b8fe860ff46d119ca652d8d9bd7df80ea1
MD5 bc427d9af0c08d8670fc23eae338a2ef
SHA1 7d14dbbb935bfc47e0292aa3b06111278f627418
SHA512 668ba4e4c27952045d4b6a9ae2f1f04c41b069b7e7ae8754547d3fb92b3b9d37553f5115ed47e13de9beae7eb391863a413e9c2f0d92192a2a66df8cb6fd7fd5
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWj6q8wyufMWuGMF36YKN4B1Jdi5hbKFlkJtx:P/ezSC6vUzPv+Hjymxu37BvdebQKl
TLSH
T10C755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 979aab89ca833c5213cea418a7936755cc4ea2ba1cae609cfede148149b047c1
MD5 767bb996e02a7fc3a312447946ff7111
SHA1 5991624fd999c26900f0d9edc8b955e0ab0ceaad
SHA512 589e9a471d2599cfc2ee2882cfa7e4e68344d84b63fe244a48b1057bc1f8f99aea494163af41b45f4a281ef7b4468c33b65e29cbed162d3d8c8a2817956e3498
SSDEEP 24576:xVbqPb88hv/l+BsMWuGMF36YKN4B1Jdi5hbKFlkJtx:xVO88hXl+axu37BvdebQKl
TLSH
T156559E66F5B48331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 ab1983330e8ad168677ce24d260d5ab4c952b7a290a2e81de51f00b397c4cbee
MD5 3e30500028f2821350478cb34fe27993
SHA1 623fb4762726c1d8d9381003fe2eb53be27bfcbe
SHA512 e1e0af34d525a1d829cab84fef8604be35b0906eccfe83f43f600ce8bdc78a69108168365a9e2f69948a055cc1bf0444e4028d949cfb01e6ada9c8b83bc58510
SSDEEP 12288:oGdyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:oGdMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T14EC423435185A031FF2831F5AE7DA95E95350E200D20EDFBD690767CAC7A362E8C9A1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 3852bc4fbbe09eb33158ff04c27d7a1bd9c9135a0d7a2f5c0a85d4c113ad857d
MD5 acba0434e0ec554ce02aff94032cd8b2
SHA1 b5f6cd547fa074dc37a195fae59e00649b17a761
SHA512 0fcc9a3ebda73562bbde2ccc3a9f338f56219118fc41e33753fe3f489dcde00e471ae01c4ac1272f4d133df6750c8fbd4cc43c82a5dab81d5b9a159d8e341160
SSDEEP 24576:5JIUEMWuGMF36YKN4B1Jdi5hbKFlkJtx:5JIUExu37BvdebQKl
TLSH
T14605CF3BAE28FCE2C67E5DB95A91C600D77278304F61A3CBD164820EDE235E15D79C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 28b01830bb188878b5605f1099e4df31f2321ba162a125f2d6367605eed3480a
MD5 419403279cc9ac5a2f08e3aef3b2d595
SHA1 56cd230875ff950dfab03d3c4a8ac567481b61e5
SHA512 90ca5633942357a52216bb4e844201bf94d3e70285f7f10ada840e20d363573ec3e303211ed5f439f0520b0b5619ef4901b4f53f5476896e6dc0fef27b336685
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THI:GQvGAdlCEL8c/WRNw5CIv8Ll
TLSH
T1ED266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 2b996e7264661910e2d62fb098d2a9ea6324405b4bd831c33b76e3b458b3b855
MD5 b51c043e7e581764b990ee74a02b1f16
SHA1 548f62baadcb19d2357cc058c7ddb054d8bc8c04
SHA512 55c34a76b609c2960adbaf98c651d7bc8632a3d2139fe55d215a29d42f326b97278753287bcc31d687b21a5d2a9de5c0db10bda682e025c9fd59a08d7301ab42
SSDEEP 24576:0fewsAjqMWuGMF36YKN4B1Jdi5hbKFlkJtx:Gljqxu37BvdebQKl
TLSH
T1AD15EF31FA74E032C67B0DB61B36D71A543D6E200F611AC3E3E89A9D59302D26776E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e6601eadc698b33d73dbefb89eca8ab19b7da764348857279f52b433f3452a51
MD5 54a802f8d0f0f991b2f7a0dbeb334154
SHA1 0dcf16ec5b799d5dc6506020821abfe6eff83686
SHA512 41db93c870c720526030e0f01395ea06f9275fcea854b86a4cc75d6142ba9e8b4037eba1f6e31b49e9ef69b3ab6a1429d4d4abb2a946566414a145aedacba5bc
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH/0L:pUEtQevvqc2W1cpV20I32/0
TLSH
T1B7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8fa284805aed320c992de6495e61973bd39bb53a52fa29f6a4cc46731b719862
MD5 f8e9060f0a957c586146d6174ffd950d
SHA1 e79848633b1cb64bd8f5a6703b3e578d0c644e91
SHA512 f1fac701517cd8342ce60c3e94d3a1a701065cf52dbeb84c1940da0f17804505851101e12cc3188ea1fc257e43e7f316e1ff7ce1c8fb5c0a281d9ef80b1a0c10
SSDEEP 49152:xCbRquA/m2yL5zQfFiV+XenmE3/zKxu37BvdebQKl:+oqtVjnmsv8Ll
TLSH
T1ECD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 dff95ee6f72209bd036699d0bc5524087a4d635124aa2d6f497e6445576b2b02
MD5 3f352a3d82fe70f2a9e15f36c1ea57a8
SHA1 f23cab610fc89d2d8a6f6bf9ea915d7179cfedd5
SHA512 e0ad21f8943a39706950112e12051327ba167a72e19e738e99bce08b2e220f6de169417be8b0bccea3f8eec46ebfe70b92742d48aa8ad4b365bb95fb130a729c
SSDEEP 24576:LAhGL6IFoiwtA5l7S537MWuGMF36YKN4B1Jdi5hbKFlkJtx:LAM5Foiq5Lxu37BvdebQKl
TLSH
T15635AD81E7F955E4F5B3AAB89DB69171EA76BCA61E30C20F2150D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 b2b8c63a07634a6fab3cc1996f3e21af04705860fe2c94bff12215be27ab62da
MD5 242bb44d77012a463025bf4813ea4b62
SHA1 df89d11bfff6c1124b886f07cf61d1b86a9ff745
SHA512 1d89c54b557f29366ef308148725bf428ac333a08afe515a8452ee95a74fac83a353b7f6e8a9c87587706cca905bf6bd140919604995795879bbcb073bcd7840
SSDEEP 24576:SwuROWmMWuGMF36YKN4B1Jdi5hbKFlkJtx:SwSOzxu37BvdebQKl
TLSH
T12205F14632E40CF9E9665178CA57C536F7B2BC112A21DB2F5360C66B6F37321AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 f2382863248ab6fc03320b249aa706fcabd92e1bc670413f6c71087ed5a453ee
MD5 4d87359acc3e263c7a2431ee5eb3df3a
SHA1 577711456cfd93bd07850857c2a5d6641cd973c4
SHA512 87f8aadf9e8957cee2a996b35cb64ab560dcfbff03c670dfb9fda033fad39de626acbd19601dcb04014516ccd08b375f3ccfaad80e3b4a0022854bb66a8ae6b8
SSDEEP 12288:DyZ1IyayPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:OZuRMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1B2E4128632D460B5E66662BCCDF59A0AD3723C22173183DF526052792F33BD29D39B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 450f3f76bb80c8b2c3d1241c5de981a8da032416b6367728868d0a16abb9060c
MD5 8db8193ca5e39e35590fda40f92f7c5c
SHA1 a85c09d02c7a58ac781cf18a1732446e2103ef88
SHA512 d4191575e112b72b5f1e7af462fddb9624a64e5711336ede3d4299d2dd105704b701e313ef975cfbd3fb80b2e1c81e362f1432ee6fdeb1074d48ff87a3e820d7
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uk:fQRQyi36YOcPDLvw2gAf+PN3xv8Ll
TLSH
T19D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 07624461beb20913ab86fcb92bf1b5a999515698427aa3521a871f91173f5f63
MD5 5c9f5be4f5a3b12bbe832c683ba9a61c
SHA1 9942071b4780bcd396289191ea93dfb886a0063c
SHA512 9c353b585ed0f5ac743b249cc031f55783be3546eee3fe3c14e3864ba812b7a1a730f4521ed843c82e89a91c0c0ce07f30c4a282bc78f521dab53e1419a3f200
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uk:rQRQyi36YOcPDLvw2gAf+PN3xv8Ll
TLSH
T117667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 88d4c39d47c380cc3852c7957565a671447290b8984e2aa77cb93455dc55b1bf
MD5 7c13e29e992e3106fecbf2433ce6b9e9
SHA1 6a14b55fda0adc137e8f60dd59006de5d0e542ab
SHA512 f312cb7a5d751b9c826754459a1a17beb58cb7eb3073db0e297d1ff45ab78a130df7e41d1d8db6349a1011fc4f43c36e8eb48ee1686999287fdabe85d9260ed6
SSDEEP 49152:x68Qg55nhkeWu7PNU3/6xu37BvdebQKl:vthTRc/Hv8Ll
TLSH
T129B54A33B2F600A9C44DE1769F4A872196E17C758FE0E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 41b5c29a215e46c3ed49f2b393256ee6ee5882af9c5768d95b95e874384a5669
MD5 69b47210d27436c1f7219ecd6869c131
SHA1 efee4c59b6e4775a704bfa6e3d281984bcd70bd5
SHA512 ad1114a825da47d71a60a22b9702eb2aa48b1ff9300c99392426a73b7128f55e855d42184dcf9844a35cbfc971f63faf63aa51e04e7f2d21e9f5eb316296abee
SSDEEP 49152:e3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk996:fy5112gYy5azzVvU69nLKnhZSv8Ll
TLSH
T100167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9c62fe77659024ce02d24676b97269936548ce5fd20841a9da8d845cf46883eb
MD5 2692c703dbd1ac0d9d536d6e4e00ffa7
SHA1 15029cd9ea02d106b239bbb6d7c231b0abef1371
SHA512 657e5514781c24d6adc6730d2945570cd7ccb1b1add38b9bb0691b304438ab57bffd35616706da8cf22d924cb8e4c89d5dfe3edcfdafb710dfb556940bb9dd6a
SSDEEP 49152:kB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl0xu37BvdebQKl:+u6JmIxd2ddv8Ll
TLSH
T191D59D13F1DA01E8D06ED478974A9233EA62BC490B34B6EF0A9073552E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9e9c9207d030bf746137e27358aa9e8450844937ed1dc9d6bb7d38accd8bd65d
MD5 bd7ba03448ee441b7029265ba51700a8
SHA1 7b7b580c310a66196f18e47a2452c48eaf890600
SHA512 e38032073cd90d161e3983b06eead51e4bfcb466c993c5812710e7e11b99dc22e1286e65144639b50e59c9561de2e0a8a3c4ace7319d82304c49f3805f50e19d
SSDEEP 49152:v1hpsNoJpF1A67U44CwH7R4xkxu37BvdebQKl:vmifPqRsv8Ll
TLSH
T195B5AE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 07631495117b8feeaf070d2c64bb021a9fce0edb09218f96bdb7557d4276829a
MD5 da994359be9e3a6670d0806d63017ed8
SHA1 6e5306b785b2d99c30c4fe1882a67a966309fc94
SHA512 1be28f47d9bd4ff3b58b3bb87f4c3f0da3e1ab461dcf413fc44e23af9f0609629a7fd70fb45a84b700189072ad46af92242ab92150648f132438a933d97b739b
SSDEEP 49152:GSuZQIY0Be2KkRVtOnks6NMHqRxu37BvdebQKl:I5dKqi61uv8Ll
TLSH
T1D7C5BF03F2E940E8E0BEE67487659236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 101073b08fb513c73e7240060af862be6c6d6231273f3d2fff0ad446860ccf08
MD5 e134fcbad03c0a82297c88e2f2aed8a6
SHA1 35b411bcd3965d57b1919380d4b33af4ed06d2b7
SHA512 271aaa51a8d758f4a7bd6be900fc7cf1d1ba35f15cce54adcbb35178624abee33732cf348cded66ccdd9356a175a1ad76f768044fa9aaa178b929d64779312f1
SSDEEP 49152:mhtSn8EApI0figjgiDn0AP5woxu37BvdebQKl:nX2iWphwv8Ll
TLSH
T12695BE13F2D900E8D05ED1B8C7568632E972BC150B34AAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 6f65e36efca006be984a75eb0d5f0b13d39a808a3a460aeccdcc94f12040f693
MD5 6743ae368f1bb515abea4fc3e47b90d1
SHA1 561072c0bdfa8578b9bc85752ea01d9552a52792
SHA512 45a3cd7a597f342667c7bb095424f30c2f59014a8877830593435d8b3006c4bfce7d814b02f2254f47a4b4970f5de3aebb510ff034c6798309e88347c994c2ec
SSDEEP 12288:yVyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:yVMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T11DC4234360C69032FE1832F59E79A55ED0351E251E21E9FBF6807138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 905e0329a86bee0cd0ea76c1d058d4b2fbd9b03fdb15dab44430396d231c6b6a
MD5 6cc0baa6cd1e91cd7cffc50bce0c8cf5
SHA1 5fbfb588629ca4aea30e7949d8896a69f6194d10
SHA512 cfd00db0e680777c81082852ee164995c2de621ef2fd54e6730e5110578ae7e868deedce7cacadbcaf33ce274a880175beb2e1952b725fefc2066258332fad0e
SSDEEP 12288:TOyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:TOMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T13DC4234360C69032FE1831F59E79A55ED0351E261E21E9FBE6C07138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 d434dda9e1d527f05710fe5d3ad0b94664bfef1d4f6a106a0d52ce18b8dc18cb
MD5 347cc49f94e6a02440655f6c46120561
SHA1 46849be0615475f1b98e96daa4776cbfda8c82c2
SHA512 faa8db9b18d34d21f6eef3a09a7cbc56465d43c6bd1d01cab8224ba0d2ce63b5732ba326cc4767c77064124db6be370778f4a9f8c642071af7d6471dd949e5e9
SSDEEP 12288:x8yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:x8MWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T183C4234360C69032FE1831F99E79955ED4350E261E21E9FBE6C07138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 57d9c02e0e9ac7d50dde10f67fa52d63b6f3e38f30d0e431c49b529c50514ba5
MD5 f5d2bd8641ac612c71fdc26566f3af84
SHA1 268dc7f23d892976075e9e0b03dda163a8d89bb3
SHA512 e65b17150b5a950aa8afeee99386254a550190172c38eac53430be734a8663b057ea7778af19c463d744bd69a358b8a335890df5ac8c27a428378c3fb091b850
SSDEEP 12288:2VbyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:SMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T12AD4234221CA50B1ED28B2F9CE79951EE1753D651B31AAFFD740213C2D72361A8A4F1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 c3184a233251cba8007b40871c604cfe0fd7b2b9757b8b621d6929663098d7ef
MD5 c83828c4cd1e388719f02d2f1d63286f
SHA1 cbd3555800b11e19106fc33b578c2f6fb570d712
SHA512 a9fd607928609bd31858be8f2933c4940edb33898e1c45af07b8cc2883a5fa0e071107c11d051fb72aa0e84f9ebf8a7797da04f5af4719adab31a40fe37f0951
SSDEEP 12288:ODyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:ODMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1E9C4234360CA9032FE1831F59E79955ED4350E261E21E9FBE6C07138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 9069357c5fad1ac417a583d503fec8d3e5b028a01388da9f0bf0b02498e8e65e
MD5 a60513e833a64b6d174e158a15b9479d
SHA1 ecde1d9dbbeca0e090f9ad2f9c7ac079cd0e48c9
SHA512 1d17f2b1880f73c999bc1f7ef69c0b64d3b420582c9f4691281bcf4653f057a0736a7e56817c06328e99b35cef9d673f1141e658377621cbe9e274cb10674379
SSDEEP 12288:ciyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:ciMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T168C4234360C69032FE1831F59E79A55ED0351E251E21E9FBE6C07138BD76362A8C9E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 bb67ac800fdf6da49c332e1c9eee559563b59068369d6f119abef9e842e912b6
MD5 b083622b625596103d92aab3b3f08fdd
SHA1 29de5cff35797c1527568b8e218d83b2a01b0e06
SHA512 adb74579e205bc3b976c87cea094cf308ff01fe09320c33060690b5dfcdba1b25b278da21b08152ed3167ab45a6b51d8b58ed94506054c4d5ad9ad01f635c667
SSDEEP 12288:uWyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:uWMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1EBC4234360C69032FE1831F59E79A95ED0351E251E21D9FBF6847138BD76322A8C9E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 79233f793387849c7522444760adafd14f14fd7e64e16d7d63beec2db7587a0d
MD5 bdd5bcab82da14228b325066a763bacb
SHA1 11008792271b5cc04a05675f6d403ea4d25e5c2f
SHA512 cb1d8e6f112365c393d23659b1c58f0d7241689ddd37f69c2aca8e55cdf4b487c4ecbdfa17492219977caa08100c597d489739a2a011037e31887fc4b7c4a07a
SSDEEP 24576:QZM3zFVSOuMWuGMF36YKN4B1Jdi5hbKFlkJtx:QZM3zfSxu37BvdebQKl
TLSH
T13B050295739018F4EC67917ECD65890AD2B27C1A0B70CA5F13E4362A5F333A15C2EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 8cb72adb9a5498df7c505a570a164087944baeca69b3c2a9dcf7c94bb4e08204
MD5 bc5efa27c6d5a8d2d94d8996e78f04af
SHA1 83e4121830713e752689cde5ffac16bc982a4e2f
SHA512 7aad8ec5907f5f9e22d0893dfd318e1bed0b8bd94aa810724ed3e7efe1dc463f77aea84d3dcae568f44b3ac5fb8d68da812fe772c4fbbbbb88f1858bb9b17e68
SSDEEP 12288:MByPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:MBMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T13DC4234360C69031FE1831F99E799A5ED4350E251E21E9FBE6C47138BD76322A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 2bd2f11afcf480e4da6eb8a98f606ba11c7366e60371c61f4ad32548cbef0c8e
MD5 7c2f6de6917dedf08b8678d8fc54d712
SHA1 e32ade1082725988a88ae3e88db15e3092262d3e
SHA512 385f3be655964c9c4b2ebd032cf3525e51bd2ea95d670c5e023cfa225c9ff689376a3161782b017c0ae29df844aa048faa21da5242dce299e091629835cee637
SSDEEP 12288:5NyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:5NMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T132C4234320C69031FE1831F99E79995ED4351E251E21E9FBF6847138BD76322A8C9E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 eb0275d9f7dfffde106f9940dacaa438e9d8c3644cb00e98cb7ed2b2981ba797
MD5 ca6ba882b1c673d871ccc5b4ef29cc72
SHA1 82da11d340cda463f6fc765fcf7d171bf4064291
SHA512 bd19f8f63a91a71014761629c68be933eb2b61dd963ebb24296a8dd74a45ea776c0ece6a463d61c9b6df34ac90f30c7dc8f197f5137f0100cf0fa664a00b55f7
SSDEEP 12288:jyPz5L8ayPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:OzyaMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1D4F40243729530F9D52652B8CD665A06F3727C320B209AFF53A0137A2E373A19D7EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 e0aca2142ea9289b4771cb4403a4b51ef5c0c3267d8facd60dc1a24b8a0733d5
MD5 4fdf2b7ccd8819409e1171d88e04d04c
SHA1 fcf034aa6d317f9c0343cb85fbf7a141c081cd6c
SHA512 d58db8aabbbfd5065f63d92b73f16aa2108e8227327837a61b7fdcbd124a2bb1a90844b4bcc33dc438eaf43a2fda561ba273b1358d9cffe20a2bf8d29d9cf027
SSDEEP 12288:CByPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:CBMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1EEC4234360C69031FE1831F99E79995ED4351E251E21E9FBE6C07138BD76322A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 998b375fb01efddb877b3a0ae511a0bc0b361202fff16b56a073856c998d8e4e
MD5 5c6d720f2028302241de66996dd936b5
SHA1 4586888dcee9c79f04a6b08a0f31073303bd08c0
SHA512 d0bfec589f8d2c4a8860eaf03544c4c692178205ef497bd08f302e9267ef2f4337205fb28ba9d9404ec301eddba3c60b96336de80a8046efb53b7c3b43301090
SSDEEP 12288:nByPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:nBMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T128C4234360C69031FE1831F99E39995ED4351E261E21E9FBE6C47138BD76322A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 074d18ad2627740addf1470b094b5888b2abbbfdc606334bd46668ecc34d88e0
MD5 d44fe947f02017f280d14b46e90a8b4d
SHA1 b8c16083cdf30b1aaabeb515ef8fc507adea6126
SHA512 e7b7ffad48a05d630353fa6dcf175ae35ec7dc746ae1e4ffce8933c870877fba602b2b8e2d487aa29cf9bfc94b2b0c02944f52074acf83142a08d3b0cf39f009
SSDEEP 12288:WyPz5L8ayPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:rzyaMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1AFF40243729530F9D52652B8CD665A06F3727C320B209AFF53A0137A2E373A19D7EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 11dd8295e604ede9449ff714c3bb1a1ce49e3a1b74b83c62e28011d0ed362385
MD5 216b072da6788a09a6ab4e2f1b59750e
SHA1 bf79ed9bd8ad1a9c606080e30101e2adcfaeb5df
SHA512 b5f867e6cfede30f0676a96744feb4dce84328c1137865bc01e47ef41c041bccde0f6e8ab8fc15eeeabc7867fc86c3e456c89866f5c7c69d33e53b5d81deb107
SSDEEP 24576:gT8aLl3z0zDMMWuGMF36YKN4B1Jdi5hbKFlkJtx:gT7Lljfxu37BvdebQKl
TLSH
T16C050295B39018F8EC67417ECD65890AD2B27C1A0B70CA6F13E4366A5F333A15C2DF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 94bfef62dc20004f453326f077b4c3d95036eb49bce8b9bda7841a58bf57113d
MD5 84f3a1d0fd6cda591982af727b9ba076
SHA1 3b94bb6d2a392e1c912eab18bac0ed4eba8238e9
SHA512 7c154a7811d71ccb154e4813daf96ed207b7a712cb39c4ca4a3bd7b3991882ecd80f12f4f8aa62a4c5486f6a0261536c4558b6240f06edef9a0d8af0614148fa
SSDEEP 24576:e3rd9CHKy7GZgMWuGMF36YKN4B1Jdi5hbKFlkJtx:grd9CHKyaSxu37BvdebQKl
TLSH
T1A725CE90B3E410E8F0B79A758D769512DA767C5A1B31DE8F03A4262A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 a4e2ab420d91867cf62cde4efdc7ecfcc1a114a35b3957dbd44a807e9716ff90
MD5 ea9fadc3e11452685dee8cb2098c6bf5
SHA1 75bc86c25462248a6233b1759f565d2566ee5fd2
SHA512 5837f0e24d084b725d9259401dc9cd47d7a6b7afe0e0d5891860b971f752af5889269176fcbf5e93dd6b5179b7f79bb2ee4ab93669361c6e964ca25f3bbd7cff
SSDEEP 12288:ZcyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:ZcMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1DBC4234360CA9031FE1831F99E39A55ED0350E251E21E9FBE6C07138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 f4b267a3efc69ee43e9ddb1bae1aa37995484e109f7bfe2112fa7e0e03daf9a6
MD5 9bf350fbf644bb30b9ab089123dd3133
SHA1 e8640b21f3a790cafc27b8f8d3c53b34f8bc0d49
SHA512 074da08721771fb7fc9e6a14df76aa0e2b3d0cf45550dfde6f5e69da55997083eb2ca8ce83255de533abf42a4abea3f6e28b00e7c86efd458fb39c195c972fe2
SSDEEP 12288:H6yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:H6MWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T150C4234260C69032FE1C31F99E799A5ED4351E251E21D9FBE6C071387D76322A8C9E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 294530cc8c295a5be1e4695bafbda1aef9e139a552a4d7379252276d953d3a1c
MD5 ec9a45b9a2422e9da63a5ac22b39d60f
SHA1 35b988cad167e906a5c48ae6be7112fdfbdaebe5
SHA512 917985e290ec91f4095f7a5cfcc264869bebf57a80501c7b07874faf64fd5631c58589f1aa2906e3065a2e74e3186f817ff151e8e2a2232ff6fee2d62ad7276f
SSDEEP 12288:SHyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:SHMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T153C4234360C69031FE1831F99E79995ED4351E261E21E9FBE6C07138BD76322A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 55a96d79c866792d680aa975d3331901edb58fdeaf39e808722a69998cc1fad2
MD5 2ceb34eb4430fef1264dacdfb24650f5
SHA1 90d611db3ca50ddb674838c4c0dd6a623b20b051
SHA512 0f02b8afe21fadbd8599d20e7f1aa543ab08f405ef51bb4261113a57f3d573b0cd232a36c19e43332f1351ac142bbbdde3ff5c8a67c1ece6cfdaf1bd083a3f95
SSDEEP 12288:cByPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:cBMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1ECC4234360C69031FE1831F99E39995ED4351E261E21E9FBE6C07138BD76322A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 55cc239db582c12590223b9a536ec760265cc4bae3774ede5b117c3b77205b72
MD5 e5c9a93b64770e27255509fb48158e5f
SHA1 06667c8ddd52ba4800c050471f5e7cf1cb4d5eba
SHA512 d32b619382a6e8815599f44f8bbd0195c2851b3d301e8c370fde7268e453c8991bfe9b22f4d4dea2653307fa3817308d88a085600a5fbaae0a28bb7a781636cf
SSDEEP 12288:VcyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:VcMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T157C4234360C69032FE1831F99E79955ED0350E261E21E9FBE6C47138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 9c11d967775a9d41af3aa4abf54714aa635383187d5be959894b7d4bf2bfdf9c
MD5 372a39953b6e734811f639f83e5b0573
SHA1 2db6f4d54226b345f4df7e134de8b5824de29acf
SHA512 204b83b4523015a733882efa1a1c0aa30c4bc1e201f8e99d782aa38268dcb6cbe3d84eb7d49ceb0a651b5b787fcad57691cdc5622a62c805153b3683d2285a9b
SSDEEP 12288:bJyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:bJMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1A0C4234360C69031EE1831F99E79995ED4391E251E21E9FBE680713CBD76323A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 1b6af9ddfbd2d8f58903e3358d7e51a1126206370f7746b63c0250c1899e7c5b
MD5 7852284b2ac84bc735dbb1353ed9d9ac
SHA1 5755072f40f46a477c30e3eb553607143254422d
SHA512 d233e5cead9c14c297c46ecd3e9ff25990db068b1d7077677847fe5e7d9918fbc9330704c82f7fc044d4bd3e29c02024bce7e70862ae7c63386509a7f290113b
SSDEEP 12288:HDyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:HDMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T19CC4234360C69031FE1831F99E79955ED4350E261E21E9FBE6C07138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 97a82939e79bff3265fa051cf38c1c6eef683770437143c89871028cd69e6a62
MD5 2003ac4026580573f88539206894a948
SHA1 f5dbba7e94f24f6dcc84e280fa56016b7647624e
SHA512 2123b576e831e6cad3f6e39d8f67d6a661fa198e249ad770aaa3604fa0e6772e037368f327d2c135e2fe9629bba692a61dbfd42a6b4613f1a4dc9cf8743a331f
SSDEEP 24576:yfwvzk9RX6wkyAI9MWuGMF36YKN4B1Jdi5hbKFlkJtx:5MnYI9xu37BvdebQKl
TLSH
T17235DF29EBD844E5E177927C8DB7460AF2B178691B31C6CF029A536D0E33ED0AD39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 96631ed953a070fe8230b3232b637195ba9a1339f823e3b43ec34f8aab864272
MD5 773c5407b6fa7b70206f8abed4b2b0fe
SHA1 e62f61cf3d0335bf78cba366dae82d22208f1474
SHA512 b139e80c3053b8bff84d8e3293329a7df36d5b49ad44580726a4410b275e5e624f9557cee6c2af5b79bb111220b803ef05c4fcbdbdcb4102cc045761b93889f9
SSDEEP 49152:HYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Ixu37BvdebQKl:qySzPRv8Ll
TLSH
T127066C96A1A841D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2c3229dbdc5450792bb67a6e6f27bc28ed098fce6e46476ef5379b3cc8c551ee
MD5 1bc212c027ccd8d8f04a24dbc3363b0e
SHA1 eec8c116eebff55f10710e6b426cce4e666087df
SHA512 4c4fdf9c2e69f8cb9cebe0e9d2cc37e1d22e0b013ec96cc37b8f5854211054b1ee3ecd711ea375c9196a111a802fffc0ccdfcaa4c2bc2dca9515d53248511c2e
SSDEEP 24576:I47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYeMWuGMF36YKN4B1Jdi5hbKFlkJtx:I47JUQjqirIhCnDHUPfF/4xu37Bvdeb9
TLSH
T12365AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 ffebc8cefa50cfca4c4f0480a8336dced10475b7f3abfe30e3426ee5f5b73bc7
MD5 5dde434e79baf6092c16fafe6183fc52
SHA1 13c841f3c24a089edcf3400935db8926c39c5f5a
SHA512 ede4fa4350c1e48ed805ae24e6f704bbcd824b2df3d7e961356cc270f4d1bc93cadc4a95ce837de39b6c70df8fc8f208c726903eaf39a70b531c624c22baae2c
SSDEEP 12288:3psfRyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:4RMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1A9E4F10AD28801E8D46E62B9CB669A45F3333C2547E1D3DBA2C0F53D1F766909DE9B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 47807fc6b7a4f368588add462fbd17b7c148363d35dac53ad6c23d689783f958
MD5 156a2529df371a7d9a915ff33a6dc17c
SHA1 c6e1fc30b729e5a6311e88ced03ee591bb8a2e14
SHA512 819eab2839d217a8152ebcffcac261c5a7ce03703e3823eab53580958bdf115c60f005beb14d0e1e4a0b614fa3ba772b74ebb07db0380adc7ef320cb54875463
SSDEEP 12288:ENVPOU3fSnobLT1nfp1xJN4OgxwD7q1mSsSMmOQn/7/0:ENVWUPjf1n7h4JxwD7q1vsS5OGD0
TLSH
T132451741766BD78FC6A940325E36D6CCA7707C02EE45AE0773C8873F9476668BAF1281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 62ef523bec3e3e19f83d65d83a267cf6f68e54692aa1481f4b84d1e19177f01b
MD5 7520609c16f3ea1aef8abe0f5483be1b
SHA1 db5bfcd46741f6a356b844f3b72c0014f1ad3650
SHA512 1b2a6063a8105a98f7579f03494323610ed7168d2403dd96760fa35549ec1172851127922460f9eedbc83cd98214c954ddc013f816021c31c3820297902e9559
SSDEEP 12288:DFquJBNUBJuArqjK37Yqo1b0VLvHbd9PRQ/fjrUWxE9ZpD:DFqEH2UE+t16Lv3RQ/7QWxE9ZpD
TLSH
T1DA553A41A5A7E35FC9B99037433286CDAB78AC07B7453F0173848A3C986657EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 96d9a3845b1916564361683e55b080dc304c5ffade6bdac8d14ca5cfa4c3a73e
MD5 021570daf7fedcb90645e75a541cc16f
SHA1 6b86d74ae056d56b0b395739fe05202494b00dc8
SHA512 964bbcd0be37e7dc405d6130b625dedd3ba85ba1f0ead3bd4ecfdeaf04fb489c23219c7b780339a42767a0d54b01c312416153c4d97a657031ee92257e121237
SSDEEP 384:HwCe7iO024YC7DL84KKDL849B7SOEAd9KVRaAcP+AWRMAHJi:QqZYSDL8lKDL8CB7S/AmVAf+hRMmJi
TLSH
T17F729E3D9F413CAC1997C0E8C1F882D98D18B6A7CFE6806D21683D0DC7989A9B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 9786b8ff216ee0cb6ab77f862270ba1a64ba89cef47f6b85a905bb1ad5220452
MD5 9870d6f8b886fbe949f533e5e93f65ae
SHA1 832a5296b8739ec1fe5c5fe961daf1f23467f635
SHA512 4ae8d468f9bcec198c56cfd98bd20c137f80dd95e0f1a89955e47131deddab0de6665e02d0bcd46c52c1e68ce03f2f34ad8b8bd2c217cbbc36df242533ad5d84
SSDEEP 384:HXkRyiO024YPDL84KKDL849B7SOEAd9KVRaAcP+AWRMAz:3mZYPDL8lKDL8CB7S/AmVAf+hRMG
TLSH
T1AE728E3D4F003CAC25A7C0ECC5B992AA4D18B7A7DEE6C06D21583D0DCB98969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 f46af79ef52a9b5827ce331cae77290735ed99f6d8e1eda156f5bd95595f49d3
MD5 eeea92284b21fa665f53e6831b368e17
SHA1 9af7c53f7ad0bf0357027471bce6a29c0d64770e
SHA512 7919b03aa0fd65d142210511397509d1a84e845fd7166ec271cfe02613dfaa2f2d150b7de6254adf67998f285e282852a3ce48f0a3458028ad4efc2158713ce5
SSDEEP 3072:j3litHMTpZwVTEb+OI/WnpgPlEhI1vbJp:piEpkQb+Denpgehip
TLSH
T1BDA3AFF6DBA3C93D64FFD42D6B82893EFD362444B3A73009C963671461C6BB82674644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1b7691715bf5fbaad05d77c45506fd4126a0a444d2857b720b44aad0bc336d84
MD5 c3e35c92e706540f64e5390393f33639
SHA1 f29bb9eda01d39ec6b30bd9c5ef6303f0a757811
SHA512 ec692d7542e25f4e5e19b58c91139fbefab762c8dc2487ea4af8b4fcd8776b95ef1e4759ca3dba3bb271fa0fe7f8c8ebfa293e1d205f87f038f5a79020758946
SSDEEP 192:JOv5zbo8bOQyjrcXCf1d66JoztdzgCl6mc0dA:Gbo8bOQyjTd66Joz/zgC1jW
TLSH
T11ED10065EA28463FC448133BCCA11F010F76395B985E3F19719C64182D5B2DEBB8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0a066d56761db4e04df35ac14a86d3b3eb1e1c13897910b6d5d862856f8c0432
MD5 16fe2fe96e5fb606feb0253247afd65a
SHA1 43a5f0699a2ea50ad2367c7bf2207c1211a9a1fa
SHA512 150af4d0eb982e497ecf23faef2945139f365c26f30273a7cfe6c45ab551c6bfcca7250298dfdb9326e191e4a13d247d5d3c14aa08bc4f2847088d7095c0172b
SSDEEP 192:xOv5zbo7QZOQyj7cKCf1d66JoztdzgCl6mc0dz:uboEZOQyjAd66Joz/zgC1jd
TLSH
T18CE11FA4EA28467FC408027BCCA61F410F36395AD84E3F19759C641C2D5B2DE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0aaab5e748776c075433e1779e39c7e8c824406d286289596c83ed8ff1afb3ca
MD5 9bf6cad71b5e9569e1f116972fe5be47
SHA1 ade93796fc6d30aeb4f2366be7835c2527502b02
SHA512 1faf86efcde453a4bf142e1e5f4f7a33a4a5784d112ac25c327337b07e15f697b89dda64026d0cae0301457913c07d33b0b2e59a21e5175463c512c9b61ea2b3
TLSH
T155213A5C39B88D3ABDCBE29D7840028E57518F0A04871D875E52EF8CCEC1ADA316E879
MD5 SHA1 SHA512 TLSH

Submit Download

0a21b01c-9492-489b-9fd8-dddf2c1f3a7f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\0a21b01c-9492-489b-9fd8-dddf2c1f3a7f
Size 235B
SHA256 964990ab9ee1ebdba2329ff981af7bb63744882c7b59ae09bbdd59d1bdedb37e
MD5 c0422c396952bf93540b3efd56d9b50b
SHA1 c9dbcd69bb2114ed71dd266325b5f79b49bb3f5b
SHA512 e638a5c8a4bd81c9adeacdbff7783de56f19bb6a90971b09a0d5f3b6e3e50c4ccc972cf7df14ede7807a9bfb33a316992d1175c0ae3fd42bf0bc5c34b8850e27
TLSH
T1B6D097D0248CA76D8A100F0AF8B078C630C84C332860B810D6500034A9B9ED982A2C16
MD5 SHA1 SHA512 TLSH

Submit Download

2fe59ed8-fb60-4ffc-a2ce-b12c66ea5a71

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\2fe59ed8-fb60-4ffc-a2ce-b12c66ea5a71
Size 886B
SHA256 8011bdddf88334abed780c7666a8ec81fd7d31481b439f50611335cfa6f24aa0
MD5 38977afa2724630f557aff88a49356d1
SHA1 bd4fd73fac1b9cc58d0b2feaf7164dc0f2dec9fe
SHA512 82ef09ae770c8ff0c77610008c585019d0d493336edd95c51b18199d77861e79028b47afbe64c7d765aa7bd7ca2902810b7a1c130bb0097deff71dcea3bc5d29
TLSH
T16C110491897574F1CC68928744E57B0386E5B523D0C648147E905F180DEE51ADB9BB07
MD5 SHA1 SHA512 TLSH

Submit Download

42c854e8-09ab-4451-bfcb-2a471f9e3cae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\42c854e8-09ab-4451-bfcb-2a471f9e3cae
Size 883B
SHA256 727fd00de4b9c5f899c107352364fbf476237957816e3c242cfa89ffc7fa2919
MD5 b697dbed4cf2b866ddb4c8bdf2d43046
SHA1 215cd7b7899be4b42f8997511f3edd293dabc430
SHA512 f21694674c47c0cf77e8c1d29c6a6f51f482b4674f76a8e3e7ca34b680ee92a4f6e5b7a39441a573ba1f29527eceb8b3e00462a2d9442b558a22a1d577d934a2
TLSH
T1A8112382E534B9F1CC78924B84953B0287F57513C0C654146EA15F280FFE61BEBAB707
MD5 SHA1 SHA512 TLSH

Submit Download

44e469c7-cf97-479c-815c-d773d4b7510b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\44e469c7-cf97-479c-815c-d773d4b7510b
Size 16KB
SHA256 207a1d2bff5f6664cc054543fbc78a548a1e338e294d5ba336866eb99725904a
MD5 aae10590df9532cf0f7593c46c525c6e
SHA1 5e4892a8b008357727f6b2b84191885753f66c8e
SHA512 d408625cdd3a45131356e103a96ac3be0c2ab7adbe96ef9ed90913da148c7c88086b0027f43d127e7260f8d90c5cffee4f73ddc5d7994cfd455c1f0b0c5f4c42
SSDEEP 192:zVChxMkbvwAxRXTeNsYjK4wuu6SJj917ttN5jRz3skxejmBSD11uygXJuBt64kLZ:sdxd17ttN5jRAkSmcjQY364kkKs+r
TLSH
T11F72B9166860557A8651E3A994F87FC3E1F638CF8C414FCE8BE4BD0869DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9df46eb1-557d-4200-9350-651d72bb4d0f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\9df46eb1-557d-4200-9350-651d72bb4d0f
Size 2KB
SHA256 59a0cc9f7a7d15b94718093775876a4a558df0795ee8d26b14cc949174c2ec0b
MD5 5cd6e46c4ee00403ceeabb05c9b7eed7
SHA1 344b2644004550cce5840adef32407456522e78a
SHA512 d493279cf18ff634687841b1ed4999d481b5af31ad5568d08d52e2b260f02adb6585b80dc5788d1fdb4ec4f9197e80ec27785028c811d0b5b9d1e762c0fb9604
TLSH
T1D341865C36B84C7A9CCAE14D9091338E83E28A4300D618431D41EF4CCE9679E73AB56B
MD5 SHA1 SHA512 TLSH

Submit Download

f17636c6-7cfb-4d13-a092-1d60ad139b7a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\f17636c6-7cfb-4d13-a092-1d60ad139b7a
Size 235B
SHA256 cd82873cf92eed0c9c278eb232677f07caa69e79173694d708d75953bf986967
MD5 b23209b86af35eeb9996e90ae83e1fb6
SHA1 a816496de6705a1e9fb042f5ad7e1d2e3d70d904
SHA512 2f2f0be8bc707e1fa72ef640d0927d0e745e48a08f0bfc5575914d52f4275d6d4b917fdc6ae8a2853f89316e69eb66c5cfde53c3609ad9088f2eafbfb9d94899
TLSH
T15DD097802C88679C08200F12B0E07CC230886C332068A810BB6380B49ABCEC88311C06
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\extensions.json
Size 16KB
SHA256 31ae7cbf0defc9e0aedd81ece126334c2b209b068cd5846f3f9a96d40a717c0b
MD5 795d82168e3dc215aceac031d090fc04
SHA1 07a451a6470c4af7a61075a55bcd48b328438f39
SHA512 a2e11a3d38c486327a8e84ef5c075a1fae418f8546f8788edecea9c27fe95a66e4f2c10bc3ffec21cd74f44e4da47c1aba6fad7e1a590a4210542f226f1923e7
SSDEEP 384:fkI4v/Umldv+8dhWn94zc96o/AL4H4L4PmL4H4L4H+L4HsdD54hQp:sI4nRfzXa4c6wi464U464k4M/4+
TLSH
T17972421545048EB8298FA79AAA367E01C37D533B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs-1.js
Size 8KB
SHA256 abc99fee8fb2f9dbfdf9dea0fce06919dbeb2847388b1d32de97f0fdefe2c682
MD5 ad11bc48ab2270df7f4f0ff0cbfc7838
SHA1 f7130767ed82cbd968f2d43693df4563c62bdebe
SHA512 35ddf33d9689c2584b22255772239b04745ca1a2f73c30f6282fba618bd6cca717b2428af79829717acd99346376f2f58cdd0e4c05c20df06dee09640e28406f
SSDEEP 96:xHYBTUmDqGqmfPnEaCObzSHSSlvdv9jsnKWR99OVAqvqaqkBw88u8L4cnZFs:23ORmfPETtSSsRzBkqaxBw88W
TLSH
T180021F3C9404CF7F74BA326CAC6889315AA2023BB6BF68D711B95494054CF3446F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs.js
Size 6KB
SHA256 0e86f837faa180006c622ee1c8f015766b8c2415f9973f7ddb012aedf638a5df
MD5 6ea6c8403558a71e5d6c9e835d840edb
SHA1 e39f2c3c98903f66d43ee87cfddf4f46a8d91aad
SHA512 75f4619c85a0c4dd118e1cab7032e4b7636a3a8978272c004181e49f4fb13a2fd4577aa49eca09f21ef56bfdec3066c09172cc7d9bd1d79d26d4fc38b224f0e7
SSDEEP 96:xHYUTUmDqGqmfOCs1zSbSSlvdv9jRnKH5OVAqvqa7Bw88u8L4cnZFs:2WORmfOCsOSSc5Bkqa7Bw88W
TLSH
T107E110789508CF7F74B6776CAC6888316AB2013BBBBF28C650B55484055CF3442F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs.js
Size 6KB
SHA256 6f3e880f8be702a83b38e550fcd8785fb407374c83be148bb6ca7f4fc6096ef4
MD5 3654da5c4b21bbfcce1de6496d8cc750
SHA1 9e9a19861ab1413710b2d71a75fdd9a204416987
SHA512 d4612947930a361e63e644fe98117b6fe0d5f4c8662e5d6189d29ce52a850175d872c09064afdfa16260be8dca09beab19a7e5e0d106919d683418d3e1440625
SSDEEP 96:xHYUTUmDqGqmfOnEaCObzSHSSlvdv9jRnKH5OVAqvqa7Bw88u8L4cnZFs:2WORmfOETtSSc5Bkqa7Bw88W
TLSH
T1EDE12F7895088F7F74B6776CAC688831AAB2413BBBBF28C650B55484055CF3442FA6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 9662772cc78c2e417fa34ffd658fe3b22331b80d0d8c7d23f8e2428c3a2e97be
MD5 809dcae157cd0e8e7809331da963207b
SHA1 fe7eb4e88e74e7985b07cb996aafa0eac1b6f1cb
SHA512 567a0572c87c4f7a7f0e84726f2c637d4f83660c01cee6a09ca3b09068266ec885ebbd539dc459beafc4b52f7f7040cadecdd78324305463e9f7aa7f337a0435
SSDEEP 12288:XM7ZyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:sZMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T19BD4225261899431FD3832F45A6DD52AA13A6E240F10D8FBE5807278BC767D2ECE4B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e01179a1c4e3552d1d8b89ba3445a27afa65a3ba853548732767a5ce4211774d
MD5 3487546bb4c648295ba24722c0507355
SHA1 6419a26cc1b4f7a5774bb7b9396b07870f461c36
SHA512 d31f539ed922eafd99cc412ac3b169a207b3e71efdd87e1ad6c1c9d8b004849212625b8db7438a87ba03eea8a176f5fbb3698bdea4673872bad7974b5b4b267f
SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bYfMWuGMF36YKN4B1Jdi5hbKFlkJtx:Wgb4mBIBhGFexu37BvdebQKl
TLSH
T1E6659E1E22E802F5E0F9E2B8DDAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 51ad60da5efee9f014ef1735baec42efa63ccb1e3fe5e8b160e886a6f354bc5e
MD5 27129f6fd73321c8926ed1bef14f80d7
SHA1 3186e6c3c285c9ef89d294f1750b366ca3c9bbd6
SHA512 4a5dfbfdd7d28107fee0bd0d0d7ee615afc15d513904f5c07b0be411e8c75348f8fecfe70a33609c1d3c3bbc234a4ea6fd3c92103250f131bdd95129cadff966
SSDEEP 24576:iG88u8FpJqH1vzria7/muMWuGMF36YKN4B1Jdi5hbKFlkJtx:57ZFPqVya7/nxu37BvdebQKl
TLSH
T1BF35F16172E101F0D47BE1388A564667F6B2B8250360EFEF07A88B551F236E14B7EF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e0108bea4680646c90b1104d079bff29816594fbe8b0a11ff01e7534f9fe9209
MD5 62719cc52b3452952652c7152db8dfa2
SHA1 2f1c12ad6a1a2766e920e84ed0b4038e95fde44b
SHA512 895c4e2e2ce5b20d3e565cc7d239137469429095728083f9906b0c19f2c32dc26f0430609c94836fbf5668d21531a9e873d154a4c4c2c2979d7007aa55a30dfa
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjixu37BvdebQKl:oG05lO43b6v8Ll
TLSH
T161D5C06A62EC11F9D0BBD17CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 443dc69690e9e605aebbc30a08109321395ab707e338c44b305a910dfb96e378
MD5 47195b02e2443e21ba816e927e9206f5
SHA1 47feacfbd5388abcaf6be28b841d7fe3dbe69374
SHA512 7ca7c2446e8f9868c1aa50a0ec3f59382630e9e4746a141720f656a7757ae9de442434afda9baa38c825cb8bf49575eedb5f1f330ca42f164e3c51d8a4d6568d
SSDEEP 24576:Jfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnIMWuGMF36YKN4B1Jdi5hbKFlkJtx:Za5POZ3lJt2pasx2+m6xu37BvdebQKl
TLSH
T19765AF5EA6FC01D5D579D17DC583861AE5B1382213319BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 375850db82bb894ebdb89f153ab2020b029ca6a7519ab5a7bce25ec00289d21c
MD5 486fda1e7f5b8adfaa1517f81166b000
SHA1 ebddf121a75276f77115b06db90a0387e3ebe2cc
SHA512 0aace78c06eeb08b72daf5ccfe9d0b0d7e8cf98d3002c47d34fb3306307f6ff93a85c464c1283843dffc3937af7910d17ed703ee195f1123f8800c4cf32785aa
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7FkmMWuGMF36YKN4B1Jdi5hbKFlkJtx:cNc/zEOVHFHxu37BvdebQKl
TLSH
T189857B1622E901E4F5BBE1BE89779546FA71786517308ACF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9996299ba320966631664537a30adf4535b7dcb6c523abd9cb155fa85f68bd2f
MD5 c283f5c784901b2dbe3c11c3cd1bda18
SHA1 1c6989bb51d6bb6093354ecf9ecb915b36b53e22
SHA512 e6d4a0032cdd9f2ac53ecde93fd8605e05ae37b18b18bf9480eebec730456e735d9ad2e0f0a977e9bdd0747dbb74c572735cf3aee30058cf3362b01728308d3b
SSDEEP 24576:YzkNvNnaFeYhJNtmZBmoMWuGMF36YKN4B1Jdi5hbKFlkJtx:YzMwBtOmoxu37BvdebQKl
TLSH
T19F55AF6EB6F846E4D1FEC6B4CD238512E6727861073293CB9290C13E1E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 56943d333bd1f6bff3106a66878ae6e0b0a63d97969ed44b7d3cef5b162d9dd8
MD5 887f8fd313963d45658ee1b2128aaf8b
SHA1 edefa9c941ebe5eb33f56cf83a131c7a0e30f07c
SHA512 408cd66c44472b7938ba6a60e609b8bd59d2f56649e09639cc59986023aadead10d092490823c8a16c23e5409b95fd27c934419257ffe5ee4eb4f2ba742d10f4
SSDEEP 24576:FPUr+NQSMWuGMF36YKN4B1Jdi5hbKFlkJtx:FJQSxu37BvdebQKl
TLSH
T12205F12F22ED18F5E67AA17D8986870DE77178620711D2DF02D0817E5E23AE8BC3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 27c3e6ea5463e417d9b41568b29a65c003969654e1b009ed16883e1ac43581fd
MD5 3b4927f48ca76a66cd6dfbdd4574c7e9
SHA1 6082af7a31d633b985c41b8d1c300282599d05ca
SHA512 bde1c52d5959c99c0452ebe60a5f422239545a3559d08520072a1bd52a70846b5e524eea565c5aef5f66bfcb82b70ca8cfc3a346fbbda26ba203444c25376fc3
SSDEEP 24576:KD3FHshBIYQgA1MWuGMF36YKN4B1Jdi5hbKFlkJtx:KDVHeBIAA1xu37BvdebQKl
TLSH
T16625E17EE69C00F4E57AD1BCDA638A06E6713CA9032165DB02D091B91F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/908-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/908-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/908-40-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/908-49-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/908-46-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/928-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/928-152-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/928-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/928-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/928-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1500-132-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1500-126-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1500-616-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1500-122-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1936-0-0x0000000140000000-0x0000000140101000-memory.dmp

Download

memory/1936-7-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1936-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1936-1-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1936-8-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1936-57-0x0000000140000000-0x0000000140101000-memory.dmp

Download

memory/2400-624-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2400-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2400-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2400-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2444-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2444-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2444-21-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2444-15-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2536-619-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/2536-617-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2536-615-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2536-620-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2536-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2536-116-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2536-110-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3788-137-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3788-143-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3788-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3788-145-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3788-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4112-542-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4112-75-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4112-77-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4112-83-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4152-66-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4152-257-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4152-65-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4152-72-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5800-88-0x00000000006D0000-0x0000000000736000-memory.dmp

Download

memory/5800-87-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5800-93-0x00000000006D0000-0x0000000000736000-memory.dmp

Download

memory/5800-583-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5988-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5988-98-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5988-104-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5988-876-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5988-601-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5988-874-0x0000000000730000-0x0000000000790000-memory.dmp

Download