stealc | 67127567c553ea99d95e9da5e1734fce3cd9fea8547485ce903728aa05b26c2d

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 900KB
Sample260910-2e441ayygv
SHA256 67127567c553ea99d95e9da5e1734fce3cd9fea8547485ce903728aa05b26c2d
MD5 e12de761d4a7ee483fbf80b0d4c6b40b
SHA1 8a95ed35ec8b5fc3074b6b4058f2b25964339aeb
SHA512 dc0ef66cb658119e0d38208f7c39441550d68c093f0af0bae1d6c8fe5076edd9331d18751dc1d28c374b0587e42e00a5000070ba11e513de98b837f362fe3e75
SSDEEP 24576:VvzLagcIw+++++++++gDl3OSq2PEIdADeU9jz:VLLII+DUSqHIdADeU
TLSH
T10015E002A7E509BAF477A7B98DE14111DA727C524B70DADF1780659E1F33BC4CA3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 2 IoCs

resource	yara_rule
behavioral2/memory/5000-77-0x0000000140000000-0x00000001400E8000-memory.dmp	family_stealc_v3
behavioral2/memory/5000-314-0x0000000140000000-0x00000001400E8000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
3308	elevation_service.exe
2364	elevation_service.exe
5452	maintenanceservice.exe
2904	OSE.EXE
5880	PerceptionSimulationService.exe
5236	perfhost.exe
3460	ReFsDedupSvc.exe
1452	SensorDataService.exe
4540	ssh-agent.exe
2152	AgentService.exe
1216	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e864ad44c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 48 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d0fa30c7441dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b3e0a0a7441dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000097f4ef097441dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd42060a7441dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1f1ca4d7441dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d45ea0b7441dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c78cf74d7441dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe
2364	elevation_service.exe
2364	elevation_service.exe
2364	elevation_service.exe
2364	elevation_service.exe
2364	elevation_service.exe
2364	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5000	2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	2152	AgentService.exe
Token: SeBackupPrivilege	3460	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3460	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3460	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3460	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3460	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3460	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3460	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3460	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3460	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3460	ReFsDedupSvc.exe
Token: 33	1216	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeDebugPrivilege	3308	elevation_service.exe
Token: SeDebugPrivilege	2364	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 2956	1216	SearchIndexer.exe	100
PID 1216 wrote to memory of 2804	1216	SearchIndexer.exe	101
PID 1216 wrote to memory of 6104	1216	SearchIndexer.exe	102
PID 1216 wrote to memory of 3084	1216	SearchIndexer.exe	103
PID 1216 wrote to memory of 4928	1216	SearchIndexer.exe	107
PID 1216 wrote to memory of 3768	1216	SearchIndexer.exe	108
PID 1216 wrote to memory of 5648	1216	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_e12de761d4a7ee483fbf80b0d4c6b40b_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2364

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5452

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2904

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5880

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5236

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3460

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1452

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4540

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2956
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3084
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a85aff3dab2fcf7bca4b0981115c1d1a1a6740303eaace4f52b0f89d8689ef77
MD5 98b0dd3cd2f85e9f6594e73647bd6eb7
SHA1 dae0655b671c2f6baf7ba30abe3556e909b8741e
SHA512 23d9f228bca77e318028b20dcaf594ae6cc94aeebe38db3a19cc68dc7bafacfa5ac6f32fb51f0de7409072423802768cf834c4161ce40119a055dd99a5f21c33
SSDEEP 49152:cb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnIUSqHIdADeU:G3q6tjBGHIdAr
TLSH
T1D3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a4a10b64f04383ee8f53fa3370cd970e49bdcbcbacadc904302203c2023892cf
MD5 821e0bb105dbbedf649e90eda1847831
SHA1 bcaca0e24655341fd488f9791c8b02cd94cff7b2
SHA512 deefd632884cc52327c6df95853e29c29f1a5e89bf8fb1135407a409e159e6de31346c38827dde625c4635c4d17a84a73962d8d0769ecc249a0d5eb2b0d85e4e
SSDEEP 12288:s1XLsswWkxy2lRq2czAllIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:aXYfDtczAll3OSq2PEIdADeU9jz
TLSH
T17205F12837E009F9ED678179CDA18111E673BC5547A0EB8B03E0A9661F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b4e060ed90223dc81c179e77947369c40b3d1d1b7939f9d053d3fbb5ea07acf4
MD5 62d47fc16500eb48e89ff12027a0916b
SHA1 f9b222c557fed3b66cbc60c09fa67d4d8d4c6669
SHA512 ccafc4561f28e16e20c4095c02486365f9403ec4e1059ec5ea24f0f660756ffa9a86ef3ee1a9e2c6ca8f4d843907aea1cb9dc8826c7e13cd786a7f21be1f6b16
SSDEEP 24576:f0Le5ji0hmxnrMwl3OSq2PEIdADeU9jz:fPji0AxbUSqHIdADeU
TLSH
T1B435AE16F6748331D073C0B9C5D2A69EE97230865B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0c9c868fa50d9e9655cff2dd0caf7576de7c3a2fc3de1f235dab452ceaa46361
MD5 40bcc1f5d43f1d12c4b9d168790abc80
SHA1 6d32b6975e2967b4b0e4513ba5866e867d2ece2e
SHA512 a8b12a5436059fbb48938778374ee3f2f95da6aa22ae8cb3fe0c7372370416d00a7e7e68e870048ce624528995372e66b7b36e84e00721fc4d97a0c0e0d59cd8
SSDEEP 24576:Wa7/ezSC6vUyDZaqgrvWx6q8wyuCl3OSq2PEIdADeU9jz:h/ezSC6vURPvMHjyPUSqHIdADeU
TLSH
T180755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9b631e7571a1a1961e0133cc4bfc7cb7d813f7ffb3a9616285ad38fb6987d2a2
MD5 18de5196b4bd719b5745dfe207ccd629
SHA1 e9ed4fdd354655d2abb25ed720f01bd6a4337a3e
SHA512 e1fc5f3482cd2b411e4435ddd37c33bc5a71c3585a38b64c293947d640b4201351756fb9099dbdd96630e9d868172c9db8fd342d127b86fe6a6f048bd1e8dfb6
SSDEEP 24576:yVbqPb88hv/lV7Bl3OSq2PEIdADeU9jz:yVO88hXlV9USqHIdADeU
TLSH
T11A559E66F5748321D073C0BAC5D2A69AEE3234425B31CACB0246D76C2E77BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 eabe16bddab9d7337287be09760d96ae3e29cb4828d9d44a99ae00fa654d19b7
MD5 e941bcfe452e074d91f559972736a829
SHA1 1cd9c9c54da446f04ad4aeae333db13b445f6f06
SHA512 aa2b81b736de9ec93ec97db428d57010fcfdf29cf6e18013d0a669f54b089cf15f4c538decd623145807627084733a1d67d97548b961564c2290843c284a016a
SSDEEP 12288:uG8lIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7uv:uG8l3OSq2PEIdADeU9jz
TLSH
T171C4234A193512C6E39348B34ED043A4D4A6FFBAE8C4EE45DD80B989647CF9FE26104F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 dd90b991acccb0a0d35f9bbfce22fc08d115cc04fc3fdf46db27bb3cfd4112db
MD5 8a10976058cc0edf5fa20a099b3c5e8c
SHA1 e621375cdfac9511dee9a4e9db57dba5dad291e9
SHA512 38b7e561271a2d1aa9ffa81beb1df55f530a7876fee8f4e163b1cc75e896800d2efc403e98d67cf2606d840b946892c97639f7ef7a19ee12a2188a968aa8f6ca
SSDEEP 12288:UeBNUbTVO86UplIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:UJIUpl3OSq2PEIdADeU9jz
TLSH
T1A805CF3BAE28FCD2C27A8CB95B918240D77278704F51E3CBD164920EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0c78d871f5f47338ede348a025f5e1f60a250e980a48d1ba3389b354a96e8f00
MD5 629807459c689cea848665a4c01a740b
SHA1 a67c447f78d04317ba4c5b3d1f50a04db08f23ad
SHA512 cc1672cbe75835bfd8fe315b934f51e74e797a8fc135407d556c9732757981c6f005f00fe25e0e295aa6e149cde2f95e391e6f9533dabc0b65df46474fad5184
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THq:xQvGAdlCEL8c/pRNw5CBHIdAr
TLSH
T114267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 15066a05f61e6489c8cbac6b38213eb5391342fcc6e1f60d6fd07bfce96b2ff2
MD5 13b3f8d8bbe3e4d490868e8b715ec938
SHA1 f7a424f2127efd486cf5501d13dc1fe2a421ed5c
SHA512 37a35000b1289ae344a4c6f440b14b161c99b2c6946c380d01636d1ffe52a3d2c878599d3c503b463c3d3eaee275bb4c0c4d82a0dac3f1263d5462b7446bdc32
SSDEEP 12288:kAwSfxL/2Dc3xDLLmt0LDQewsAjrlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:5wewsAjrl3OSq2PEIdADeU9jz
TLSH
T15915E031FE74E036C3BB0DB21B65C316547DBA204B911AC3E3E8AE8D59346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e8c87806e1dec224f498ecbe884ed1a5e4b53ea8529a26723aaca0669e44121d
MD5 e04969f76e15c4139f1d7363db2a29bd
SHA1 a7b32635dc6fe6f3674e90e56dd4480ea92abb4b
SHA512 8482d81553d7a1ee2567cc556dd2ec673030c420a02b90b6849ce8d68ace97d4ca39c91a3ab670ba8f96ed7e836102c1571843895862976770c77a519320f507
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHEHIdA:EUEtQevvqc2W1cpV29I32eIdA
TLSH
T1C2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e2eb33cb7af013b1382f91fce3d94d1baf49b3f10a2c50fde465395b07e8ff80
MD5 e490f96d84ad35c069d1e3dd119d1c98
SHA1 8ba5d3f85c36b0db95a361707d867d4a74ad7213
SHA512 822804c1942397a9b1110532a2237d935cd73826cc6d5fe054b74f7ebc9093fedcb977c0e5674629dcd4d65df1913b1c747d5a40767543bbd2f67225dfe6560d
SSDEEP 49152:YCbRquA/m2yL5zQfFiV+XenmE3/zLUSqHIdADeU:RoqtVjnmFHIdAr
TLSH
T149D58D0976B882E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c08b013345aefde35ee31b96993eae964ca7e7fb3a9a2200b0799d26fa8c572c
MD5 b387cc387e399305fc2781e1de0ce622
SHA1 37d6f978dafcc7d75102ea349007e7278f478790
SHA512 efe59e6656594fc02252121e192ac9018ecd61a17768ee5f029439d17131863b83deff81c3019a1347194d26c31895d2b9bf1962019016509bacb7c2b93cdd22
SSDEEP 24576:ZAhGLmIFoiwtA5l7S532l3OSq2PEIdADeU9jz:ZAM1Foiq5mUSqHIdADeU
TLSH
T181359D81E7F955D4F5B3AAB899B68170EA76BCAA5E30D20F2150D10F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 96d157d37c8de53806984c2bdb7b460daca780601aab3190071c33bbf708092b
MD5 d2d78a80085055779524b081324a32d7
SHA1 c83137fef9e35256d39ff668cf918ec7676c07fd
SHA512 93928443842cdae5de006171607b5ad9444db3725a15d2941efc437d2644caaf2591084b111aa1a3ba19154a8fcc74782fa0dfbc8d6d2f7d0101990780dbe384
SSDEEP 12288:Imw5HEjsChNOBFgl0WDm+CilIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:lwuXOWvl3OSq2PEIdADeU9jz
TLSH
T16005F14A36A40CF9E5A785398697C136F7F2BC122A20DB1F0760D65B6F37361BD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 5a0eb747b5b1f38ff8be6428ff04c79d8267b878a83b04d77558d7b3aceaa680
MD5 e40c5044f814c1697dab59cba5748f33
SHA1 e0eb2c002e198f32faa5a44079c4c193a61233f7
SHA512 8a4c88ad6bcee834aa0dbc96db27e9d0819a068faa0fc7f9fb6472d207f21d649e48fcda61b6d37264c2d05e2d37de80a9d95e7faf9e0c4ce2801fc667f4ea3a
SSDEEP 12288:9bZ1Iy7lIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7ur:ZZuYl3OSq2PEIdADeU9jzI
TLSH
T1F5E4124A32A421FAE1A34179CDE04244D3B2BC676770D7CF1A50769A2F36FDA5E35322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8c7339a0febca62a99d9b7c1070e99f9b2a092c721b029dabf5f84327ca4b6ea
MD5 a18bcd70045433dbf35227c3de22ff4a
SHA1 0d2d250bcb95fea878d79099d7746542a04f9cb4
SHA512 41466665e591e5991c248152349dd0cb2c6706c3c3ca1401d9169496f633c917772f6c109aa35819217a7c57e90fb2927049f7656e21c931509cb10901797948
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Ue:LQRQyi36YOcPuLvw2gAf+PN3iHIdAr
TLSH
T1D7667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0522d410215d6b2519681eab099252b111f6a31fc2f39c82ab2aebabcd906e41
MD5 914292418d7e73f199df2a8349c619ec
SHA1 07ff0bc975625c4d55fc067798b19c8b2c12e993
SHA512 280e5f551c4cdbdbfd63dd38edc9f175ef28d9607b449de566413e7a20889b17d84c925b35b7a7810ca29a0d5b65907c6b1d17644b2095a3630ef021558d863d
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Ue:cQRQyi36YOcPuLvw2gAf+PN3iHIdAr
TLSH
T1C4667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e4a640600ad80bcf655231512021f00c17ce3b0f3fdaac0fdfe0be6093fb5708
MD5 953f146467067adef2496e5bac714b19
SHA1 1efdb8af4f40ba20979ab8a28f49e3663ea7f546
SHA512 85bd18daa5f89a7eef4680f2a0e7a0dad785e5024f40a680d6140b72f8e9f06d5423fb8839e72cc18f1fe9d91c321dac0dd961e5b6be43ce78927588a89ae1d6
SSDEEP 24576:OwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0Il3OSq2PEIdADec:468Qg55nhxeWu7PNU3/bUSqHIdADeU
TLSH
T151B54933B2F60099C44DE1769F4A873196D27C758FE0E7DB8501720A1BB2AD47B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f9bf9179e10f232a0f0aaa26ee73fe3403b3944ac8653ce2097146afd349092c
MD5 bac0d2102fb9124fa68c835996d53233
SHA1 afa4354207a892b912a23b0b16e941b492d96a3e
SHA512 421bc8fd9d94a8c6e621263c3630b844a55bffd3b3fe41125a74abf22898b3ce9e5ad6260ad6803dfbed1cc2890dba3dfa4b3c7fefbccab45a72727640928f1c
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99M:4y5112gYy5azzVvD69nLKnhZvHIdAr
TLSH
T1D9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1541c82f60900e10752a4ecb02a58ea320fdfefef29eabb1e16cedbe2eb3d34b
MD5 60a7e530dcea81a37caf63d11f68fd80
SHA1 df499f7145cc4ffd975211646c56087d033de7b1
SHA512 b4149c005fec48cf94f57cc2dbc63fe401a067aa94b4fc12f019e24fafa0694290135e45e9c62b5e0251a9e40fab4fd07d3b0d3fb70730b2e09808c794f3a7d4
SSDEEP 49152:hB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glVUSqHIdADeU:3u6JmQxd2dqHIdAr
TLSH
T150D59D13F1DA01E8D06ED479974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d69c97d366acdcbfa186834068acbaeca81927cb3fcf3c23cf9a8eb35d8167ed
MD5 ef5552e6cdc4791d7d042bd44df6b3e8
SHA1 c215bdb174d3f9adb422150b8ecfb8b2c686cef7
SHA512 3280633a2d55808f8751ec5c0a6f2f6281a1b50d161f625da003060b38d45c19360c97b6568cf61e5a9519e9facc7c79b18c72c0353e680fbf3cacd94caa032b
SSDEEP 49152:A1hpsNoJpF1A6yU44CwH7R4xJUSqHIdADeU:AmifPVRFHIdAr
TLSH
T100B5BE13F29901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7dbfb45f3f0fce5328bffa594d7314d673b0e6eb88276a24289fc38dfd889e16
MD5 a6b2a94c5c7081b71f5f4aaf5e8e2929
SHA1 25bd385a23c1a0305a1056b624275754e97066b1
SHA512 3831ccf5e18b3189944dc0e070c6e8549d04e4c6c1be616d95ba6be66c7f52c9a2b90df3723c44ab7aa792ded6ba541577fea333abb468e87cca30bfba13c88c
SSDEEP 49152:6SuZQIY0Be2KIRVtOnks6NMHqYUSqHIdADeU:k5dKOi617HIdAr
TLSH
T17AC5BE03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 edf1b8c3dd027d71c26eeb9d0960f61f732eb627afb6bbaa063a801b5b7e385b
MD5 66359e731f25cd7b2da2cfb740bd2f87
SHA1 e101edc264f5ad9f5c13edc71b67a6cac42252c4
SHA512 4e28c7ea7febd5eb4222f39b87be30129e46e2560a8aa2fee82b6bf074490259f5c0cc07e968b8351b0588218159cc3dc382a7afd09f90c8bed5f0ba6c9f8bdd
SSDEEP 49152:4htSn8EApI0figGgiDn0AP5wlUSqHIdADeU:pX2i/phZHIdAr
TLSH
T17E95BE13F2D901E8D05ED175C7468632EA62BC160B34BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 54cfddebe98fb7947187cd6d9c4e824de66de9422db49a2d9d4146d9a879d5a3
MD5 d06e77b5907343f4ae0ef4287d48c264
SHA1 55103d2c5eb7b3252d30fc064affb63b481b963d
SHA512 14b4f89f6d2a1be2db3e0ad897f6b15e8b53a91ef2d43b80a5dd3146dc2fd694634ab57521d429e64bd220c0fc54be494dcdc0c63a672df34592da7f8607016f
SSDEEP 12288:EElIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:EEl3OSq2PEIdADeU9jz
TLSH
T185C4234A287603CBE14394B38AD04394D499FFBBF9C0EE89EE80B545657CFAF616105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 4ebb3e849236f6ef86278424c70bb778526c53b4b1ab494d7316f8d7036a1fcf
MD5 19c7ac90267ad32ea8a0ea671f7ecf01
SHA1 68a0bb2909d2d2bc76676c9da1bde4ff804f259e
SHA512 202614a6ad9e9ea078bc65a107bbbe698702a137396e90db3bd2728cf066ba7afaa757a9b13d314aa72dc3ef7de8c9eeddb314effff5dabf0af498fdb10c2cd5
SSDEEP 12288:FnlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:Fnl3OSq2PEIdADeU9jz
TLSH
T169C4234A287603C7E24394B34AD04394D4A9FFBBF9C0EE89EE80B545657CFAF625105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 bedbcaed145cfaa49ed0cacbdad16dfbd1c1d8ee780d3ce8bef027af1d6bab7c
MD5 e5720297e1981ac343ef2edce154148f
SHA1 a175e3b2a5b08eb263fc06f3207f97249c94e883
SHA512 87b2f43c7ca7c66a487c88f570871528a409a0aebd25a13ab28268e695a752c0b6cc6b83bb0e1dc2b5883c06925790ddfd3bf730c134231c87bc088c08b5aec6
SSDEEP 12288:AxlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:Axl3OSq2PEIdADeU9jz
TLSH
T165C4234A287603C7E14394B34AD04394D4A9FFBBF9C0EE89DE80B545657CFAF626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 010ba6c69c525191cee257d8c6e3385a319f36cae7cbbbc333b661fc4c2b7fe5
MD5 c4b6af9fdc40be87cb14100741652408
SHA1 4a176f0688fe643a46fe3ad2150ad54a332f250d
SHA512 79840764cfadcfa6b1a723d7f6ed3ab61173f6867b8a221380dd0f0dcb8f9048125c32376d498e7247a7ec533fdb5fea194bdf4e0ff2276a11508c63bde7528f
SSDEEP 12288:pVWlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:Kl3OSq2PEIdADeU9jz
TLSH
T1C0D4230A2A7502C6E153C4B2CAE04250D1F5FEBAFA60EFCF9E4079491D78BDDA53065A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 f081d50c75913faf67fcdbbe2c5ecf72e9627bcdd0480b187f93a096fca69a56
MD5 4945118fb287bfca1b5f9ce18f2444bd
SHA1 95a498164f085d66737e4f32492f157b5f772578
SHA512 e40e936b06146b001aaf71bc23f29a32d5bf2c7ac88e88006a773829a8009747ee0d3d3aea3eb8bf98d092775d85023f2fa521d5f664b00ce90fd71f3e8d2b2c
SSDEEP 12288:BOlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:BOl3OSq2PEIdADeU9jz
TLSH
T14AC4234A287603C7E14394B34AD043A4D4A9FFBBF9C0EE89DE80B545657CFAF626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c22ac11bf0fcd3c8ca87cfba314b0518141936faf09ca1c88866913fb38759c7
MD5 aa62b9747b5aae4d72b1052b29265070
SHA1 fd5c4e4dec15c482e3e02a8132f458e41411d209
SHA512 600b2be5f4bf735196845af10a4732673491fc2bc0398072da691d2d06d6b955aa10df36f41417b7af14367679ae9a9ff2f370903af42f3132c6d2a46aa8d9d2
SSDEEP 12288:gzlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:gzl3OSq2PEIdADeU9jz
TLSH
T18DC4230A287603C7E15394B34AD043D4D4A9FFBBF9C0EE8AAE80B545657CFAF625105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 5ea18eb5cb685f14d38bbd920ce132ee94f9ff8e6815162826d3ae486b6406ec
MD5 670a3170b4254dd3ae6b8e361a1dc081
SHA1 e4890e79b413c194f88502d862a16d3e6c3fdb47
SHA512 fc39d2a875cb7054eae0a170d5d26cf4c1d981acb8302da0f5a266ed7487efacc05697c7228cbf427ba8cd5264002de6847e8baf040f0bf69dbc3c792e616ca7
SSDEEP 12288:wflIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:wfl3OSq2PEIdADeU9jz
TLSH
T1E3C4230A287607C7E15384B34AD043A4D4A9FFBBF9C0EE8AEE80B545657CFAF615105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 383ebe6086a827d5c2a9390d50fec77d214a15e1011065a2c9486dcd124b9116
MD5 16d71c91609cac8ea8a10f7f63c819e3
SHA1 0f09b4d989b323cfd2e9753782a48fac2ae44443
SHA512 f9d773bc0368596ae9917c4a762f271d8a92573c42a7f309c10e3a3de2aff52f756ba8fc75a18969b1d3c094ead8a944e94bc42860a547ff7929241e12597485
SSDEEP 12288:BiZwbNzzFEoS2cPvyHlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:EZMJzFVSOHl3OSq2PEIdADeU9jz
TLSH
T10D050295736018F8EC63813ECD508915D2B2BC6A5BA0CA0F07E436675F377A11D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 bf67b795dd15b7ea59a96985cc55b13c328c97e85ed9e36d322ecd1782c7a74e
MD5 a178238f30a54b5c4dc88c9fe9e07dcf
SHA1 4ea3788b4536b40d9ef00e31d7b119521980ec70
SHA512 813b1d75de0df362e86175dff8ab28597ca9874540fa0a1b0a266cf66d072b15f01d740775dd027667b04af358210f802d3fed7e23330f3ebebdd208f101141a
SSDEEP 12288:lolIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:lol3OSq2PEIdADeU9jz
TLSH
T1B4C4234E287603CAE25344B34AD043A4D4A9FFBBF9C0EE89DE80B545657CFAF625105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 81418f8388d0502cbdd43225f48a50e5df17f727a1dbc4c28d927bd0edc21bcb
MD5 09fcf8d3fe1a94db112dd67946c31d8c
SHA1 a6c029623915d4395836b91d8bc12aabdb694932
SHA512 5e6963d0e7b5e1a8101d319c0fcd565e282a662c19d9e82e0f9633f78ba757006012542efc1ae71327c0e74b08b43ef55b42838a925310f2e688196459b4bcac
SSDEEP 12288:wMlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:wMl3OSq2PEIdADeU9jz
TLSH
T1B1C4234A287603CAE15384B34AD043A4D4A9FFBBF9C0EF89DE80B545657CFAF625105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 e115fd9bed7689764a011ff32a38a1e3717ef39d544ad9099cf1fb341ff64d3e
MD5 ba82be7f0477ef8b55869d4a7fdcc3fd
SHA1 f5c373b04cd3af6f60aec525c1faaa51ff38d887
SHA512 a9272991c3d619a3e0aadffec5675c12c5f9304960f29f09e51681a68034ca599e99e17f51e352887c632fe31f627958810f935f0235c845758554a1d1323a19
SSDEEP 12288:NyPz5L87lIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:kzy7l3OSq2PEIdADeU9jz
TLSH
T188F4120B32A121F9D1638135C9E10601F3B2BC365B60DF9F579066762E37BE5AE3A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 76360b0dfd9d710d4faf9989bed660aed7ed3854f39b549bf7d886bad9a94fbf
MD5 bbc3ea83519771bada0892aafe063d2e
SHA1 32381b570c6380912011161b7786743b79f30a29
SHA512 0497b38116f5cce0c225715fc8aac7e92dd8b3f87ddaac24c2ff99de1ff978af10160962fc1a9d203ebfb126264eb2bd6cffd30bbf0c555c4ecbde89f0402c1b
SSDEEP 12288:ColIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:Col3OSq2PEIdADeU9jz
TLSH
T1E2C4234A287603CAE15344B34AD043A4D4A9FFBBF9C0EE89DE80B545657CFAF626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 6f23e473afd873ee11d286295311f9fa4fe0f5ef0c0ce83c7834fffb0714db01
MD5 8261ca60f6c5fbd48a43c6b41ba73c09
SHA1 da6f63149a19de21484c2f6002fc7858bf0cd4f0
SHA512 2db2a93a49eeb37a0c264dae43f45941cf3afd52418c0335db7939c26a213af6f73117e5dbf82a393097eb77d60cee7ea83b228c8b316a5212ca7ea293936083
SSDEEP 12288:zolIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:zol3OSq2PEIdADeU9jz
TLSH
T105C4234A287603CAE15344B34AD043A4D4A9FFBBF9C0EE89DE80B545657CFAF626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 f0209e315c4b19f0da277565029ab719848bc7f63f0a90f89242cad5b45048dd
MD5 00e9b714ce2faaf6d5e35c7af404ff54
SHA1 89b949392594e22fb96aaec990038667c0f447f7
SHA512 96813828fb46b0827900d04c2536e6f48ff8b971fb7ed2ef5595b9758a2e35f353e02a4c98527f659af92ca7b4df0a1f87035176ad79f3b1ea67ea03aa220510
SSDEEP 12288:fyPz5L87lIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:Szy7l3OSq2PEIdADeU9jz
TLSH
T1A3F4120B32A121F9D1638135C9E10601F3B2BC365B60DF9F579066762E37BE5AE3A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 373cbad224c255ab3e55ccda71307f1d6f8534f0c2e432d737ef6df92f010885
MD5 65a774e5447d8782eb4bda0d2de49c86
SHA1 f7b8330c5895458ec7c1f98f4055192418e97a00
SHA512 c9988c91adb9d9ed5dd565ca669b2a5a42e2af37888bde79cb46bf0994de2843d1cb6e2e7757908910313bc6b20c1be8c2550f5f5b0023deb413e2f4f85443c0
SSDEEP 12288:tCd9XWYoaLHF3z0z04PDvhhlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:4TuaLl3z0zDhl3OSq2PEIdADeU9jz
TLSH
T185050299736018F8EC63813ACD918516D2F2BC6A4B60CA0F07E4365B5F377A11D3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 a63e95cc87044a15f7de1ef1e907afede3a7addf7a3662566e6fb1e21e0dcc89
MD5 45777f0c3e451f5bb47ffe1ac632b266
SHA1 d310255c5727cc38615c7fa31b80056877463e3f
SHA512 8b29130ea88cefeb97f95ec2ce10924105d23700489aebb7f4e650179f910e175d5687f64a466a84b89159880656d89d9a004dedb76896512beb9567e60a5e3d
SSDEEP 12288:Li4e7URdTfgwCHKy7GLbbdIvalIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:L3xd9CHKy7GZNl3OSq2PEIdADeU9jz
TLSH
T1DF25CF90B3E410E8F0B79A358D714511DAB67CAA5B70DE8F03A4665A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 f74dab8c9e11cf3e2bdc0a99ee1fb00a8fbb710f601c82d5172b52cef52099dc
MD5 8bdeb91061b1cfca11ba3565d24e0388
SHA1 9bdf57a7f6386633fc535ced36768a552f532db3
SHA512 2b19ce44ee2c3959315eaeb1b8a9a9ce4f0eb3d1077edc0e6e8157a525adbe671b93efddedf0a2429185c0ea00fab936ce9b897a9878d83d9277a8c780f10236
SSDEEP 12288:ZRlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:ZRl3OSq2PEIdADeU9jz
TLSH
T128C4234A287603C7E14394B34AD04394D4A9FFBBF9C0EE89EE80B545657CFAF626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 059f6cbe918c7f01f01fd55a55c2d190460ac3a64dd6c0baab4c21a73e694605
MD5 e7071de4a0d330f39e3d85e84d026256
SHA1 546857d5858300fbfffcd0b2b2e8ad2c4b5c0467
SHA512 6f44fc82430e6accdbfb53747a773024faffa6f9da0fd27d890ddf7aded28122c66639fd8058bbce28c16fc3f0c81a1bb8535ba6f42052aa4ec9347ad7724f12
SSDEEP 12288:ablIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:abl3OSq2PEIdADeU9jz
TLSH
T12DC4234A297203CBE15384B34AD04394D499FFBBF980EE89EE80B545657CF9F616105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 e955abe4563bb879f916b9e2f9e7a3c1503246349d85b9113fea2f4d44a61914
MD5 672a32333442914b6baba88a6908a97b
SHA1 618340d3503deb9fcce17a386aea6ddb81bc9aff
SHA512 b0fc29626a27b18c0bfa6a867fe31bd32895cc4562d6b7de8cc3b6fdcbfeb43d5d633f414029e433729aa398c77cdfeca576bcc567a9cdb7120881deb69fb056
SSDEEP 12288:jalIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:jal3OSq2PEIdADeU9jz
TLSH
T11EC4234A287603C6E15384B34AD043A4D4A9FFBBF9C0EE8ADE80B545757CF9F626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 8925ff41fac63c6d564889558cf2b55e3a123f37df5f1b2686cb6f17aa776d31
MD5 5554bcebea08c46a0030d4fe411f02c4
SHA1 5f1081bb25b74a7be44f5badd3ccd1a5025e2e9b
SHA512 5fe3a909515fbcaa5a5441af3d09faa356387a30e23521a7c7b321df245ea44e4b40abe76658dbac2ddfa7e24c78bccf8d41771f79ed51a02307e21f26f799a1
SSDEEP 12288:EolIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:Eol3OSq2PEIdADeU9jz
TLSH
T14EC4234A287603CAE15384B34AD04394D4A9FFBBF9C0EE89DE80B545757CFAF625105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 9ddddf5ef54310bd1987b1780ff7e969fade877fc41374735ec56c48b799f385
MD5 79ac6a289df21532c6f19b52c14c7455
SHA1 a194e2f298dce382c365ac1dbf43d2ddd996ec0f
SHA512 8aa5f9cb50004cb6e00edae97553267b51d98cc5525d1730b3d8d2629ba19a7d32be04c5825420f1a144be11cf0d3388196800c08d212119914af6465a185381
SSDEEP 12288:mRlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:mRl3OSq2PEIdADeU9jz
TLSH
T15EC4234A287603C7E14394B34AD04394D4A9FFBBF9C0EE89DE80B545657CFAF626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 e0feb531b720ce5a99bfdc2a0e3ed68bfd108fe1eb59a9edf718466c9183e4c2
MD5 b716ba11ac1acb90ab3c71dc0d327b1e
SHA1 53800ef144a6df7c8f18b649778d3f9b11dd5f30
SHA512 b196488d37768b89648195b3a8639b54693e3056d51e65f71dba013fc31aeeb6b6daa21a4223516167c166d5a356f6f374c147902517d99baec96308d7ae61bb
SSDEEP 12288:OglIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:Ogl3OSq2PEIdADeU9jz
TLSH
T1F9C4234A287603CAE15384B38AD043A4D4A9FFBBF9C0EF89DE80B545657CFAF615105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 63b68bc75be20de882f40718691ce3f98b07d8f6bd8892d67a1cfdc885bf308a
MD5 97e92921f67c1f2683178512eed079a8
SHA1 33abfb1528bbf383384b64879f6fcded42ff64e5
SHA512 b56a3be1aaaa62dbd88f596358e37c25ec88fcc0de1da2a16b6598ae991593be4d3a7413684befb4fd6ed43e3ba7b5b370f8750e314818f6d8feb7204700cf8a
SSDEEP 12288:vOlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:vOl3OSq2PEIdADeU9jz
TLSH
T1CFC4234A287603C7E14394B34AD043A4D4A9FFBBF9C0EE89DE80B545657CFAF626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 28ad92fbe62e5f7079ee6cd16fa2c6a3b43b86c79f50f7c85837f85991c4031b
MD5 385c2a7ba912379f2933b90b8fdedcb2
SHA1 4b8a31aca7acca50c974b8a04c6c56fc1ef8e090
SHA512 c47ffa6941c113d6e41d77704fbb5ae63794f2b2454dd00cfdcc2795690ed12c9227bf5ca80cb195cc12d7fe4f1623b28da7ee28580dfeba01ce53fafd3af022
SSDEEP 12288:m5lIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:m5l3OSq2PEIdADeU9jz
TLSH
T173C4234A287607CAE14384B38AD043A4D4A9FFBBF9C0EF89DE80B545657CFAF615105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 c687cf866588335e9fb30f8fbcf67636ad5c02293fa71f1b16b86c8e1ea0daff
MD5 975ba8cf5d8f3343fa1b165d7df3852b
SHA1 fda9bc2046c8b3164ef93f1568e0a78bc0888f3d
SHA512 f69b8bb34fc2c983757bcc023713460b45e9651f2c84a0ed06346aeb287b1b62a580296426b78cf8f3ba847fab8807ae5f790fdbcd94a54adb867ef81260e5da
SSDEEP 12288:DOlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:DOl3OSq2PEIdADeU9jz
TLSH
T1D0C4234A287603C7E14394B34AD043A4D4A9FFBBF9C0EE89DE80B545657CFAF626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 7b30cc2ebf22bcea76feb704430d3e0508684349037f5913512331b50c3ad438
MD5 1c998f3b054e590e1681a93361e96171
SHA1 8397eefadc5828a0af9d9b663c822301e8709a25
SHA512 cf35f30e4064ed4ccec4c808891f8d021f28ef523fe6be0791991bb9482949693b0344eb4c7e2fbb9fad2b37af5d813ad4a37f2bd0e780dd10a0a7eb34011b57
SSDEEP 24576:BfwvOk9RX6wkyAIcl3OSq2PEIdADeU9jz:tMnYIcUSqHIdADeU
TLSH
T10A35D029EBD804E5E1B7913C89F3460AF6B178691B31C6CF129663AD0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2e147284da0dd42837581266e146ee4bb57e9cfe09f759d6f09d721c6510aa36
MD5 2b3014628fae46f48049e650eb102a33
SHA1 68c9be63691cf49638e90f79afd8422e3d49dae7
SHA512 f0fdb68f338cc5ad8d212c7105d215cbe70e3e604f6c800e073e586c4b19897c126f3065a46777e2d9bfdde6c649fb33897b5f8777c2faf1e643255f62f8bd69
SSDEEP 49152:hYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0FUSqHIdADeU:PySzPCHIdAr
TLSH
T155066C56A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5fc23226c6542f0ba5175e12b53c0956612af9c49d65e34894cea4449777a87c
MD5 88af1a51c73db4dab3ebd5dd824aac85
SHA1 4125d4940f1f7a45cec200bde8e6eaa010bfe82f
SHA512 35e72cfe3a8dad772a89aea4fd53fc6d68b78208bf96d19395257e2e41bcd038d91a3382b67d89f963eab3a10ccbb9d8c2503e0ebc07c4ffdce76eb1c47f359f
SSDEEP 24576:O47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYXl3OSq2PEIdADeU9jz:O47JUQjairIhCnDHUPfF/VUSqHIdADeU
TLSH
T15765AE1EA3EC01D5E1BA827885554A1AEA71782E1F31CACF1270937D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 f417835d2766f85f0b23cd5b1168b4886581a19015505f0fdddd94ca36decf95
MD5 cca8885d773a6f047637fc449ad6db97
SHA1 da6b51b40a36b001704fc3e54f11ca73104ed22b
SHA512 66def3680ef47c1fe6694eeb6f06425b7276a04b3671f77ec1c15c202cc0d2467027d82646162eeb61cb63bda4031c504533cd5e7af45a926e6d365ebea6b014
SSDEEP 12288:8ksfYlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:2Yl3OSq2PEIdADeU9jz
TLSH
T172E4010AD2A402D9C06F6176CB914240F3737D6697E0E7CB56C0F53E1F3AA95AEE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1004KB
SHA256 fdddb735e5c8bd7a5c6edeb37c335bf84cea973c07d3a663abd54737bf1802c0
MD5 36e285149a2cccc4375b71acac9957f3
SHA1 d2a4ce35d4f2bf62cb636737c802c5bcfdfde1cd
SHA512 091f4546067bb4fba663b1667a7ef56a75fc5945d675dfb050738ade53257be70c2fb3bad25cf505fc24a9382e8b707250e8d13913af2c3facf76b45bcbeba13
SSDEEP 12288:HOFMzpU3fiiHGXKZcbxcJ15jKRueO8kO0xESrr:HOFMlUPdYKd1NKRueJh0xE
TLSH
T143251750766BD75FC6A940321E33D5CCAB707D05EE05AB0372C8872FD57666CBAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 e7a625672a59b0fdc05524a5b3d97d4fc04d4c8f37f33fbdc9b22195a9ab68c8
MD5 4bbbc63cec15506af5b50e63139fc79d
SHA1 8df20a6044e51f8752b45420074dbee952103406
SHA512 4c7c18c6d8f03227d44ebaedf3f09cb93d05d478b2df7d6e5cb37d533f321f526ff0b4bd3433d5adf7366eabb2d7f86e0a4ed2b7d22c749bd17176fd7a17c312
SSDEEP 12288:P9mEdcW6cn9RQq7KtOJ/KXMu7j5ccAhPAME:P9mEdcW6cn9RQq7KtOJ/KXMu7j5Is
TLSH
T13855C581953BA3CFD1F72031076A5F4DA764EC06B2095F66B3C8053ED86AB25A0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 69474efc5658dc6bb2c96246dd2399c7b645660f91b5aa64d218eb93889008a9
MD5 ea7e9dd25144cb48bce048cde28edab6
SHA1 fc1e2bbf4b1c9d5e678553eca6cf5f98ae54246a
SHA512 86859eccc7f6410233d30ef587c46c57d7836649910699f94bd3400bf0c3cfb084017d4a130037b91cc808160439ddf387c90b5a4a5046c35556c90fc335d08f
SSDEEP 12288:KM7QlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:nQl3OSq2PEIdADeU9jz
TLSH
T173D423062A750686F16354B249D48274D06EFF7AAF80EEC7ED40B589643CFDEAA7110F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a3227ab22f1c2f7c2bf51f3144b232cd00e8f263242c44c759f22c99143e7758
MD5 a1771dc3b8ab626d7bc997eda63c68bb
SHA1 54999ddbef2fea2e97de7ec4a9bc5b1d06cfcc0a
SHA512 11930d94a5f44a753830df2f60132db8fd919c383f2f9f30fcd54a2941e3b0f513742db4da3be8b3399be86ad0477eadbe53021e32bef25b3a7d2950bc7884db
SSDEEP 24576:ggb6bmBIi49WNNFpg1rSvFv7bYCl3OSq2PEIdADeU9jz:ggb4mBIBhGFXUSqHIdADeU
TLSH
T10565AE1E22EC02F5E0F6D2B8CDAA4417D6B278161731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 419387e3c5a77ee8bca2f973285309c15e33584de070b93554f14894d75b7caa
MD5 f34656d6fc96c89d140a575b8d78a7d6
SHA1 1e9cd8707be8f7c29c5b3ec2d48fc001656a4084
SHA512 efd873b02a72ad0ac28ead5b6fd9471d15be01653e3ad20c3e2ff4a12dfd525a8c5b25c565d95b4e31b3385ec5689c18f88fbb99b5214e0faed65a9863791ad8
SSDEEP 24576:oG88u8FpJqH1nzria7/mHl3OSq2PEIdADeU9jz:L7ZFPqV6a7/6USqHIdADeU
TLSH
T15A35F16576E102F1D477D0388A824663F6B2B8251360EFDF07A89A511F33BE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6b9d492e2d0a22bdae360c55c0d5c0d54e803b68ae5bac3dff45a218ccd2fcf4
MD5 03bbdb987b1a0ae82b465795f2704b27
SHA1 bc1ce31830b53372db57106a1f3824698ae3ad27
SHA512 f459fdaf95c22a41adfd42e9ca3f32529ea06049785dc48b5d2f64c753f11a4b790f392bb151f27a7a80d54a66008343392823f6e51160e98be48f3ff25393ac
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzUSqHIdADeU:oG05lO43bHHIdAr
TLSH
T191D5CF6E62EC11F9D1BBD17CCAC6460BEBB23825032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cc1f1903d6a40404a20839ecd49153fdc508baab174af19e7bc6bec4e7b32aaf
MD5 7f537dee1774a0c419794c6855329860
SHA1 33b28902620ba5f92c4df678610e06e2821e861a
SHA512 a7bb9d7704d6088236c75748e7c5601d55b56a831853a041546e43fea27bdac8632571ddc77f74603ee130905bbed532a2b05334b69f049499f4632773e2ef38
SSDEEP 24576:qfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnFl3OSq2PEIdADeU9jz:ia5POZ3hJt2pasx2+mbUSqHIdADeU
TLSH
T1CD65AF5EA6FC01D5D1BAD17DC583461AE5B1342653319BCB022182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 564561f91b6c2a5ec57e4e028e1e2c463b08158dfb5097e064d1af6e1aec340e
MD5 780b582af31494c326e38b6701ab6232
SHA1 f1caf06843f82549ae3b98d5c0f865b9a4fa6c42
SHA512 8c04efad01a85e4686562559c0e475cd8c2ce81c4363e42515e58dd9d982233070bfd26a0640836e610a65ae01007bd4e7806dda062bad0b71791bfedb0a1fa4
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7FkPl3OSq2PEIdADeU9jz:UNc/zEOVHFaUSqHIdADeU
TLSH
T1F7857B1623E901E4F1BBE1BE89779546FAB1786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d11f1af665b5cbd81c58e700da282201c7ea7ae69946090d518a512d790c1bfb
MD5 2259767ccb9513ad55cc79bc35244e1f
SHA1 21fe4d829b3a4bd9a82614253ba6228bc2920416
SHA512 22ea7166db34a353b53592274f28ce801a10bf8b8dcb31b82b369a2e6ddea6be51126e8cb696b6996272a44f0ba068a3ffb030e883b4d3953f0784b463787cad
SSDEEP 24576:k3kNvNnaFeYhJNtmZBm5l3OSq2PEIdADeU9jz:k3MwBtOm5USqHIdADeU
TLSH
T16755AF2E7AB806E4D1FAC6B5CD238112E6727861173293CB5390C13F1E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 3c5c6aa46b462e291149d0f1880285b36ba7c98751e37f03ee470aef55d317a7
MD5 823a24a596284fbe5c1a47be4f306c22
SHA1 3619da70d60faf6144a086d6c408baeac016b0b0
SHA512 9b0f192b5cb0366e1a1880fa4509be6d17d1cbbbe5a973ffa3c20594365e516ed595f529970465c53c75ed77af947f81b9194c37e2f2369b952c60f59aeca979
SSDEEP 12288:0HvUrBFrEjwaQDlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:0PUr+NQDl3OSq2PEIdADeU9jz
TLSH
T15005F11F22A818E5E677E17D89818319E772B8621711E6CF02D0917E5E37EECBD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 c847b7d967da8ee560a667232784524fe4a06a45285a57d7c3f9856ed249e46d
MD5 b10e60749c89a986bbfd7914fa9286fe
SHA1 d30672b5e4b8ca20237dfdfe16986dae2c96768d
SHA512 4bc2931e8249cc4f411cd585bdab2d4f5b2328d305a481ecf2ba1d40f19d9052f5f78fbfdaf1662c3fd5667d2593ad196a207ab13593909eb0dd0d31f98e76eb
SSDEEP 12288:TQcMxWDXN1Dp/fshBItT1IQgAklIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:DD3FHshBIYQgAkl3OSq2PEIdADeU9jz
TLSH
T1CA25E13EE65C04E4E57BC1BCCA938606E67178A903216ACB06D091B65F7BFE47D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1216-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1216-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1216-369-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1452-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1452-102-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1452-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1452-365-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1452-108-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2152-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2152-135-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2152-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2152-133-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2364-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2364-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2364-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2364-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2904-293-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2904-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2904-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2904-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3308-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3308-22-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3308-14-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3308-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3308-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3460-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3460-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3460-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3460-96-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3460-90-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3460-382-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4540-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4540-116-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4540-122-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4540-368-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5000-314-0x0000000140000000-0x00000001400E8000-memory.dmp

Download

memory/5000-310-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5000-9-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5000-77-0x0000000140000000-0x00000001400E8000-memory.dmp

Download

memory/5000-0-0x0000000140000000-0x00000001400E8000-memory.dmp

Download

memory/5000-1-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5236-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5236-84-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/5236-79-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/5236-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5452-39-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/5452-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5452-45-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/5452-47-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/5452-50-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/5452-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5880-73-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5880-67-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5880-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5880-308-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6104-378-0x000001DA27D20000-0x000001DA27EEA000-memory.dmp

Download

memory/6104-400-0x000001DA27D20000-0x000001DA27EEA000-memory.dmp

Download