stealc | d03155b9b6f56dc0dde5df5854a635b8d1f064d8ccd82905a89a128c74cad9d3

Resubmissions

10/09/2026, 07:14

260910-h2w75aga4810

10/09/2026, 06:04

260910-gsxlvsyhph10

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 1.4MB
Sample260910-h2w75aga48
SHA256 d03155b9b6f56dc0dde5df5854a635b8d1f064d8ccd82905a89a128c74cad9d3
MD5 4673725f1adab911f8089538b2a4e694
SHA1 6049cc237b5ba5bbcdfd2cc5adf5604a1dbea280
SHA512 e92a94845b015b0847db9a637a80bee20f27729d748e2a20df0f0b45b10f71881f7777670710d3f3835e932f9bb4f4dab1416456161a8f001b7ff8eb9cad9979
SSDEEP 24576:c09W8T+KfIGI9pZcTy045HbJiGGC5SYCTyxknw4FYnshx8OfVe247:c09W8jG9pyW04ZXzx4x8EVep
TLSH
T15765AD2DE6A801AAE06A9136EC554306E7B37F15137186CB33A0766A1F775E0CF3EE11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/4268-87-0x0000000140000000-0x000000014017D000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
1788	elevation_service.exe
5784	elevation_service.exe
2644	maintenanceservice.exe
5912	OSE.EXE
260	PerceptionSimulationService.exe
3944	perfhost.exe
3680	ReFsDedupSvc.exe
2400	SensorDataService.exe
2100	ssh-agent.exe
1736	AgentService.exe
1320	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5e476758d744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\java.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f46f6754f440dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b1c9213f440dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000035c98254f440dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d3d6513f440dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8bcd813f440dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000954dfa11f440dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000bab2414f440dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000faade312f440dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049acf412f440dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009525614f440dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
1788	elevation_service.exe
1788	elevation_service.exe
1788	elevation_service.exe
1788	elevation_service.exe
1788	elevation_service.exe
1788	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeBackupPrivilege	3680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3680	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1736	AgentService.exe
Token: 33	1320	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeDebugPrivilege	4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4268	2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	1788	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 4312	1320	SearchIndexer.exe	99
PID 1320 wrote to memory of 2768	1320	SearchIndexer.exe	100
PID 1320 wrote to memory of 4040	1320	SearchIndexer.exe	101
PID 1320 wrote to memory of 2964	1320	SearchIndexer.exe	102
PID 1320 wrote to memory of 5604	1320	SearchIndexer.exe	104
PID 1320 wrote to memory of 1720	1320	SearchIndexer.exe	105
PID 1320 wrote to memory of 692	1320	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5784

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2644

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5912

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:260

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3944

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2400

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2100

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4312
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2688 2808 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2908 2868 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2688 2808 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2908 2868 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ced161d911292fff5f08cfe624a28ed9f4cce9df4b740cb5d84ef8a15a741355
MD5 a36c2aca78018cab077884868cef19fd
SHA1 38f3c4ba74f4689d89fc50a86059a660f5a24fcb
SHA512 081041cc6a57ea8e5e233950b7e115764885e2b356d9e5093d1dddd17542259925837d6a80037426109b41f045f67157b2a799ce8c902d57f23a9571829d5521
SSDEEP 49152:3b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnUx4x8EVep:l3q6mjB7ix8EVy
TLSH
T1E8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 f71bf4ceb1b179abe813ce867e950a7451fb94caf8632a94061d7c14671c9776
MD5 6f7fc718f5eac80fc8a1b0e2f67f3d6f
SHA1 0033021b3f9851ea46b605608fbc14100e5421bc
SHA512 dab0c3420d7e64fd42e3e5d289600406379f57456573752e316937f4dc459babbd13d51b1215372c1b1734bb6c2e7dd4c052e22f2ead3bc972b5fe9008da18c9
SSDEEP 12288:D1XLsswWkxy2lRq2czAc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:ZXYfDtczAcyxknw4FYnshx8OfVe247
TLSH
T19B75F12877D548F9EC6B8139C9B28112E633B8554770E38B03F4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 ee97a97e41b3680dabdef355b554e8052b46d2f4e4206e44b7a4eae773d334f9
MD5 690be7043fc7df1adb439f5ae96dfe3d
SHA1 7b39644bfa3e11d53d692937e1a0b1447929e6cc
SHA512 761efb63333f13b96c1e37b9692a7feb411c29a03d0c2fba5a23ad22df7048640e248b98b0f2fe0cfa9fbe500bf029cc8a333c19d422697ff0c53d3fd62377e7
SSDEEP 24576:T0Le5ji0hmxSrMZyxknw4FYnshx8OfVe247:TPji0AoZx4x8EVep
TLSH
T14595AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 70fa6b0bf0d7de4d235736df8b1da1e604353a0864d4664290c1a4bad7107331
MD5 4910a15d3e9f6890af4beafe5ef037f0
SHA1 774c56bac593d858a5e5dd47d747012231486077
SHA512 8f32cd769e93508f9cd7f0fb5879dcde1c20971dff4c0dcfdea11269831dd7612fb8932d728c0cd0ad1c5fd12adfdb5191e0f366a4601f0bd5acd6541db25981
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWj6q8wyufyxknw4FYnshx8OfVe247:h/ezSC6vUzPv+Hjy1x4x8EVep
TLSH
T155756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b74bdab0a40c2135bf3a7ab591e8e1a34d72f396f171e2e6ba303f4f4b89610c
MD5 b2eaeb3cbcb45b35061c399298f03506
SHA1 b8f6d943dcb0ee437ce5124fc8157ed60b5cdeda
SHA512 a0850ff688ae674dcacaa672277c3ff39c1ee1b902b54b1be19f42a8b5585b0c7fa4b28b9a0683bf8f948134e78e9dd05df05409b44e2a34885478471e5ce80e
SSDEEP 24576:EVbqPb88hv/l+BIyxknw4FYnshx8OfVe247:EVO88hXl+5x4x8EVep
TLSH
T13A559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 0bed76635462a25c60d13db0fab1bfe08538015d2e2232662634b33dfd23d1b1
MD5 c66be1527455bbef4b406fc1b578edfd
SHA1 1057fbfa7ddefa1026433d1bc6cb94b78de1d8ba
SHA512 a0678c080229163b2a76a90d07e6e48fd711950469cb40bbce4d9aca4d1191c6a165044422d755ddbb72151c1ee79b31cbe2cce097474d001396f0a6338e6c3b
SSDEEP 12288:xal+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xalyxknw4FYnshx8OfVe247
TLSH
T1366523BCABD9E4E1F65E14331A7572223605BDA0DAB4C11BCB78B54EE4B0C54E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 013a88b242c3f0d23c86845b5b14b7c6de7f2d45a25a95ff11a9ebb77780e616
MD5 2960c7d7401746a15553b1fbdf0286d9
SHA1 f9ec9d6d024a4e01b007a3dbb276c102c36b7177
SHA512 a264f68d1dfdf0b377cf0864ddb0fffe9fb16716cddb33128e3623ede384cae7156167c335b17615e7943365da13a1238a6d3aa5f2695d02d0b3662aab147d23
SSDEEP 12288:LeBNUbTVO86UQ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:LJIUQyxknw4FYnshx8OfVe247
TLSH
T15675CF7BEE28FCE2C27E5DB95B918200A77274704B6193CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e445ba9e53283bc7b8ff986bb2e083113e3a00c03d8e530b1e49e4f0f5eb0f87
MD5 a8992c53d066b40b61a4e7ad7826741f
SHA1 b14790a8cc892ed0a6d89307f452619c5097ae4d
SHA512 3833a4d264effafad2af95912ad26d730a2e2e558b4113a338a285217bca937bce31eaad988e97c57b8294c0f5be058a366ee9a045877206434f675b3f71da10
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THL:IQvGAdlCEL8c/WRNw5C6ix8EVy
TLSH
T145267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 9c220047a378458eef95975e38bad926efedccc07f821949edb28167ebb3930b
MD5 8e328f149eb2541f5f9aaff274c06d73
SHA1 0b28284eb8b0a2340acf98ac39754d9b6cb57978
SHA512 fea5e2a57ae2b0c414ddc6579e014632547ceb072e35dc629b6912d7220f8623dd4e51e1dccf55ef58c4f67a417192700667861ad27600ccc97a7fa7b11f8fdf
SSDEEP 12288:CAwSfxL/2Dc3zDLLmt0LDQewsAjW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:H+ewsAjWyxknw4FYnshx8OfVe247
TLSH
T13185E030FE74E032C67F0DB21B36D716142DB9604B611AC3E3F89A9E99705D2637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a60a976705e92aebe9f8ba6caca9afdef75acace106b3c3974d70ed3695009bb
MD5 c849ad7d0f2b8cd1764b6e8b50303136
SHA1 e7aec37c6b0170d41c064e74e57c85fe8ff690c7
SHA512 741bcddab4d5c3b4b7dde31d29bd868a3b87e6bcc2c90a452a6016d843f59c387411e6d28eda2a61dcbdb26cacf5d0746e368986bde6d6e5667bf38686a70159
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHs:xUEtQevvqc2W1cpV20I32
TLSH
T137474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 284577f3abfb6215dc75094fbc5786fa7c38d522227886205f231069413e5a55
MD5 582280c7969d963aac2af4b171437e2b
SHA1 0e285804e60917310c8059831a1aa6a85df01b31
SHA512 0fb38a52ba2dce0330084add4055e5df5c305a616c76a0206cbd2c93b5fbaa8317398c85bafcb8bf8c9f27ec2cdc437ec805e9989ee01ce6228eeffee85d2c0f
SSDEEP 49152:lCbRquA/m2yL5zLfFiV+XenmE3/zpx4x8EVep:yoq2Vjnmmix8EVy
TLSH
T1C3D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 52402fa90ab2cb384dab393ea73a06260e768886a8b0170536d6a4091cd49614
MD5 d16b861ad47981232dd57d329e331431
SHA1 1b97bd3768a243a35ab809d0695dd497677aa676
SHA512 8227903c0032a0e407ec97ed3960c8d8319612fcbbcc90a6eebdf91075d3409ff9f34e130550d255bc13cf7784c842739f65b73e1c3147b3ea6a1253074e44fd
SSDEEP 24576:iAhGL6IFoiwtA5l7S53Dyxknw4FYnshx8OfVe247:iAM5Foiq5Wx4x8EVep
TLSH
T13335AE80EBF955D4F5B3AA7899B69171EA76BCA65E31C20F1260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 e4c2048bbdf7c6754ea7e8d507c2805718a472bfaa1cee0b0072c52ad172a029
MD5 e59b9b12a73ce9d925ab5249a4448387
SHA1 79bd3e9485f89ad548386663073d499eaef4b669
SHA512 5487b55fa5accf843a959f433ff6d2c98f87fed298310d3e825d83874c6bf2f1dffe55087ceb096949a914b0680f5ecba0aadfca7e8faeda261f26ae5460c0f0
SSDEEP 12288:4mw5HEjsChNrBFgl0WDm+C/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:1wumOW6yxknw4FYnshx8OfVe247
TLSH
T16675F14977E81CF9E96741398697D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 a29bfa29b6d24faf48ae118c2ff0183ed96bd4d413b6d8f310c7695fefe5fc00
MD5 76a89419a9037f296562b799eeae436a
SHA1 af88bbad059028167cb0ae061247dab2c710e39e
SHA512 cfa32911aef6ce545c2eebaa1675012c1c0c02bbeeb9675f1021479591296c922eb50d844b83471b58c6f6acc4c5b7d13568364306cf6c41d14a16b42c229ee3
SSDEEP 12288:9vZ1IyG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xZuByxknw4FYnshx8OfVe247
TLSH
T1766512AC33E860F1E1A7113A89F15206E762B462677183CF4768625EAE72DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1c3db6418e68ac17fa92e9db0db037f09cef04595b30838d0904c79276794448
MD5 b8e62c871c0ec3f15cc924a7e019eaec
SHA1 792d8d711d134a03a73303ff17121855bf797095
SHA512 3ff2cfcce0e7e9306b215b30b086277e3e10cc3b3a18b41b009107569a4fc731d0e3ccba6c7f73191e50eadec5a9c7740fcc56f256656f228a57a995592dc2ee
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U/:SQRQyi36YOcPDLvw2gAf+PN3fix8EVy
TLSH
T103667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 87408b3e589b79e003d791778965bcd1aa403d13318a73ae541b884c5c3b76e2
MD5 8c4c60e73dd20e55f615ed8501ac5522
SHA1 2a5b00c6ffcf7c7141f06ae222954e1dd8d5cfe3
SHA512 ad0e830074b636aa8b1323f97fa8163c50337c27fef199aa1a531bd53f4a0eb93099a715b73cd1be752e851a79112c1d72ab526a230ec66adfe01e3166db7419
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U/:HQRQyi36YOcPDLvw2gAf+PN3fix8EVy
TLSH
T10D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 60f54ae628272e3c23d1b3a07b26ec239aedc72f859bbc58897ede600ecf05b0
MD5 2fce33d755daec245a542380ed485647
SHA1 c1d83aefc886db16a850b1c87db6146593a505a0
SHA512 0bd7a08c9e8e78a0f942f1c97e6cf197a2ddbef26d110b87d028546f816943bfbebec7667a85f28456be0377ddfb436dd373eb506f0d0092c91e091d8d41bafd
SSDEEP 24576:zwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0Ryxknw4FYnshx8Z:L68Qg55nhkeWu7PNU3/Zx4x8EVep
TLSH
T1D6B55933B2F600A9C44DE1769F4A973196D17C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a83a81d70e743f8882e08d62de1b2bf97b540b93e03e48ad2cbd645316de194a
MD5 aefb624ba64ad1f7429b794e95908ec2
SHA1 4c7c7563d2590a4bcfcb438da76da9bd810b575b
SHA512 34ed749f8033c5d7f6ebe22b8056a9547e6ef5abf44ed6539132b45efd419d83e969a26e31c5f7dcf91fceada7970a6db223b5acb4f0cb25a7769007e5130654
SSDEEP 49152:U3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99J:By5112gYy5azzVvU69nLKnhZwix8EVy
TLSH
T15F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 764ac44475c7fac3934d96a31df869fcfe203964e83f93c69e9b0bcbcfc14237
MD5 1e5bb2a414ef05e0a4c96a9c42745725
SHA1 81c32e45e48e04dc8fc3d3070b5830899f6a0696
SHA512 8b0a4981c06016933e29e66fcc39005314454131d5f7faa21de55a2f77f25ff0fd40aa3e4a736fbafd11962969fed9f12c8f36e9910e08edbe9d2d42ea49fe44
SSDEEP 49152:AB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glHx4x8EVep:au6JmIxd2dHix8EVy
TLSH
T18DD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 16c20969e694421e6d4f78ac4787ac9ad1de7ba07d7bed030c05751326370d98
MD5 8071035c1e73e0e1878bbc2205b2ebf7
SHA1 fd03c2cb1c66008b71634fcac3639b2274cd5e53
SHA512 75590005820802857ca7e21b855ffc56f8eb709cb2525a228b63cecb0f94089c64879f894ea2be455a091ca1c1c57f3072823214317faa71e2eb0919c7cc7322
SSDEEP 49152:u1hpsNoJpF1A67U44CwH7R4xzx4x8EVep:umifPqRmix8EVy
TLSH
T15BB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c746bfb3af90da362724a7fbab620837a4e1958c5cb5f56dba9fa9d9f843d649
MD5 0df2a2ecda6c7369b63325517229696b
SHA1 c7912ee073c6875a126241633d379d1612a06fa3
SHA512 47d3df07037831f24bb3d4d5da8ec2a29b169d2bcd2f6b70dd108f9a234a7a7ef574b0a182b346ed20242b96f363afea07c96e1768f37dfe680f7c736d6f1d73
SSDEEP 49152:0SuZQIY0Be2KkRVtOnks6NMHqEx4x8EVep:m5dKqi61Eix8EVy
TLSH
T115C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e113ad539e17a2f6f4d41ae4a72ef6c5eaa4eb47e6a36ebd8c1db1f74b37cfbb
MD5 e94a5e81c9a799d62a09ca4260b193d6
SHA1 5dd9d9ac9961522dfb64eb8564ea362e6288a0b6
SHA512 ce0ac54e56b83aa3bdbbd46d39d23ec08afa783ba956a5906b09b620143ac1cd913318c66916853c6c5f94ec8feba50485121b1d0c009b6fa5b6982a56ac60f8
SSDEEP 49152:6htSn8EApI0figjgiDn0AP5w3x4x8EVep:7X2iWphSix8EVy
TLSH
T1EC95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 9bf9bf97a23e737a5d0026b186ab1b6f6978c1762c4610af9b611374b899b939
MD5 0e312849e78ab0dda3557546d1d36d56
SHA1 ad66f1b398428295e2a36bc86b0258b5a69a6593
SHA512 e66964d5bb48d5d083d43a98a024b6ab7803d9bacd0443beb5ad89443ec0a5fda867030481060d226f86cf1a993b7d51e0785e830684e983deeab08b90f51556
SSDEEP 12288:xN+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xNyxknw4FYnshx8OfVe247
TLSH
T1EC65237CBBDAE5E2E50D11734A7133666609B5A5EBB1811BCB7CB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 316dc2a6fb35cdfa2c76e92e12b183b8706c6d213200b26cf506f9ae0fd8d523
MD5 f4892329dc89f01c947f732c11de6ca7
SHA1 75a4a26cf78153cc6edd4ac22a5feb3ef8ca5507
SHA512 a72fdd1f02bf10ba28a359a2149733ca784690004e178f8bb2dd60cb8e41156d7c613ff2c6de5867cd5861a3439a73b133c9b3348617aad0f3d1ca01443247d8
SSDEEP 12288:JS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JSyxknw4FYnshx8OfVe247
TLSH
T19F65237CBBDEE5E2E50D10730B7172666609B5A5EB71811BCB7DB00EF1B0C94A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 cad40934e9ebed8f0e247ee6b7d46a9865b377dab60e89dccfda4f69584cbbe0
MD5 bc9b721fe490a4bf0050e81cc7cc3642
SHA1 914761b2d5405a0125fb3750a7f27dbbaab8cc68
SHA512 ff43c05cc12062eec8d2a06668cbc645f12e081630addd1d6fe798fd5c9aa6fc3ffe3fcf674ed60451bbfad62e70d62ea1d9c1d6f7c25d08d364979a6f23bf86
SSDEEP 12288:FY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:FYyxknw4FYnshx8OfVe247
TLSH
T13165237CBBDEE5E2E54D10730B7133666605B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 6369c84125b456fff354a2dc0cc0c0c0961295a10b3687b64c21e3cf1ee9e6dd
MD5 b1b77a94ff3e39f1860be45eae181345
SHA1 1f98483d2de80069bad23693534d30ad83ab6769
SHA512 51dbffd2f1da67a7fa6985ad223ee28450b88b71e03aca2a964b0f0d9c08f0ff81a0c49a799ed4e22e681f41d234dcb0bfe5c2d486912621eb3e3ebb02443c00
SSDEEP 12288:8Vj+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:cyxknw4FYnshx8OfVe247
TLSH
T13065237C7BEE90D1E45A51738A716222B365B8E4E731C25FCB24740EEDB0894A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 b635f364dfe188467f898473fcafdb4c7b22b0ccb69508e54f77f3ed27d9d781
MD5 5b899469140232779d22eb5a5e740ac7
SHA1 ea51240dfd989f8cc30866fed264dabd31990680
SHA512 3ce68033e8f103701bd272270585aba7032dbc9fa2becf2e270ed1ff1479261b9a4c6e5c02c46d7ab3a7a890860e8e26ea9a52124ddeb498fe5e216792b38494
SSDEEP 12288:kb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:kbyxknw4FYnshx8OfVe247
TLSH
T15065237CBBDEE5E2E50D10734A7133667609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 8b1af6c475db720bfa29da0ceccb3fbb621c29817e2fe9441b47b866f466cf69
MD5 a54cadfa3aa468755c344e46e88acf34
SHA1 853199516e664edefa07a753ce9de7b1b3f15987
SHA512 ef287b5e0f9ac0ac10366d2e878c1a7bd2371b74a690a589143af35074c3207ec948f9d0f7fe42c38bf705be9ee80043ede5dda3dd66562c7307a48ac904f9b6
SSDEEP 12288:Re+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Reyxknw4FYnshx8OfVe247
TLSH
T14C65237CBBDEE5E2E50D10734A7172666609B5A5EBB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 15377b663556d2dec183f526dbb489d17b137807cdf9fe38daad7f8263143520
MD5 92e648dcb065d2f26f7fea907a250440
SHA1 770ef60033c517665604af3a040432ffcc74f41c
SHA512 bd9ce8bd96f449777765e734bcc7377531e11eea5c3142a899ab9cdeccf90eb34b62de6a5966db5708bc73fcd9db6a4742eb430d7df1896b70c7a013a61bb9d7
SSDEEP 12288:UK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:UKyxknw4FYnshx8OfVe247
TLSH
T1C465237CBBDAE5E2E50D10730B7173666609B5A5EAB1811BCB7DB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 b8c77935838b0e6314a394e2d3b1bcb5a9129fd1672aecf7f2148336086f8f47
MD5 35e29e3f3fea3350193d49fbd9979472
SHA1 08a4bb65d0dd66d60fe454a8d01a186bc7aeff3d
SHA512 5343ef3f1fc1c4c1d1bb4e1ee564a18b54568eead42facec723b34c7ff339028a3f34db4ece7fd877913f021dc694c49b1f00f3264a50ca20f2a923bdb1db96d
SSDEEP 12288:ziZwbyzzFEoS2cPvyy+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:eZMqzFVSOyyxknw4FYnshx8OfVe247
TLSH
T1A57502A8B39018F4EC67413ECD259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 4570040c96ce30307d4dc8aef094f6ac09efaaa97842136ece1e1437fb6e3f7d
MD5 835f7182c2348d9880c96a8fb577f99e
SHA1 dcf18f502e67b17bae0a4f4cbb3e8eb3361bffee
SHA512 2b812e95829094997d1138286defaa66e26fa7149924fc7b2113ee879909bfd136c61737e35292edf0b19dd5e3db47f3f8712d82dfcf0f5074ec4ce91760249d
SSDEEP 12288:nx+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nxyxknw4FYnshx8OfVe247
TLSH
T1CC65237CBBDAE5E2F50D10734B7173666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 cba7be250895ebabae2f1f4ca338902b72b999f95601086d0cbdab77d893d549
MD5 63b59b128c43dee35c409f0e3a9539b0
SHA1 04f185190f9dd8bd168cdf4499e9e25c31be9447
SHA512 efd6967f7d8b36a238ad4be48f85b6de126c4a82a6dc071844a165afa3dff8cd76c5c753635fd482c0c4546bb0974d41fdcdded8065569bca260d56dc75b5b2c
SSDEEP 12288:5V+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5Vyxknw4FYnshx8OfVe247
TLSH
T18365237CBBDAE5E2F50D10730B7173666609B5A5EAB1811BCB7DB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 1459f5d66b7f8223f56915bbbdac500f52078a6d38a21b3be235e68a646b1072
MD5 875b527208495c68ec63653b750c632b
SHA1 3588759fbc9ce0c4b47a9d4c2276a4bf65f5ca8e
SHA512 a66142c235ee78aa7fc3e96e2f4c9a950520465e1af32b275d9fcd9bdfd18b3b48e340292a3ba79f45ede07589315efa0532d1f38c44efa3f97aa3c55aa3e33e
SSDEEP 12288:3yPz5L8G+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6zyGyxknw4FYnshx8OfVe247
TLSH
T1A975125B73E530F5E13A523689621602F772B8724B3086AF87A4537E6E325D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 62e4b8ba9e0a5f6cc71c15d30bab2302e9afb51890b4a42b4ebc48c6f9408a90
MD5 04192272f3019cca2cc5ffcffddcb146
SHA1 1dc565ddf4499eadcac9456b7577ced8ab0c10a0
SHA512 e5e162f3dbef5cb4d2abab07ecc1ab9f0bdb9a14283837178eb0ec56b405b943b27940c02d2ca0be7f2104e506e9416857e9a1adbc6fb94a085b59a453e7c641
SSDEEP 12288:5x+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5xyxknw4FYnshx8OfVe247
TLSH
T1BC65237CBBDAE4E2F50D10734B7133666609B5A5EAB1811BCB7DB00EF5B0C54A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 729e719410238b34f8869a720331397e1757f370df0c1d525ad3ee14b72ce3db
MD5 5ef90fcaae1cb08106eab2f3d7965654
SHA1 296c1a588b515e0591e160dc2a1d1a985aedab24
SHA512 8721198e3df3cc947d48c6e1f33f162d833db7574d94585d19711799f47b6a8a6911f5cd9126852ae2ad31bd154b771cbd877f2ee2bcade2072974d8ef96aadb
SSDEEP 12288:mx+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:mxyxknw4FYnshx8OfVe247
TLSH
T1B86523BCBBDAE5E2F50D10730B7133666609B5A5EAB1811BCB7DB00EF5B0C54A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 99c95cb7b34c7cceee3db0a1cdec4f4f8d810e426483478e3c4eda798d9115dd
MD5 73134a5ef6ead0af53368f015dcc5ece
SHA1 5fd1b20ab6c854a757026a92b60a9ae4bce7eb1c
SHA512 ec3f08964464f7c77dcc77a26f58177821d69751327a1a8d20ea481f2bf810d3a52090fe49648075e1f04c71969b27533c7e8d125da2bd5ecaeef4bffb8a7f75
SSDEEP 12288:nyPz5L8G+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:KzyGyxknw4FYnshx8OfVe247
TLSH
T1D175125B73E530F5E13A523689621602F772B8724B3086AF87A4537E6E325D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 0e0d5c60230d22023df80c00a9911c31347d7b9121f4a5f5cdceede84b8ba88b
MD5 991e700d7eb2c98b8051faf10e1a5575
SHA1 c23f15a41dff592890df85888bfe4751ffb90f29
SHA512 94085fe16014a233f0224377b1bb53ae83d0da7abd24370cb1f948f23fc6bcd76ee807f8dba517b3cf991ebfc15e495afa51fda56be10c9a56b0a19e3cd0ec99
SSDEEP 24576:NTPaLl3z0zDoyxknw4FYnshx8OfVe247:NTSLljKx4x8EVep
TLSH
T1747501A8B39058F4EC67413FC9659516D2B27C6A4770C21F43B8362B9F336A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 24eabf3d87628b3745e3cb6553d8b63b3416d1c0f2c05c084872e64aebbf823f
MD5 51549101da844cd0ef58e4af1a5b7594
SHA1 3fc781e9af95ac9f0fd3fe29e36fe6a21c8e6324
SHA512 751ae9747ce812df95a1d32765f51836f00a38a45ff96ab9e95031ee24f9eda74bbb71cc610f25a83ad7729477fbf2f8e5b8687862409a487e3eabbb2c0cf422
SSDEEP 24576:u30d9CHKy7GZkyxknw4FYnshx8OfVe247:w0d9CHKyaBx4x8EVep
TLSH
T17E95DF90F3E410E4F0B79A358D765512DA767C9A5B31CA8F03A8661A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 ca7d0c6ce19917fc50b562d8e64c5dfdda950b85ea13ce4cfe4f34629589cd3f
MD5 4de3e9b06dcadb3367213dc1d5d99dee
SHA1 5b2bed3e21a6a70d61368a0099522fba68ddd3b5
SHA512 e7b7a23c7c796d028d3981d83121376b106daf0d1e9aae9a90afc832097384ceda81b6c367f8d99f5a815359b77908a226470996645258f02cf15cb69240ee80
SSDEEP 12288:N4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:N4yxknw4FYnshx8OfVe247
TLSH
T13E65237CBBDEE5E2F50D10734A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 d7ff6f9e005cb30bd86d5564fff740c893f951ab23bc3ca85960ef96d7af7d9e
MD5 f5315795e8fd8d1c0cfbe9d2e659f9a2
SHA1 2180a879e84fa1ba69aa84f74956a298ca11cc93
SHA512 9c76ecf51e8d8e3aa32d9a0d920d9c263368c963af8bf18a8a06276f01677a5e6e45e0905e7f98da33468bd6d2993e9ec895e3d0b039a560fc35347b85bda354
SSDEEP 12288:ym+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ymyxknw4FYnshx8OfVe247
TLSH
T1996523BCBBDAE5E2F50D10730A7173627609B5A5EAB1811BCB7DB00EF5B0C54A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 770c91cd8fdcd21796a7804efb28eebddef35e2c2dd3ed7205dcb7786d158b81
MD5 074d2e1cb4a197aec3c85f5b470a6a5d
SHA1 d27b3432f549a3261e12cd625dcc3613c1806e02
SHA512 3ce26531ddeed33015c731db7b5013f1ca5afad59179d2dfc364c2c84b9447b630a6e138963073e5556bf01ba6f9bb3e92adbb11b4fe3b2bdc260230a4f4b977
SSDEEP 12288:J3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:J3yxknw4FYnshx8OfVe247
TLSH
T1FB6523BCBBDEE5E2E50D10734B7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 6ef494838ba8f76c99ce704fa05b372c96fce40620ed43669014c79715b13128
MD5 6f45be6fd7d0ccab9132f970127f8e1c
SHA1 34a04a4a30fc7c11bae1d88e499b84a3682bff1b
SHA512 ebbf1d763f22d7f095603a451d7d852ebd291c35dac4b97196cf2d1d0e5cc7e0e073cae975a5d748e146114014e18645ae6e764fd2cd5bf8897d8f5ffbb6d23a
SSDEEP 12288:Lx+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Lxyxknw4FYnshx8OfVe247
TLSH
T1F56523BCBBDAE5E2F50D10730B7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 d942429476bcc6cde88a15f3db5ef6ca37f363be8803cc0fb19a1496f2da05d6
MD5 de346941435d37114a6028d65c4dc8fc
SHA1 77491cfa1e514d65d8335dcde50af4d98ddbf685
SHA512 e3bf57bc483dcdcb6c4c9ef06a828aaf888d5ff983d9181f9dacfddf7c07d81c69e7b9b3735127e3d1dd9ccc456adb408d6dea104779f79bc38c6f099b7b324a
SSDEEP 12288:p4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:p4yxknw4FYnshx8OfVe247
TLSH
T1BC6523BCBBDEE5E2E50D10730A7133666605B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 e01e2b1a058188684951874badc19e6c6fff2b40d5cfee050b0e13ca7944bd1a
MD5 7f6e711be35b255cfb9586b322334efd
SHA1 668650248bf74ed64f471f27c5c4118f0e4bdc9d
SHA512 92cacdbe6964e923e29cce2e2c38e26e5f2fc6bf70cc8c723966626df29f73acbe9ca67e66dec874548185b20dfd5dc16d2e082de91f4b5183ae62cf2d021396
SSDEEP 12288:Gp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Gpyxknw4FYnshx8OfVe247
TLSH
T14665237CBBDEE5E2E50D10734B7173626609B5A5EAB2811BCB7DB00EF5B0C54902E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 73babb73df00a598c0618daaa5a7dffc23946c179f8dd47b29ea28c35cec52b8
MD5 3d9578388057cad467ac021789f9f49e
SHA1 9da9cc6ebdccdb7d57ebd7145f8ad6d57ffd6b53
SHA512 5cbc8ee60cd89240f123c8e19beeee50379d2f335b1f0ba0a1b1654d82cfdfff0cd6bdbfb160d4d02b7132fb8aa31840278ae48e654c50345417e3ef35e62e03
SSDEEP 12288:Gb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Gbyxknw4FYnshx8OfVe247
TLSH
T15465237CBBDEE5E2E50D10734A7133667609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 f864f5d3e6c360568ed804ae9e9438915437bb96f373832da4c259d3620a8f66
MD5 5365857f7b079b8ed418a93589bf4625
SHA1 3f03ec2c72dc76ef1649190a7c32f824af915f2d
SHA512 f451a2cf579034a8654fa2ebe80ac9d9ee89c48a79231c1e779cbf23f01de31330631e1ebd670ff889de14d5d4649c82ac98a9ad39de2de5b39df4626a3b507f
SSDEEP 24576:lfwvgk9RX6wkyAIFyxknw4FYnshx8OfVe247:HMnYIQx4x8EVep
TLSH
T15795CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7a9e0011b0bb64eb94aaace7cfce66f81158db7d4953c54dfd5d2ffd575e4bc0
MD5 9385e850b4206e1fa65d7bdb6d3274d5
SHA1 30e262f9f0c360617b228253c1eea5b41b5046ee
SHA512 69323d7a85384fc15e668f5172e83b9ec9b15520f0ae6e014ef34a875a37a31c2a144f3c308107d910be5f15f94929f70f82b374b2fb80b50a9ceb33f109e689
SSDEEP 49152:uYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Xx4x8EVep:RySzP/ix8EVy
TLSH
T11C066C96A1A841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 87282d778cc2a7b5aab2fe66760f7c10b49561c6288bc524df00bf38e5b77e43
MD5 e0e5381ebd3ea6a2acf6a6441f1f9d24
SHA1 27bbddb859f52c8685b340907c9637303da7a8bf
SHA512 7f09d3c89f38f413d9b53998cc4a3f6519a1d05b3b53d34bd670826231875201fd22b874317f866f597a561cbcc0a90cdcd9da53ac5492fe673a24437f7bd1f8
SSDEEP 24576:I47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYiyxknw4FYnshx8OfVe247:I47JUQjqirIhCnDHUPfF/Hx4x8EVep
TLSH
T14265AE1DA3EC01E5E1BA927885154A1AEA71742E5F31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 d118cc148b2c8a4f24c522d9f2cd9fb182ca87c786e479d27c31a9bf0eeca008
MD5 6b1b2d450b7d8159ebe16879d77c8aa3
SHA1 e4321ef2fedcda53fa2217e22dd84f666d8aaa29
SHA512 a70af5d9bd77d5c700ec94bb0e1bfe585da6b3076dcdf64a71c51dac113c0f39c7377744611be148c3edfb18dfa5f3426e75472f01eb01cac01768c0c35c917c
SSDEEP 12288:e0sfB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:0Byxknw4FYnshx8OfVe247
TLSH
T119750128E29852E4D06E2176CB625641B3237C6597F1C3CB87E0F53E1F71990ADEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 93c0732ccffcb5e44187a500eb3e9c5c0974ba7d9b82b80c2ab12589f869774a
MD5 7d1c6b41cc613c2d6cc0f3cdbf8ece4a
SHA1 d84e0a91698e0bb0b1abe42f0693e983793a7b90
SHA512 25d07fbb57d77a5948d0d6d22cd45581c382c23b66fbd6dd02eff597dc7bb5d5648c474a1ce51802ba2d17608d37e3a6f32a9698c262f3207f6aa33232add5ec
SSDEEP 12288:gJ8V1cSU3f185MQj9FrVnT4DUSivD8YMbawLL7pVmjq:gJM1nUP16M8rTAYJEXvMq
TLSH
T19D452951766BC75FC6A940325E32C2CCAB707D45FE44AF03B3C8873F9576568BAA2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 fbc79f923f1c18bc3a96f1237c9564af000f129abb4bbcc68e4192d59fd5e080
MD5 f520e966e63ae54d7e15b0afd70304b1
SHA1 96dfb8197519b47ed1e54c9c421008e5fbd79a83
SHA512 abf9496feb3424bc0dff04daea8f30371b1ce65be009471930cd03dd2af58721814f33623a1d4e8011469a8294fa8c5bbddbcac52a8b9abb2504a48b1d6547b3
SSDEEP 6144:dXElagkDu7tBGRMYIWWxkwKkqV1KziZlPrO5keNVJIxZdrjHY58XUiUbNPetMx7w:dXElaf3btTMyqY7VEK5PGm+jMgfkWc22
TLSH
T124751A81913BE39FD1FB503203295B4CA7B4EC07B7456F16B388457AD86BA25B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 6a0e90a39965da05ac12aa69fc67c18d7f49d46747cc1c48f00561f6d91940bb
MD5 f4522dbea9566fed098efe30b46149a0
SHA1 c9fb20fe560ece4b60832dd4191c97a7aab14186
SHA512 7583a54d3165ce443cfc702359c22e332cbf13d827d4fa7feaeded40247e69f5008e6589427e5279babadfd092f3f572a48a1873ef9b80cc273793f87c68c4d1
SSDEEP 12288:vR75+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:h5yxknw4FYnshx8OfVe247
TLSH
T13765237CA7DEE9D2F46D11730A76A221360AB5B49B70C0DBD728B14EE4B0CD0987DA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6879431f0af602722ce7dafb072268e0dd32f4e73741aeecc5f9cd6152c30aff
MD5 bdc29028011d47fed7ec2b1060d6fe03
SHA1 81685b81ca169b240a329a6023fd2f176674f2b6
SHA512 a237998260bcba4fc9456fccc1d8a0db02782f4700061250f6ae3f6c8d9a89abd81b7e4ed0920b893768f6bd52b663b6ef2a3a92eebfa8f2624af09250af01ab
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bYfyxknw4FYnshx8OfVe247:zgb4mBIBhGFdx4x8EVep
TLSH
T1EC65AE1E22EC02F5E0F9D2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 331052edb2858179392e631500ad440ecaeefaab60988570d5d0d2436d6194b7
MD5 33dd3d7417c53ba433b66f60b5889fd1
SHA1 cff60d1d1ad791798d099be817c41f16fdd9b192
SHA512 0dc750268ed4eb08757299b881cf9c80e59fc49fcf452d137f5284a0d5d05ab404cbf92c5cc2bae24812cfa2eb22396e329263d955c0363bd976863353aaced3
SSDEEP 24576:MG88u8FpJqH1Izria7/myyxknw4FYnshx8OfVe247:v7ZFPqV3a7/ix4x8EVep
TLSH
T10795F16577E101F0D47BD1388A924663F6B2B4250374EBDF07AC8A561F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6d797bd39087f10f359e98f600b46149d4d78dbc136ff3aef6acbe82cd6515c4
MD5 15f182769e8164f634ffdf3c2bffe2dd
SHA1 f143fb4682cec5cbbcf3958dbb78fbfa77e26ddd
SHA512 b953e6f834bb4a215176c903f24681ca8d77d32ded6098e6716d7b2f86ea68b70a23f3092b13cfe01a04c968b8467f4d1f63afff807bae7ea8b709d0bcb54431
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRx4x8EVep:OG05lO43boix8EVy
TLSH
T12AD5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5436edaddc84116e0922172ea61bba452fff3cf6532c23ec21429b7e0e0f47e3
MD5 3afc4272e46ee4b0625fc9dd44e1b036
SHA1 bf36c1156ff10dfa0e38b615732f9a55a05dcdbe
SHA512 506e8f9381665b111dbb7987dee7d743f734947a1ab958bd99f9f3cedcd540cd957180ad026d9c2a61567f4f500b04334700339d8f0ac7a15b47ca53a529e949
SSDEEP 24576:Lfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn8yxknw4FYnshx8OfVe247:Ta5POZ3lJt2pasx2+mZx4x8EVep
TLSH
T11865AF5DA6FC01D5E5B9D17DC583461AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 706ac0f56e3f114f53a93b4b29c215bb9df6eecf10a0f3a9a76afb6eacff1440
MD5 d653d2b164fd593623ee0c256e2e3fd9
SHA1 712268277898d29db0503b3d35133516e4b1f4ba
SHA512 602209075c51af03283d3bdca6e2f8ed8afdba354f0f24616e03291f2f909e74f24acc0f5a09432164d98a37c2b049d34af8b5f5dffe68ab9220a268eaf0a85c
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7Fkayxknw4FYnshx8OfVe247:3Nc/zEOVHFCx4x8EVep
TLSH
T146857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 625e62f226cc9513829a1f2bc74ca71e6fe6e57dda645ea06d94f1a0a0759d0e
MD5 797dfe82bbc8a789227d604a693e16fe
SHA1 5f029a36f520ef89f68bbb1d6d721364ac010def
SHA512 accffbab514e3763ae5c97ae8a146147e36b81ea764ffd858f753fd5e9464e550d0a2acce2ee836ad6a54d279b4faa605398809152bc2fbbaa3b94a99a22a892
SSDEEP 24576:uzkNvNnaFeYhJNtmZBmAyxknw4FYnshx8OfVe247:uzMwBtOmDx4x8EVep
TLSH
T18655AF6EBAF846E4D1FEC6B58D238112E6727461073293CB8390C13E5E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 204cddea2449cc98ff95e26598b334266df118165e40e81c77d65d5db95d008a
MD5 52a79f0c66748d59300e799285623b74
SHA1 1b6d57fbd1f0793eee0c4d2413c7d3560ba2ac10
SHA512 f2f8fdfebfb04691fe3b7045f9cb3866a65a8a56c8a1023fac83e77cd42362a8f454d207fc4bd59ebe3091d31cdd7a082e20913a57de1a7a2fbeef6de8e96f71
SSDEEP 12288:lHvUrBFrEjwaQO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lPUr+NQOyxknw4FYnshx8OfVe247
TLSH
T1DC75F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 7e3d5a49e391bad8c6587d227cf72ff88b163bf0d72ae0c3a52e8476a3290f5e
MD5 2537d42d6a7c45a8887fc02315bcdd0e
SHA1 471e4b44f2f7145258fdfd592de72e498def6a18
SHA512 1a3de075a4d6fb1ae36a61d80b4656f181abad9c19258150be94e10ee244c2d9c3f245309ab41c96a99ab692cc94c2165a1185c348b3b76dbc73004feb36dfdc
SSDEEP 24576:XD3FHshBIYQgAtyxknw4FYnshx8OfVe247:XDVHeBIAAYx4x8EVep
TLSH
T17E85E17DEB9C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-305-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/260-65-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/260-73-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/260-67-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1320-144-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1320-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1320-150-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1320-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1736-127-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1736-134-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1736-137-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1736-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1736-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1788-15-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1788-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1788-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1788-22-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1788-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2100-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2100-315-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/2100-121-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2100-113-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/2400-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2400-107-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2400-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2400-313-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2400-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2400-101-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2644-52-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2644-40-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/2644-39-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2644-46-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/2644-50-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/3680-89-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3680-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3680-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3680-95-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3680-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3680-327-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3944-83-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/3944-309-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3944-77-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3944-78-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/4268-1-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/4268-9-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/4268-0-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/4268-87-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/5784-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5784-133-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5784-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5784-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5912-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5912-54-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/5912-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5912-278-0x0000000140000000-0x000000014019C000-memory.dmp

Download