3bf0c59087a8dfa1ae28048b5a4b0dd0d57aaff7b6e52b1f587e1a7cc42988c5

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Size 1.7MB
Sample260825-etz29swgmd
SHA256 3bf0c59087a8dfa1ae28048b5a4b0dd0d57aaff7b6e52b1f587e1a7cc42988c5
MD5 ae9748efbaff594df074250eeaa0a17e
SHA1 1f1c0a0b427f170b9ac1577a67f1238fcf30b738
SHA512 a6cf9ca741c2be3c2ecaa959c4d6825f0d591a858b5a719835c1372bd5580ea5f8039b9b091d6ea932ec40e3c64c00fb12ba734b1c2ead704e5e9298b2f64b6d
SSDEEP 24576:HQ8n4ad5wpe9yxknw4FYnshx8OfVe247:HYpeox4x8EVep
TLSH
T11B850255F3DA10F5E16B81358A124516FA62BC564770A2CF33A47E8A3F33AE09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1432	elevation_service.exe
3632	elevation_service.exe
5880	maintenanceservice.exe
1540	OSE.EXE
1176	PerceptionSimulationService.exe
1980	perfhost.exe
6032	ReFsDedupSvc.exe
1048	SensorDataService.exe
3040	ssh-agent.exe
4260	AgentService.exe
5588	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1e34a687e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f78d50494834dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007afe46494834dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001a1237494834dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041b4058c4834dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023a4304a4834dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d00dc484834dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d52d16494834dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000280f2e8c4834dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092e440494834dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d463a8c4834dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1432	elevation_service.exe
1432	elevation_service.exe
1432	elevation_service.exe
1432	elevation_service.exe
1432	elevation_service.exe
1432	elevation_service.exe
1432	elevation_service.exe
3632	elevation_service.exe
3632	elevation_service.exe
3632	elevation_service.exe
3632	elevation_service.exe
3632	elevation_service.exe
3632	elevation_service.exe
3632	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4644	2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	1432	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4260	AgentService.exe
Token: 33	5588	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5588	SearchIndexer.exe
Token: SeDebugPrivilege	5964	firefox.exe
Token: SeDebugPrivilege	5964	firefox.exe
Token: SeBackupPrivilege	6032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6032	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1432	elevation_service.exe
Token: SeDebugPrivilege	3632	elevation_service.exe
Token: SeDebugPrivilege	5964	firefox.exe
Token: SeDebugPrivilege	5964	firefox.exe
Token: SeDebugPrivilege	5964	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
5964	firefox.exe
5964	firefox.exe
5964	firefox.exe
5964	firefox.exe
5964	firefox.exe
5964	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5964	firefox.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 3316	4644	2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe	90
PID 3316 wrote to memory of 5964	3316	firefox.exe	91
PID 3316 wrote to memory of 5964	3316	firefox.exe	91
PID 5964 wrote to memory of 4864	5964	firefox.exe	94
PID 5964 wrote to memory of 4864	5964	firefox.exe	94
PID 5964 wrote to memory of 4864	5964	firefox.exe	94
PID 5964 wrote to memory of 4612	5964	firefox.exe	96
PID 5964 wrote to memory of 4612	5964	firefox.exe	96
PID 5964 wrote to memory of 4612	5964	firefox.exe	96
PID 5964 wrote to memory of 4612	5964	firefox.exe	96
PID 5964 wrote to memory of 5524	5964	firefox.exe	104
PID 5964 wrote to memory of 5524	5964	firefox.exe	104
PID 5964 wrote to memory of 5524	5964	firefox.exe	104
PID 5964 wrote to memory of 5524	5964	firefox.exe	104
PID 5964 wrote to memory of 2836	5964	firefox.exe	105
PID 5964 wrote to memory of 2836	5964	firefox.exe	105
PID 5964 wrote to memory of 2836	5964	firefox.exe	105
PID 5964 wrote to memory of 3496	5964	firefox.exe	106
PID 5964 wrote to memory of 3496	5964	firefox.exe	106
PID 5964 wrote to memory of 3496	5964	firefox.exe	106
PID 5964 wrote to memory of 3496	5964	firefox.exe	106
PID 5964 wrote to memory of 3700	5964	firefox.exe	107
PID 5964 wrote to memory of 3700	5964	firefox.exe	107
PID 5964 wrote to memory of 3700	5964	firefox.exe	107
PID 5964 wrote to memory of 3700	5964	firefox.exe	107
PID 5588 wrote to memory of 1100	5588	SearchIndexer.exe	108
PID 5964 wrote to memory of 4176	5964	firefox.exe	109
PID 5964 wrote to memory of 4176	5964	firefox.exe	109
PID 5964 wrote to memory of 4176	5964	firefox.exe	109
PID 5964 wrote to memory of 4176	5964	firefox.exe	109
PID 5964 wrote to memory of 2944	5964	firefox.exe	110
PID 5964 wrote to memory of 2944	5964	firefox.exe	110
PID 5964 wrote to memory of 2944	5964	firefox.exe	110
PID 5964 wrote to memory of 2944	5964	firefox.exe	110
PID 5964 wrote to memory of 4260	5964	firefox.exe	111
PID 5964 wrote to memory of 4260	5964	firefox.exe	111
PID 5964 wrote to memory of 4260	5964	firefox.exe	111
PID 5964 wrote to memory of 4260	5964	firefox.exe	111
PID 5588 wrote to memory of 2572	5588	SearchIndexer.exe	112
PID 5588 wrote to memory of 5596	5588	SearchIndexer.exe	113
PID 5588 wrote to memory of 4728	5588	SearchIndexer.exe	114
PID 5588 wrote to memory of 3436	5588	SearchIndexer.exe	116
PID 5588 wrote to memory of 1780	5588	SearchIndexer.exe	117
PID 5588 wrote to memory of 4324	5588	SearchIndexer.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5964
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1896 -prefsLen 27097 -prefMapHandle 1900 -prefMapSize 270279 -ipcHandle 1984 -initialChannelId {05b2ee35-9e40-4338-9e79-01ea0b5a9560} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4864
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2384 -prefsLen 27133 -prefMapHandle 2388 -prefMapSize 270279 -ipcHandle 2404 -initialChannelId {7ec11491-6a7f-449c-b27d-a8421a6c2732} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:4612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3584 -prefsLen 27274 -prefMapHandle 3588 -prefMapSize 270279 -jsInitHandle 3592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3600 -initialChannelId {c56a8af9-98cf-4683-9ce6-47aab8b0e1bb} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5524
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3776 -prefsLen 27274 -prefMapHandle 3780 -prefMapSize 270279 -ipcHandle 3800 -initialChannelId {f7153860-3f9d-4467-8dc4-0c150fe5e633} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2836
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4392 -prefsLen 34773 -prefMapHandle 4396 -prefMapSize 270279 -jsInitHandle 4400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4408 -initialChannelId {63e1c9be-68a0-47b4-821b-edec744297b7} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3496
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5016 -prefsLen 34876 -prefMapHandle 5020 -prefMapSize 270279 -ipcHandle 4968 -initialChannelId {03eb0866-1e16-427e-a4ba-e7cc4ee68c76} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:3700
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4528 -prefsLen 32952 -prefMapHandle 4532 -prefMapSize 270279 -jsInitHandle 5460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2844 -initialChannelId {cef815ef-ddba-48b2-9b46-39145a5f5fcb} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:4176
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4944 -prefsLen 32952 -prefMapHandle 5472 -prefMapSize 270279 -jsInitHandle 5476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2852 -initialChannelId {61e3eb9d-3d26-4c24-8da1-685944a0a646} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:2944
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5704 -prefsLen 32952 -prefMapHandle 5708 -prefMapSize 270279 -jsInitHandle 5712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5720 -initialChannelId {7598c1b5-a2af-41dc-83ec-c18c0b050250} -parentPid 5964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3632

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5880

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1540

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1176

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1980

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6032

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1048

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3040

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5588
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4728
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3419a147ae1703f68c2e7d5b6689a4f2e6e34a66e575b14c512ef79e10aa94c5
MD5 efde648cdf0c750e2e6d85146f144a3d
SHA1 e84a4b8e39574d475cc525e30bd07ab11b54f0e5
SHA512 562df26fefc02eb99d32689960efcf140973ff297b6385dd0e55c6b2845cc1500a5efd8bf8875680a24c026e0a8a4a134fafe980ed4e47b8e31df62e7ed665c1
SSDEEP 49152:Qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnox4x8EVep:63q6HjBTix8EVy
TLSH
T1AAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 ebaaae9384aab585595d0167582f63a6eed7e06ab4b3c2267efa2daae4ccff9b
MD5 a8bd7a096b5bc7ccd62991beda91bd12
SHA1 5616090953b70d2019a6412a87718c3f24f56d12
SHA512 b03e5442d30bc37a662bc6e0d871430504a66985f13804f1a7354126a9efef4e50e8fd710b8a4065305c39ce4faf458b98ba09327e23f2eae424cc946a6a744f
SSDEEP 12288:m1XLsswWkxy2lRq2czAk+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:EXYfDtczAkyxknw4FYnshx8OfVe247
TLSH
T1F275F12877D508F9EC6B8139CDB28512E633B8954770E38B03E4A5295F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 d0a465ecef6f0da8728397674d90aa21442d12019fa0afbb56624012a8f68598
MD5 2f4d6b96b75bf43037c2f3fb6a8c03c6
SHA1 e6dd66b5d0bab2b1df059f4bf26fed54e7b90bdd
SHA512 5568f9a69aef70b0ec55f1eec793c679a819aab2171824f322321ffb536ad27559c42e889261ea6c8cdba5cdb11ae4bac46a6413d013a712dd4d2f505e3f2cb3
SSDEEP 24576:G0Le5ji0hmx1rMiyxknw4FYnshx8OfVe247:GPji0A7gx4x8EVep
TLSH
T1C395AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a459c60402f001a7729c4585e636545a1ad74d3ee790fecf43b7f5b02c9d686a
MD5 9cc941a60bb3f80b471df6f757e92bc6
SHA1 8caf446d1cbae87645b33d7d3a2241bd1c185c38
SHA512 66bcf6a278ad2f1b5e0902c234c50a4d314d17a5a9c6e5f28a0d97f128a0472188cdcef3ed0af6fae79216347dbd450536ce894ce104d8a26dd5e718a095bc10
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWE6q8wyuMyxknw4FYnshx8OfVe247:4/ezSC6vUzPvxHjyEx4x8EVep
TLSH
T17D756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5691338600fd16f1b506fd0195915d1ecd51fbc2ebd45da41dd2702f5861d94c
MD5 011f1126cb966e097ec9e0223aecb0a4
SHA1 6ef2baf0eda0f3a2452ac95e11d00755ac3c4dee
SHA512 f9631c6ba29b7d4c730c9e60ed2e2deb9c44808718155c2fa5523f8c23ab918affba85c0f01924ebf91b8cd38fe4c615c958f8b2948a31510826cae7009968e1
SSDEEP 24576:DVbqPb88hv/l+6Tyxknw4FYnshx8OfVe247:DVO88hXl+hx4x8EVep
TLSH
T145559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 c6393dddd1b15f63959cffde6b1bb3faf5ac39a2b0dd07eb0c21d7747fc9b8e1
MD5 172ec76a77276315181f86a7b77afead
SHA1 bd43ce02e160055101fc440bf40f7f8f17fa22ba
SHA512 1471aebfb751777fe87d5df2679e089ee1e2e59f1c22795f8e4f71139b1bbb71e308ba418338a8a11a2a00e9a08afffd133d036761d63ba8f1bce9cdefda727e
SSDEEP 12288:jNG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:jNGyxknw4FYnshx8OfVe247
TLSH
T16465237CA7DDA4E1FA5E15331B7172622616F9A0DA74C11BC779B14EE0B0CA0E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 9fc78f79811cfdf4bc2df1ceb004c65984874a5fe27ae91c40ff556ba07d028b
MD5 154e9abd2b8ec0823d5eedf055b584c9
SHA1 867a357544229ee48c8a413020557ac9cc96eeff
SHA512 f278d58e5deb1be375bfde82c843432f3983ab47a846a6b136f079c856967c79f078801e8b986291d6b431011442207fdb4854fa5a9627499e502460fb45ded0
SSDEEP 12288:/eBNUbTVO86U7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:/JIU7yxknw4FYnshx8OfVe247
TLSH
T1C175CF7BEE28FCD2C27E4DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 607e0dfe5e9788d59f293ee2adf71750f9d0df8eb108031544d69015cc3941ca
MD5 411a13b93494fa1c14c0348fca53610a
SHA1 d00bd15bd16bdaea047fb8bdc53546c2cdd0a579
SHA512 55a90c4cebce8892ba8d3d9dae4fccc4d62f038f645067f1b0ec2d4652a32d4c311b5c56d4ce5767f2d296154a278f514d678edd0f12e656f02007b3b11a9b53
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH8:2QvGAdlCEL8c/yRNw5CXix8EVy
TLSH
T1CE267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 bd30ec4757425c69dd1d152caa6e7dec5e146447fe1d7c82e9b8ced52f465ff8
MD5 e176e4413eda5990d618609a7a3d18f1
SHA1 f90004f022995dad8df18cc94ee9df0dd369e02e
SHA512 63a23eaf81f1230d85ab22c95e01bd8258f743d8713a5eb857722ad09ae65bba01b35a3c1a6b35f79a73ba4e9ee13ab7554e74fb9e55bd27faeddfe5aa90a41c
SSDEEP 12288:TAwSfxL/2Dc3LDLLmt0LDQewsAjF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:M6ewsAjFyxknw4FYnshx8OfVe247
TLSH
T17685E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 abed9b8b76ad0dac7653bce00086f0bf72f67702e648892a3b616f49aa78ece7
MD5 149d3e6efa5b85a8d2569d3687801146
SHA1 ca5f81e749c0213bdcc7ae8785866d54b4d6c3cd
SHA512 4791fb6763426a0867274b0c15c140f451058ca212a60785f1185dfb9c7dab74a4c6dc2dda9da74a44fcc30b90d5e63bbfa35edf0db30929a5890797dbd18a29
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH1:PUEtQevvqc2W1cpV2EI32
TLSH
T14B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1b44119e2cd41f8bf37789dd5c2630f9cc8b8c03a18d894e904965df1edbd092
MD5 256dac398279c2999ddc5ae216e7fbc8
SHA1 a6776cdb9ae369bc0bffe7d278d66811afa5137b
SHA512 6c2b28c31e79db45067637a02b7c740c1b7e4608066a2a2bfb774c92ea17101075f147c39a8619743f1644623777ae29b95c353988f0b24e2bfa812ef44c66ed
SSDEEP 49152:MCbRquA/m2yL5zQfFiV+XenmE3/zwx4x8EVep:loqtVjnm7ix8EVy
TLSH
T1DBD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0913ee21c1651235e48e15dbb8f55f4e6da0bbf8497b102751d56065096c760b
MD5 f0217780820c99367b47882054b276ab
SHA1 c16d59adc41a99667e97f056ecb3251a224fba53
SHA512 6ce8e4822e3e45eb343e58c38245549fde012fdb5032c0737f73ace18598d6918eb002445c7c96801796b10c429a242f202947b0c7e59ecb4e9a05bff045dfb0
SSDEEP 24576:0AhGLJIFoiwtA5l7S534yxknw4FYnshx8OfVe247:0AMyFoiq5rx4x8EVep
TLSH
T10D35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 0cd7d01f678ba0d3b8f3b1668ef90ee97189c942a1f53034639bb879c5e2e8b3
MD5 51e16b4347de4e4ca4bec884ebac5e35
SHA1 50d72c7d9d5aea56bfc893ddfa9373b56b7a8d13
SHA512 257377c821cd81bdd4ef6dccb6ff8e0436cbd511e037ced51d839db0407cb6955ce7dac2a2234e28622e7d5103774791ca5509d27f408682871120c884f12a56
SSDEEP 12288:9mw5HEjsChN4BFgl0WDm+Cz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:4wuVOWKyxknw4FYnshx8OfVe247
TLSH
T1A175F14977E81CF9E96741398697D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 c2f08ed14f056adfa2b741a552720bb8cb1fb517938414c190506c234f194032
MD5 c125f382358913c5bf59ba21cdf1430f
SHA1 99f42a3e23de950905fb1cc1db7a424b93c48890
SHA512 635a36dda2492d3b7c9f3ae7772ececcad862103499d382884382d916c8fd47aa09bcb37652953bea9d73ecc07b988ae81a2cd42c895eae55c3afce73cf286a2
SSDEEP 12288:wFZ1Iy1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6Zuqyxknw4FYnshx8OfVe247
TLSH
T1F76512AC33E860F1E1A7113A89F15205E76274A2677183CF4764A25EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bcad103bce7016dba2ce8c70791139c9f62ad69b647af6360fe23abcc778e7e2
MD5 23c6bba4df94f7e76838c03c940e2de9
SHA1 5291df246a8d6534423bd7f56f92231883cdde65
SHA512 73cdc63abc3663cc1fda4a563963efb6c5853814eaab7c5f8c6f2c96652a5f2b71b2d244851f00755b8930961f78d71886f373e6dc7f4ace02a085186447e70c
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:9QRQyi36YOcPQLvw2gAf+PN3Cix8EVy
TLSH
T1F3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 59f6883811d7dffb811b05fbc8728629384f91d71b6b63a2821dd7fcc0be757b
MD5 ab6ce3c514faf6ba1968c6572ba7f19e
SHA1 c6bb0e16fc1b1d1fa45d6111d34f27a33a688879
SHA512 c3505e5708fc1b1136f23791d04cb8a5f92c6e860ab84fbd280193b7648573afb32e77dfbb76100e97e78d84c017eddc177523130057c1a31abe6addfcbddbea
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:kQRQyi36YOcPQLvw2gAf+PN3Cix8EVy
TLSH
T118667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c711e664c24d0099bda03f93da54e25b3cdccd336837399f0b6dc77480f3080b
MD5 58b95456e4eec0a0c4dd8d3f682a6b79
SHA1 d4a0b75de6f7b59769d3af9825b5d3705b672f30
SHA512 b5e47c4d8092a8a1a4f92c0eed678475d4cb9a0e3f58839aee7f864574a0ed9b254cf0a0459d774c24f45c2175d81518c5769d855bf6b1f5ca075202eeb2a20d
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL06yxknw4FYnshx8Z:368Qg55nhheWu7PNU3/gx4x8EVep
TLSH
T1CEB55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4cba1994a5af47716fa1fcf8bee25b17b0373c3d608fc225107d0194676f681f
MD5 b8ee50f53862b193dc721d90ae5b5dea
SHA1 ae8942470768f3a35dd1b04398c02e40c948261e
SHA512 96248846f49264bb1e46eed0852d93b868df470e33d049e55837716aaaa6aa168f8e04fa7b5742a8d1fe48c0840c0828dfd27e4a57e8b3bd3044f55072155ac1
SSDEEP 49152:V3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99e:Uy5112gYy5azzVvL69nLKnhZ5ix8EVy
TLSH
T168167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5aa936b200cee94cdfc4104280175f03c78be7c254113619a4e73bc0bcab96d8
MD5 386d3cf4395c1f5105012518d948b165
SHA1 da3dec8da53e6ca62905f75eb036aa13bfba7977
SHA512 6845de95e87b9e0f1ea1052e0558713cf0647ae1abc93d608093c6b751109873a8188f8bb7e68c761e5a0f8a6ed9825ff96846ff3bf7c11bbee1c00e70c575cd
SSDEEP 49152:5B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glvx4x8EVep:vu6JmVxd2dvix8EVy
TLSH
T1C8D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0f7f00e5d3db064e39a967903fbfe3cfe13d7cf2b84c87569112ba0a145530d0
MD5 e0baba41352deb0bc081078a6db06be5
SHA1 97b37a1523c831002697957c81a1f46620102f74
SHA512 0b520c7604fff275e4b8225c604e9c442752b201289e428669f67fa39e1c7bb4e545d414722ebb180a13209908dba1024813162b8c321a30ca5b7326ec730fa0
SSDEEP 49152:r1hpsNoJpF1A6UU44CwH7R4x+x4x8EVep:rmifPbR7ix8EVy
TLSH
T15AB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 de394ee3e70482edda03587beee664491bdb9e7e7e70f50eec2f190a9668ebcb
MD5 0076089fccf69bdaa40e8d8eb40520ff
SHA1 0295c1cf4bfbbade9a319b2898674645a8929451
SHA512 fe28f6812f984244ec6157402c50178d98bc82f6b918a3c467b13be457ccc955a384c16985b91aede83267103d37c0986a61ee42e28bf3a8f2693280e871f859
SSDEEP 49152:uSuZQIY0Be2KRRVtOnks6NMHqFx4x8EVep:g5dKTi61Fix8EVy
TLSH
T17DC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f9d2e7fe1feb1d5cf09509f0948b68c4d7ee50ac9780b56c156bcdff62a76896
MD5 048cf08f29968090c33051cdde5dbd99
SHA1 b790707851bb29c9e927aed5b4477977e6f5fdcb
SHA512 81d14e9492a0d83e4d34c9e18e82ca3fa091ae567f21af9c885ada8d4fe6550b3ca63cb19dec01f0aa14c0b6631c0b34ad717ac6b8379f78e3b8e90d5f26ecc0
SSDEEP 49152:9htSn8EApI0figngiDn0AP5w6x4x8EVep:sX2iyphPix8EVy
TLSH
T1A995BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 58acf1db6cdfba2311f79fa262a8f5430c8a75b68d72251f229bf48c40d1f4c4
MD5 76248f72168e295417a7f0341264e146
SHA1 e78f668298d6dbfaea63a136dc797941709eff31
SHA512 55aeb001989f448f5b47df20681ffb17e0dc011fd1d43bfd5044755fb5f4c0cde60ea905286625fd7b4bb73aef711b5e86b0f50e5a67e1d275b9f51dd008cdf9
SSDEEP 12288:9u+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9uyxknw4FYnshx8OfVe247
TLSH
T16F65237CBBDEA5E2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 3bfa0baedab763c801be2230be287a06f7dcd922e27432a06cfd81e23efa7ec8
MD5 5f60b29a8b17367c62b60227243a58dc
SHA1 388d57c9e4433e58c089ae5824311b8cf2dce574
SHA512 2bb8ee7afbd944d89b34676efdace0da7d6e2d6630f121c1417c915e774ddda72716b3dd69f6edcc977767fdd7071fdf003a911a8cecc07d4ec1bd3e1fadeda0
SSDEEP 12288:F5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:F5yxknw4FYnshx8OfVe247
TLSH
T13465237CBBDE95E2E50D11734B7163626609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 ba3c725e0e4dbccdc77480ce9dc7cff5170a24710736071d66f034dbe59fa8b1
MD5 c8bffbf761a6828f152328d76c92ee54
SHA1 0169b30ec23c4e7d75beb2c6d33a0ab136ce70fc
SHA512 cc2dfce2b66f357e6772a3aa1d9a87de6e76f29d981f41fd50f835cef09eae233ce32e6edb30ca782fb9cd508e4b80d2740a6a8a7d9acf95e52887131e331951
SSDEEP 12288:9j+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9jyxknw4FYnshx8OfVe247
TLSH
T13265237CBBDEA5D2E54D11734B7163626609B5A5EA71811BCB7DB00EF0F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 569b6b92bfe8786bdd195b3274a6785744ced1fcccbef89032e0edd9922a4b24
MD5 7d6f91165b1ad1dfa0bcaa4ffda3bc84
SHA1 81fdb4c60248066cfbfe5de2d2d453433cc1da3f
SHA512 b97d9a1cc9f52f5b2567c0814f83383bda596407a18d5c5dbeba2112df533166abca9721ee22a45498495cc34fd4b5e52b01eb7beaa32aed52a7027ce26d5961
SSDEEP 12288:AVY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ryxknw4FYnshx8OfVe247
TLSH
T19465237C77DE50D2E85A51738A716222B365B8E5E731C35FCB24710EE9B08A0A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 dfde44652fb43f78021c21657cc768db442c46db8551950b38776b19bc250e41
MD5 73e8c53da209fe33b9961a3b5eb4452e
SHA1 7924e99b8de47a46a817428071fb87d929ff66a0
SHA512 9610e9b8941fcbd0ba88ce7d20bc5006036bdc71b4838f5ef9c49faeedf3623bad5aa3b69663c1b299e76dcec9f5827de679cc97059b90b6b1e30d9136f14cef
SSDEEP 12288:0w+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:0wyxknw4FYnshx8OfVe247
TLSH
T16665237CBBDE95D2F50D11734B7163626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 9dd9419087e5596132b66f3dc1497fadf3eaa67decf9706c2ba4555fcd9a6633
MD5 503031a740bbf93be711f7b8726b9e49
SHA1 216318c3d1e06eab32c935a7e097e6ea20397010
SHA512 a4a4f2727ab70b79c5946d9cb140c110b2d3240838d44f6f7865e75ac5041ba8a414651c309acebca0554fac82befa58e46038aa6759abde6a740147ff8dd5b6
SSDEEP 12288:Ct+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ctyxknw4FYnshx8OfVe247
TLSH
T1B665237CBBDE95E2F50D11734B7163626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 70804591092be9adab971fe0f2136b193e2fb56615643d5e4e071c9f137edb37
MD5 96001bb3bf1ac8192bcd3a37711d7d35
SHA1 e3f90d4fc01c5e589c65a7b124a6f5b7512fb3e3
SHA512 6c7fddfa3bd9c82a7a6d3e914ec5fd95f10d089b2f45b19951c43e44e0fbc911738365253cc03018ed64b388e1f93445147b3f54550bf1a57596c965c4025a0a
SSDEEP 12288:Cx+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Cxyxknw4FYnshx8OfVe247
TLSH
T16F65237CBBDA95D2E50D01734B7163626609B5A5EA75821BCB7DF00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 98649c554e2331a32238203a04dee957cb6737128180e4101d2fe8e958b0f230
MD5 e99ef55464e470c46332b047ec6da729
SHA1 5b3596166ec1c128445e22205d94a30c27681ca0
SHA512 16cf666e625eede201801d528a7a7d0a3fce9994af1b95f868b44f2879303b24ca67f23327dace858d25bd013815484f77a181b0eefb777696154bb9d93fc058
SSDEEP 12288:1iZwbZzzFEoS2cPvyZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4ZMdzFVSOZyxknw4FYnshx8OfVe247
TLSH
T1607501A8B39018F4EC67413FC9259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 3add968dfe4bc2b753f5b9c23f4f5fadc56916cc2acc8b80f72bcce8e9a05e68
MD5 fab3ce3f7dcf8b649faef8c6188acd27
SHA1 2b5c3c807427756508559d7c1ad4c8ec3946491d
SHA512 25f47ff7e11984dd76bf362e5e10272eed85e01d6fddebb889c78abf220bccfcae6dad98f7527ad9f2d57e82336d4dd2da1fcd27e231e82269d09e3c54b30bcd
SSDEEP 12288:ba+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:bayxknw4FYnshx8OfVe247
TLSH
T16965237CBBDAA5E2F50D11734B7163626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 c61b53afaf77779ed4e72a3587c89ffcc00f4d988cf8e502b888f93f853014ce
MD5 7bf4a4549c27fc724613ab9ea5b693f3
SHA1 a086cd0681315122797a493c3da1594967a0ee02
SHA512 94355253dc2a6dc9e5646c0a6f1749f9d7433ab5c8c09151e8cd022bb43da45ee5ce122da401ddfae238c9021bbd283741f82a1fb70fb43028654e75ce3b1339
SSDEEP 12288:L2+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:L2yxknw4FYnshx8OfVe247
TLSH
T16B65237CBBDA95E2F50D10734B7163626609B6A5FA72811BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 62a58bc919fd80a8d1eee6331882e909ef0b31c28e08cd4a4c30472f493cb791
MD5 99102a3360d423feca515711b572a468
SHA1 c040e57d47959e98e09c5b1af37a63c8fb046f10
SHA512 e41f5b0bd34a5aaea19e9784af6cfb464c45d46d79a804d0e232967e5cddfc5f21b19b51958401290350d71ce2fcf5cbb1e0de19639e35398db5be95e63fe6e9
SSDEEP 12288:SyPz5L81+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Pzy1yxknw4FYnshx8OfVe247
TLSH
T16175125B73E530F5D12A4236C9621A12F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 0fb6fa92a86aca71d3881e0219b417172c3d68420b94bf728b4c1607d88f1ac5
MD5 6afa344d58abdf534ccb694b3f5ceb48
SHA1 283f9e922dcd47e1c605f505627832174623ef6f
SHA512 de5dda02d38bf2419b0dd92fcc3dc807107a8ce74cb6dadb3b1f010a7a2cd16597ee823b99fc6baeddd8ce64b29d72d0cf32c70902b24d42a4d9e7164e0c5e1f
SSDEEP 12288:ta+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tayxknw4FYnshx8OfVe247
TLSH
T14A65237CBBDEA5D2F50D11734B7163626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 1171ba05ff9a95bcf9d1ce0ab7d10854402810b20f9029fe1e01fba70ae46f99
MD5 f203f48412d23533b8c3811b04b212f4
SHA1 e5007087f0bdb059fc46d614f461c67db0e40bff
SHA512 ea90f7393c96a2bd7405d669ec06a9e63e115cb7e6b1a8875b742bac93e4f87c86119b977b13b08eba0665adf40d7c7e031994d8f6b82d6d982a54609a95fa16
SSDEEP 12288:qa+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qayxknw4FYnshx8OfVe247
TLSH
T1DF65237CBBDEA5E2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 7d898088c3bd285403ba8a5562ca2ed9283e1f11b6473b2f331571d55dba3583
MD5 34dc244918b753973b89832aa12487e2
SHA1 bcc9e687ff06ee942a2c28ac5df204c89d011e1c
SHA512 16977b0bffab6f3584fa01fee0c2da78526d02a8a312a2f98f6df814bd38c6ca71cea35879580553ecc28f144b50b1816898f56cb94dd971482df7729558c872
SSDEEP 12288:WyPz5L81+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rzy1yxknw4FYnshx8OfVe247
TLSH
T15675125B73E530F5D12A4236C9621A12F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 fe92dc04e79962c2f6e13a4b9a48fd8a64643aa8ebd97952c61f540d426fd430
MD5 cde86e0884043c0ef393c453d1086927
SHA1 2856d3c00f272adbecff15b841afbc8cd6f2865d
SHA512 ae78ca88657785ecbd67870c9d623d2b1d34e02af481b998cc4f4b38a27ce3804e4b1eca6e8e20d5767073ef932d2ffaa1140374e9471009d771c2f97900427f
SSDEEP 24576:0TGaLl3z0zDzyxknw4FYnshx8OfVe247:0TFLljnx4x8EVep
TLSH
T1437501A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 194939ae0f4efd3187a4a7dbfa877da980fcb3be31570726e63a607cb0c0dc91
MD5 f6be0cda241ef86a6a4eb1392a35d7ce
SHA1 d2bb62bb74f9a66e32e2e2009993927567aa9c62
SHA512 59505647564af0eccebb245c848eaf972e358d636746dbbbbffa6d80ed06c8fdaf3e57ecfcab2bc9cb946b9f198e1393056d0160215889477332d51a94dd9880
SSDEEP 24576:s3Xd9CHKy7GZXyxknw4FYnshx8OfVe247:WXd9CHKyaIx4x8EVep
TLSH
T12095DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 4d1b263769f4b02f93d9621d0cda9b25cf74cb723fa6c95d47faff7d9041289e
MD5 ccec3cdb8a1124073e0c09569f8876f9
SHA1 5226f540bbbfbd2edadb65b83e19b6dca5853655
SHA512 7ce21ff751bf32be29c81922c8bf29901a6c855e1639e4aa35f33354fe49d17f9f4b2eb9c4cdc5c2b0ef82c30e1fbb47c474b22f65afc4613e456c89cf21fee6
SSDEEP 12288:2D+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2Dyxknw4FYnshx8OfVe247
TLSH
T1BA65237CBBDEA5D2F50D11734B7163626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 5dea507ba019682c922b7ff887a81653debf022510a04190b855c1babb4f238e
MD5 db270ee10ae0a27605b373e191a30843
SHA1 fcb9118effae8f43ce4d2d359f4e0573193c95b3
SHA512 f42ae26ffbc380ce6f41eebc833cb0855f255fc080eccc0bd0756224efbd543a7c946eef4ed35f84e74096816e525da5eb7dbd74fdee50050a1dd4f993eb3568
SSDEEP 12288:QV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:QVyxknw4FYnshx8OfVe247
TLSH
T16665237CBBDA95E2F50D11734B7163627609B5A5EA71821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 50ab5930c2645886634a0966d48f6caba6e0436d0986ff665a5e943172c35d17
MD5 843a06a24fe216266e83a41da5a824e9
SHA1 549107a0ea66da9c9f26ddbd4b320c37232f3829
SHA512 f215ff9a626881fe5c2d5706a5b65190c6be085b754b9e3e940ea2a087500403952e6b07d68a55e647b721dc989ce9fd96e66b67e72f98e4129bd09a5d68e394
SSDEEP 12288:uk+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ukyxknw4FYnshx8OfVe247
TLSH
T13165237CBBDE95E2E50D11734B7163626509B5E5EAB2811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 2b71685a08480903e14ecc8265443a0637a7d7129adae4c9fadd90277b645416
MD5 66066cfbd28df6939782f2bdc16db83c
SHA1 5dc0157bd6987c8979a87ed99ecabaaed075703b
SHA512 a90ec720b766073801776a96cc414cb030d97b7fd4c6f309884dd335e6ea519a3031946c02a8963e0b5753b7e120b60288ef33625cbd11b2a306d4bd1f67d6b0
SSDEEP 12288:Ia+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Iayxknw4FYnshx8OfVe247
TLSH
T10765237CBBDE95E2F50D11734B7163626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 93bab93b8c607cc19e798224fb05114ff7c6f29137fa0eb914c60a6740f4a5d5
MD5 0c523c9f9646e107b621de4abf43283c
SHA1 b649b2bcf5a24e5ed496eda0fdb31e1c3742298c
SHA512 fd01e2e457e551c1d9461877981ec547219b16f6c65574d2977aa93a4be0773ca7909b838b922ae129fe740ee4955db5bf9d93926daba92364c803ccdabcfb0e
SSDEEP 12288:hD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hDyxknw4FYnshx8OfVe247
TLSH
T13665237CBBDEA5E2E50D11734B7163626609B5E5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 b5850699be7821fbfcc9e144d6bc0c35c928281d48518114fad2c9286acd3aee
MD5 386c61530611d5f23413d79aea3f920a
SHA1 f922ef2e09799a69bd8938d59834657b4afdc895
SHA512 b727a7658e6112753e20220d6c34cfc69a6caf604eb053d97620c18777557b746fe07948c637d5bcd1539de71a8a96f2a7e7bdf6a1695d67e19c27594cd3b775
SSDEEP 12288:Iy+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Iyyxknw4FYnshx8OfVe247
TLSH
T1CA65237CBBDE95D2E50D11734B7163626609B5E5EAB2821BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 98d9460fa89d47abfd9d88e0ce7499e083a4f5a59459cb25f5d68493792a5818
MD5 1632aa327d5b2ab467ea0b2460bdd4eb
SHA1 7d0fad752d11cc6ffea0f0f04a5f4f87d9091fc8
SHA512 c789743e91b52f5645487e27029828877db15b95deb63c405a043898d9d33240a89871757a90835c7861d164745c89a8a76a09e1967e10eb72b7d1fa9888cb24
SSDEEP 12288:xw+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xwyxknw4FYnshx8OfVe247
TLSH
T1CC65237CBBDE95D2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 7c24700f3ffe36324bcf10ab25c2cc68b3213a3e11e666b9ce7b2851104ed670
MD5 348672c52953988a898075c74e01e1ce
SHA1 d5bcbe5ce8ec707d6cc929fd3f18e0d301fabe46
SHA512 a3742a3f07c9f84decebea4e214f9ac4be1b9ab6fe28eb1eb83fd718cef025651ec9e81a03afa4b13fee32e4c2c67ac476e8f0311eff7558947055c86aa62aa9
SSDEEP 24576:UfwvJk9RX6wkyAImyxknw4FYnshx8OfVe247:dMnYIZx4x8EVep
TLSH
T14895CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cb654166b66dccb03ab6294d34a0b78bddb283e9e414eefd682c651767284e7d
MD5 c3bbc4461cdfb1531c84cff8ac356a67
SHA1 b6bbc18f6ecc04258e5cddaa52ec6b1eaa9b67ab
SHA512 70ce4fc9fb1bf95e42329aea10c6a50a300180a1ae95579c6d25eb72f2accb7cab86f927c3941863fcc095602a99bef85ad83e10d9a370a84df98821d0c1155a
SSDEEP 49152:XYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ax4x8EVep:zySzPiix8EVy
TLSH
T157066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1550749ad01d47e40a42275a0a4cad3b2a66396795bbd4dc02b9662ec87172d1
MD5 b60a147d66f047d490d59d280ebdd76c
SHA1 c5888448f04535cc791d6302fe950c1e081e3b46
SHA512 e853adac06e748df361b91239a4ff7806b94661c7abf26c551f39564e02bd9b798a22d4643dd79d2831a995efe8b9c222f052f4b40a1a832acaef377e4ad4850
SSDEEP 24576:j47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYJyxknw4FYnshx8OfVe247:j47JUQj1irIhCnDHUPfF/Kx4x8EVep
TLSH
T13C65AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 04d69dfc5f7daaede16a9228ae1528d2b3978a7e762ca82f6c6b8c9faabc4b72
MD5 09ff060cc40285c4dc002c77bd186c96
SHA1 85de760e668c2e5c3d4036baeb2d93055250da59
SHA512 4bf04f47a3bc9efc84e5a022c6d3a8eca0085858df40dcb85e589b6a7adffff7decac30cd47a4a734f66737a0314b909a80a837bebf017179cc4080a3e321861
SSDEEP 12288:y+sfq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iqyxknw4FYnshx8OfVe247
TLSH
T15175F028E29802E4D06E2276CB625641B3237C6597F1D3CB97D0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 69c664a41a97548d48b1abae8520371ab158ba73667a29a234d72ffdfe1098f0
MD5 6a950a78a096cd544cd7a170967e6d7b
SHA1 1ed2ccec20fcd6ba0a61768574f7d1d6a956fb73
SHA512 7bfb8c99f95e224eb320af56197058ab26a1ef5c584155edd11d84e22e5cff1b6328beca886c7ba1afa0269429ff4d740447a7e2f70c4df5d72b0269d7a280df
SSDEEP 12288:c2yL+eU3f3EhY+4U1u95kDxuZsL1a3gXX0:c2O9UPSN4U1uMDxu2L1a34
TLSH
T1A0352800766AD75FC6AD40322E32D2CCA7707D41EE059B0372C9872FC57666DBAF6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 482KB
SHA256 51a94ef1a001f6367db153bd04ae6a8843632c17a42863b3ae2050437ba16a42
MD5 e14648456c7d9064e09a383b4c5f5b78
SHA1 9162c4bae5ed2e5b08e7f0c38dafce58d1e57e29
SHA512 0e01813e94c64d0aabb59315c3c50468edc4205cb3808c2804788d3d4ac3d80629d01108c3ebe2a47b2cb59b8d118133d1acb2236070bc6f0dfff5f19003e0a3
SSDEEP 3072:mYtkExHrIsFEeGOIut+EeXmSTSEJ83+HiK1MHGSEEw3+HiK1Mf62SEF2ANhb:bXxHrIsqeGOIutZeXmSTlJ+GlE662lN1
TLSH
T15DB4F741777AE35FC0B980734531968EAB786C22AF016F016BD48C74D8B216E35BA7E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 7f30b7a4774ab52864f935d402842ef0c985f894184efa438b46933e66bd4bf9
MD5 d5856030dd0ae2cae1afeca041f347e2
SHA1 207a97a7c244146b2fc5bfc5932b80943b04098c
SHA512 8022631c647574482af388f9d14a54e55489e66be8ff34687af434b9c97bafd1cfef0ce7c65928b725e3e37201f316223531d51f855d316a3fae5165f133d39b
SSDEEP 384:HXkRyiO024Y5DL84KKDL849B7SOEAd9KVRaAcP+AWRMAvis:3mZY5DL8lKDL8CB7S/AmVAf+hRMyis
TLSH
T14B727D3D5F003CAC15A780E8C5E982A98D18B7A7DFE6C0AD21583D0DCB98969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 8cc3fcda340e32dd5146f643fdd7cb6d4e82e55e65501d551db2111b3c284cee
MD5 259a4f941cfb3393dedeef18264e67c6
SHA1 9baf598cabbb7ee021f9f5baf7ad797eba24744a
SHA512 568e0e5c6b86982a2cd668b534209052b3bdb57d2ee3f14ba9fe10baac7bcde22f99d45c1922e8d93c0d2e92540a26b0e56c14183d1ba99c8730ffe65cb94183
SSDEEP 192:Kz1d66JoztdzgCl6mc0dvSOv5zbo7oZC9yjHsz:md66Joz/zgC1jJRboEZC9yjH
TLSH
T154E1FD64EA29823FC859427BDCA61B410F39388AD84E7F19359C60082D572DD778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 1f37c0424549e3e46d5db0004ec1447aff3f16c41f05f43247ece3bd2101c65c
MD5 9fc59da04e8a5c757343b87566e8ece8
SHA1 b69c0111a3aa3def28f693f17deb198bddb09876
SHA512 af37799d2c26c71a10dada44ee0435629933a689ef611b2621e98c43a91cc64609ff3a0f8adfec8f9cfcd06ff1261145095384b6e44a49f2e2b2151cde7a628b
SSDEEP 192:Kz1d66JoztdzgCl6mc0d0SOv5zbo7AC9yjHsz:md66Joz/zgC1jORboUC9yjH
TLSH
T1C0E10E64EA29923FC859027BDCA61B414F39384BD84E7F1935EC60082D572DD778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 fe1daf09fb5d7a37974f2845715f99e368567156d81d5f421402500a9c4165a1
MD5 0c9c62d8f1a3a50802f2de1fe6dee900
SHA1 3610e5425e8e5b695fbbc78ba3e7870e903e2920
SHA512 16de31c67068bff1b30b5db859784f9358ae4a8b75bb6c5233d011ce430b5048c77441dd0a8fa2fdf676d68b4411e904763bf98df88062e0faf5bd430191adde
SSDEEP 192:Bz1d66JoztdzgCl6mc0diSOv5zbo7oZC9yjHYxqz:Ld66Joz/zgC1jwRboEZC9yjHp
TLSH
T14CE1CB68E629963FC859023BDCA61B800E35388BD84E7F1535AC64182D562DD7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6bf5ee8d729ae2283bf2799af19c4cb1cd9562e4923a5ed7e3a4a6ac88512bc7
MD5 1aee9c87f479467ad5da0764a164b32d
SHA1 03c050e48351cacba6103872886e7949e144e015
SHA512 830ded186e28e2ca9bb4793a2b5537af6187fa4996e95d96f168f26daba5e9860cc8c1afcc7e2abfa274e729a6b093cb4eff4a3990fc777a252b9ccbe38a5126
TLSH
T19321F55C7ABD8E6B9C8AE6987451128E93514A0708871D434D93FE8DCEC1AD9326E839
MD5 SHA1 SHA512 TLSH

Submit Download

6105a11c-78a4-4c68-b61e-c2c709b9959c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\6105a11c-78a4-4c68-b61e-c2c709b9959c
Size 235B
SHA256 f7ffba5a8a55ad894684232f0c368a559322d69199224c21528c6e83a37e5f42
MD5 8f1397018c46a1a7fe5f0878648c2fbb
SHA1 c12b9a81b38b9edd4a9174b842e092f52e259835
SHA512 cf570b27054840bc5aab1020a4818a2acf378f5d0b2e207ff7d369bb6360007df9dca8315edd2a8017968d927a3b7db27e041df9ef173bd72f05545539722fe2
TLSH
T1E1D0978038DC6F5D1C140F06B0B02AC334844C3310649890E9B08A789ABADC49162C1A
MD5 SHA1 SHA512 TLSH

Submit Download

7b60ef0f-82a8-4a7d-b477-dad069bb82de

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\7b60ef0f-82a8-4a7d-b477-dad069bb82de
Size 16KB
SHA256 93b1e043da4cdc21cac139f4a1a24282a07fa431ab70e1e13a84b157a3a59443
MD5 c0eed38855a74be0124f2983c9c54454
SHA1 6d2f5356bef2c38785be535ea15c59ec6e239b9d
SHA512 a128ce637a672410f394a5a9843563b006aabeeb9f09e2d7f38d640ccae72141a67c5a5449751fefa116f71f74aa817d08baee168974638b778b9f72be23072e
SSDEEP 192:l2DEXJGsohuquy2lB9/Su1z7dr8NdQ++HDdFIyZ9AFdFusl8KIjSeh35AC96NhAZ:lau7hTSGzkeh3uC4NhAm7iqEbJ
TLSH
T19172FB16586045BAC691E368D4FC7FC3E6F524CF4C419FCA9BE0BD086DDA06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3db1db0-2763-492d-be9d-7618bff1127b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\b3db1db0-2763-492d-be9d-7618bff1127b
Size 883B
SHA256 12c0eb815c368e4e79196b0d11bbd8dcf945090da3ecded6eb711dd8d2d6bc55
MD5 ad087b494dfa5fe3732fd50f30a3da2f
SHA1 4118b9c6ed6001d56bdcbd5d55c50462e46323db
SHA512 e1074079c0514cea72e73747c6f629538bcba1f8d683040c402ffd604b028ca094f764f8b1afd5cd3ff2af9111e3ae7905f4f0e136c7455c0d645ef5a65e0e80
TLSH
T1AD1100818738F5B2CDBCD25BC9A53B4197E87813D0CA54003EA04A040A7B51EE7EE64F
MD5 SHA1 SHA512 TLSH

Submit Download

c11190dd-c8c9-4652-bdef-ecb0de7cba30

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\c11190dd-c8c9-4652-bdef-ecb0de7cba30
Size 2KB
SHA256 ffceb4247192e3e6986274bd7f28f8b1f1ae869f473f6faf5107d7971443e5bb
MD5 a3a53fceffc4933910b227c36c56fc34
SHA1 02dd5c2bcc38e158968e76e1750b2d9b101d7075
SHA512 c7619b3700e9473ba4aced68663d5651dd3be7e994458fa62827b3c1163d4ba4e796afac7ce78a4dd9d273d160c107815e7b0372353e651d9d43360f46d20add
TLSH
T12B41239C35785D768CDBFA5D94C233CEA364990340C22CC32E91DE0D8D966AE637E42A
MD5 SHA1 SHA512 TLSH

Submit Download

e142534e-aabb-49cf-a798-20456a972d3d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\e142534e-aabb-49cf-a798-20456a972d3d
Size 235B
SHA256 b8563bf2fdedf9aab2b82ae7eee464eb8a05612a3ed4b4470432fea3ca37ab13
MD5 5f87380a3e72813707768a9d89a96bdd
SHA1 5183e8da1a4c473ca12bc45e2948c091cf183cb6
SHA512 8261fbc5eac4cd1d7a7d2cea9dfa90f3feab2588cd1345b525ab95318269732e80864963121a585bfc69fdeac1706bee280f809443631242cefdb1b490200088
TLSH
T1A9D097C09488772D4C202F03F0A028C670888C3310B56C649A9149788ABCACC0261817
MD5 SHA1 SHA512 TLSH

Submit Download

ee6b095e-50db-4ab2-b1a8-5c2bb34d9b83

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\ee6b095e-50db-4ab2-b1a8-5c2bb34d9b83
Size 886B
SHA256 b854bd9adf73a3ac2229d7acff455ab206d80cf74286a513138495b747828ce8
MD5 96c0f144f503db85fe6e547eb83c5439
SHA1 330032cc6eacbd7b3d07c2674c1cfe33413ecace
SHA512 97ee0f81abd3b8c2a37463886366ceab51f08ea20b4127fbd3c3223e075ab7d7d0a7a3be0e052d41ad308408c0a7b0be400a3cf2044296d84c33117485a0079a
TLSH
T1D71100419B78B5B2CC78E24B98D07BC25BE47413C0C668143DA05B084E7A21EE7AE71B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\extensions.json
Size 16KB
SHA256 3a4973dcf4ca3a46987d326d5113e5bf36b1091a4e9c41670aeb22b8fdb5e1d9
MD5 0c2efb60f25d066ab7e8069dd957b87d
SHA1 eae015fa2dbbdd259b76c6a232cc4f7ecaf06ed5
SHA512 a676bea8b7cb85c49b3b0b90f1d4674c1a827176764daab1221ed2f16e2f4a5ed78ec1dae1988f8ba98a9313737c516c30fbf94cd4ddf9f1aac0958a9d6ebe61
SSDEEP 384:UkI4v2UmldvR8dhWZk94zP96ohL4H8L4PtL4H2L4HxL4HQQ74hTa:7I4eRfiXi+4Z6C424l4c4J434A
TLSH
T1CA72531545048EB8294EA79AAA367E02C37D473B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 7KB
SHA256 27673a63f1e461dc9bb6e58c210345426533a5bc4a4ee381f7c3bd66e92a3015
MD5 d6abf835e1ecdcc5a3424718dc8fd892
SHA1 a3a7d1f3887ebc479c8effcfd8830c02b1389e2b
SHA512 de88e32a7b78e0faa5699c298bef211349e8600bf9844eff29f83ff4c75695925359d3f1af79d81fd02bd369e04758cf2b783197c510a51dec30b2229a8e8848
SSDEEP 96:xHTGpTUEqGqSvfMlDObzSVSSlvdv9jbnNWRIem9cBw88yev5F8L4cn5VPB:oORYfMlDfSSSRGGBw88yeB6T
TLSH
T1DBF11D385148CB7F74B677ACAC6489715AB2023BBBBF68C714B95485010CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 60bdc3447859a3bdbbf431b9f74d0ccc79573d0de31a0c254b2f62a450480a91
MD5 89f6f92dfe9eb5b41f793cf4ca219d90
SHA1 7e6b96a372f5757d725cb5ea400cf6830ac4e94b
SHA512 16d8fccf75aabd5992994bdf144a2de2bb257336bda267acf221871047596e55b27698062445ca933c6f6c03710a116303669b8e06dde5da08b6cbef14d34fd1
SSDEEP 96:xHTGUTUEqGqSvfklN1zSDSSlvdv9jhnNHKm9fBw88u8L4cn5VPB:oHRYfklNOSSJ35Bw88vT
TLSH
T1C5E1217855088B7F75B677ACAC688C316AB2413B7BBF28C610B65485011CF3442F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 f2028fc61ea6cf840f864acb11429d30917b962eac15d2dd9cc389acdfe39e72
MD5 d0157f62eb7c983e2f8f47e00e04585c
SHA1 adb8d67355cbe4550de2427e9e93356cbae7c906
SHA512 abfe6a8b442603d2892c0e4395bc96b2ec3339c31f9e2d99cbf3b459a5dff1b4333bf8149eba37229444678f09896bde621436c4e5ad85970218119eb235c0e9
SSDEEP 96:xHTGUTUEqGqSvfklD1zSVSSlvdv9jbnNHKm9fBw88u8L4cn5VPB:oHRYfklD0SSb35Bw88vT
TLSH
T133E12F7895488B7F74B677ACAC688C315AB2413B7BBF28C710B65485010CF3446F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 13477cc3aad63d5bdc8ddba21fff95668ce60e5ff583641dd524067cc53d8995
MD5 7898c6f01dda55a07fdb82b4cb55adab
SHA1 36f146669b3028f34794a2b60a067195f862e772
SHA512 33c6d9df677dbae453c938c06b3609852c2a2f9fa500ae028771a46113cb45405fcff54b333e7d1688a6f83cf1a30a3f6c50ed5c02cb63275da96fc648cb05ba
SSDEEP 12288:l47C+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6Cyxknw4FYnshx8OfVe247
TLSH
T18D65237CA7DEA992F86D11730676A231360AB5B49B70C1DBD728B14EE0B0CD0D87E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 47f5986730a16dd783476794cda5c6e95a7c8759365ce50473c9c8110142f3fa
MD5 1b4b6c1d7485a2954cbfb44ae93ee186
SHA1 6da21d633aeea473b6f29d70a31055c6277085bd
SHA512 f3afdadfe54486cb408324a48e4fcb244b6a3a83b91ead7eea171174c185902c52459f311b07432021eac0c0f18b6ff0c8b3db97965eebc042dced530177afce
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bYMyxknw4FYnshx8OfVe247:igb4mBIBhGFMx4x8EVep
TLSH
T14265AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 060a8192d47e3a5041988012ca0eca20236bda32d9b0e02c341a88b7a392f1df
MD5 cb5a197154a001bd789df173c541abb8
SHA1 6ec27e323dd0fad0f6e759011d523c94e89046d8
SHA512 dfd6b32194e8041559986e9af9ac33a3b3192b94a73d1d819ef8b21362636a3caa125a97d3218285f60e6708b0de383e1796cda4bf2b4177f6805e8047de39a2
SSDEEP 24576:hG88u8FpJqH1azria7/mZyxknw4FYnshx8OfVe247:k7ZFPqVla7/fx4x8EVep
TLSH
T1A895F16877E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1fc569f5308bb2806d4d060e79892b1adca6fb596eda190919e68dd97f06d7eb
MD5 917b247d9d5511f0afe6c877969cb520
SHA1 724fb811c2ad20193ed1084ba586bd6e1a8b9230
SHA512 d0fba052651e68793b6dcb0842919b6fcbb1b1ff20a6b2528500b2dec5fe60a84b44857192a6bef72973ab660792a4b5e2180c39468a66f22120b9bd7965a195
SSDEEP 49152:PBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYx4x8EVep:AG05lO43bRix8EVy
TLSH
T1ECD5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d0c666814f7f1dd0c192ea7936d63ad18d9f91c830341bf546e14dec335d4bc8
MD5 d66739a599e47580b98f3852b84ba23a
SHA1 61fd671eb628a30da780ae20467436b50a89605f
SHA512 802b673fb6b7815ac9b2a7a89b53d22355269c3cd3ef6e454620a58f0dcf075b04c03c594f8df480477486debf7434ac2f85203041517c9597a98432197b8f6d
SSDEEP 24576:ofa5POZ3dpFWVM50JicR2hG0lasx2+47eidnvyxknw4FYnshx8OfVe247:Qa5POZ3+Jt2pasx2+mgx4x8EVep
TLSH
T1AE65AF5DA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a4ca000e530f38d7970b488630a9533e6ca5c8c87cbb353ed6d5710bf75637c2
MD5 339ac0bd6b77c7e14be0383ceb20280b
SHA1 96b99437aea93b9b67ac2aeb159b2691c1a083f4
SHA512 2052b0f8fc0f6faa5eb26e67abd2e40d73e7e8b1e66342afad2fd7a4162a0c92433762c269cf29fa617e96cd436d705c1c02a7915e322aa92bddf2d18ef73201
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7FkByxknw4FYnshx8OfVe247:oNc/zEOVHF/x4x8EVep
TLSH
T1B8857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9d3db93809f309e9c9bfabb98f3a36ee973dae7fc72e8b8db49d4a7786c3c3ef
MD5 0460eff6c00e224975c78e8ec245d999
SHA1 20a308922afe077a92971e172aec0e5f683e4a5c
SHA512 54af8c489cb47972d773344bba70bc4115aedd5c5c7ef31c974b88003c83c99b21315eb5f3c2e545b0d2f50106b34392b8bcf5f1391e3aa216fb2de5360ca725
SSDEEP 24576:R8kNvNnaFeYhJNtmZBm4yxknw4FYnshx8OfVe247:R8MwBtOmbx4x8EVep
TLSH
T16B55AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 382fd80d73f28460020e00de4bab343e798b5be9706df81564b9764200b826dd
MD5 e42a78122878a5795004133a76ca7999
SHA1 180bc122f4af40653aa99b09112490096c117256
SHA512 b59986b92d4b825f3089737f9d7d23e066e564ad7f0bc8f7e35b86f44a746f9c076056ee8fc6b8dfef295ff6efb5554ade2ebd4497994393c318aa8948959455
SSDEEP 12288:4HvUrBFrEjwaQd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4PUr+NQdyxknw4FYnshx8OfVe247
TLSH
T1F975F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 49c6621d6d3b04f17dae33e8c69a3e04a678723ae89bca4a07189fb3d71fdf6e
MD5 139e52b7d68757e669809f117b982c71
SHA1 2867e26153aab7d8818617deffc1e56f454b20c5
SHA512 981dff0aa987c071ecaefcfb4ff6c16343e0e5891d7e5633a2d4fe2cf9544493508f7569b56d21a5d0497e1eda59efddae4d8b107c410b184f468177d25592e2
SSDEEP 24576:jD3FHshBIYQgAOyxknw4FYnshx8OfVe247:jDVHeBIAABx4x8EVep
TLSH
T15585E17DE79C04E4E47AD1BC8A638606E77138A9033256CB0294D1BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1048-624-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1048-623-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1048-620-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1048-112-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1048-111-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1048-118-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1176-585-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/1176-79-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1176-85-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1176-77-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/1432-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1432-22-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1432-21-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1432-123-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1432-15-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1540-65-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/1540-72-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/1540-548-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/1540-64-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/1980-90-0x0000000000870000-0x00000000008D6000-memory.dmp

Download

memory/1980-89-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/1980-95-0x0000000000870000-0x00000000008D6000-memory.dmp

Download

memory/1980-601-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3040-132-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3040-621-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/3040-124-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/3040-126-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3632-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3632-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3632-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3632-153-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4260-138-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4260-150-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4260-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4260-148-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4260-144-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4644-0-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/4644-1-0x0000000003640000-0x00000000036A0000-memory.dmp

Download

memory/4644-57-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/4644-8-0x0000000003640000-0x00000000036A0000-memory.dmp

Download

memory/4644-58-0x0000000003640000-0x00000000036A0000-memory.dmp

Download

memory/4644-7-0x0000000003640000-0x00000000036A0000-memory.dmp

Download

memory/4728-661-0x000002869D8E0000-0x000002869DB6B000-memory.dmp

Download

memory/5588-628-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5588-155-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5588-154-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5588-161-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5880-53-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5880-39-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5880-40-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/5880-46-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/5880-51-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/6032-100-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6032-106-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6032-99-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6032-619-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6032-953-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6032-947-0x0000000000740000-0x00000000007A0000-memory.dmp

Download