stealc | 00cacbfcfabf4aeed4461481381a943ecc3b571d54d5874a6ffe59fcb1f2be71

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 934KB
Sample260930-jdrheayckd
SHA256 00cacbfcfabf4aeed4461481381a943ecc3b571d54d5874a6ffe59fcb1f2be71
MD5 d4e9d4833c82ba43667bd32a939f63a9
SHA1 d7285dc90aa27f8e057ebd008e4ca341aebd8525
SHA512 7472b44526041135ba7920d32d880a7e39fab389f706f3dcbfb1106a4a27db68330534cf1a78c74c2f53756a61c41ff528583c1205f3c9e14d060a679143e888
SSDEEP 24576:09ED+ugR9q+dicaamo0sCBxbtbNQ0jJ+9Ms5T:0OvgSY9aFTtbNQ014Ms
TLSH
T15515F11AE79454FDF1BBC138C9529E06EA317C4E47A1A6DF23D44A921F232D05E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/4636-78-0x0000000140000000-0x00000001400F0000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
2448	elevation_service.exe
2368	elevation_service.exe
5872	maintenanceservice.exe
5468	OSE.EXE
2392	PerceptionSimulationService.exe
248	perfhost.exe
4980	ReFsDedupSvc.exe
3600	SensorDataService.exe
5412	ssh-agent.exe
3464	AgentService.exe
5800	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
	\??\F:\	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\97e859c267fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063f9cd4aae50dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037191d4bae50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010ac180aae50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a95ad4aae50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000532a210aae50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6773f09ae50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000022f69a08ae50dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095c05909ae50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	3464	AgentService.exe
Token: 33	5800	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeBackupPrivilege	4980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4980	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4636	2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2448	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 4956	5800	SearchIndexer.exe	101
PID 5800 wrote to memory of 6128	5800	SearchIndexer.exe	102
PID 5800 wrote to memory of 2444	5800	SearchIndexer.exe	103
PID 5800 wrote to memory of 4916	5800	SearchIndexer.exe	104
PID 5800 wrote to memory of 3000	5800	SearchIndexer.exe	106
PID 5800 wrote to memory of 1380	5800	SearchIndexer.exe	107
PID 5800 wrote to memory of 4336	5800	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_d4e9d4833c82ba43667bd32a939f63a9_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2368

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5872

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5468

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2392

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:248

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4980

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3600

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5412

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3464

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4956
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 2768 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2576 2584 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 2768 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1380
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2576 2584 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 03f5f7d86ee95eb010b8bf39ae14f5b42af7f362c5dcd429d6a76387e1522728
MD5 3dafba91a54bb6d3b65b85d8ce2048b9
SHA1 59786e038a365970a75853d78fe37081826ca07e
SHA512 24ca39b5aa4ffeeab1008b6a14c7a20659bf37f85270fd78f9dd227a1bba9dfe23893a36d2f3ee88125160bde7cbf336dd4756a8354483ab910b9743229b7edb
SSDEEP 49152:zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn6Y9aFTtbNQ014Ms:R3q6sjB4aFxq0CM
TLSH
T194D58C03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 e0e9be27ebecdd23159926306412199f025d3d5b828e367b691ebfd2d7cd60d7
MD5 3654e52466e71c4fb444f5a8677f7a01
SHA1 ac5638960bd06a0f36c7ab3f35e7167466a49df8
SHA512 5be877fdd833753b6cd10fd854f5f225ca2126753c048d5a86dc6384bdf25a5ff4516698a3882170815349839553f4e54f7ba60723edfbdb42643f05b13fc2ee
SSDEEP 24576:eXYfDtczAV+dicaamo0sCBxbtbNQ0jJ+9Ms5T:9tcIY9aFTtbNQ014Ms
TLSH
T13B05F12963D448F9EC6B827CCCA29502EA33785547A0E79B03A4D6654F333D85E3EF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 3ef27833a22281d29e1d846faa6e836f3230ed635ac7f25c7caaef822833b1d9
MD5 b661e9e89e94c72792486ba1b4372c3d
SHA1 79d54c986d821a62cd4c766dde10fb912cdf9ee8
SHA512 7ee38267836cd7aa3bce60c68e30543c3fd163e8caf1a2c6c17c33845f39f31087d72f2be5172c164fb6255eb6844b7f7c6edb6170d9bae2d37c473622d3a059
SSDEEP 24576:Y0Le5ji0hmxxrMS+dicaamo0sCBxbtbNQ0jJ+9Ms5T:YPji0AjvY9aFTtbNQ014Ms
TLSH
T13B359E16F6748335D073C0B9C5D2A68AED7230855B308ACB4286D77C6F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8263dbccc09a9bd0eec206f7a1a74468792b44791af08e0c7eebcc9173657cb6
MD5 919e7b3a5e59f733e05abf9b6ceb1934
SHA1 d52a8b2337e5535e3ec5944525a6290c4268be77
SHA512 410a25ea6634d46273864c8967ed53df049911bf06adbb44f7c777ca25aa941c76ac96e8752b18a68aa2628374edfad8ea1f222de2d95f12e50e8845084420bc
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWn6q8wyuY+dicaamo0sCBxbtbNQ0jJ+9Ms5T:U/ezSC6vUzPveHjy7Y9aFTtbNQ014Ms
TLSH
T155756D15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5fc21626c17f11e76ccfc2dfc637ab6e4e7a1f111919a98d4adc8aebc8951606
MD5 93cd3c897683ef8b0c0b290d9bc597b9
SHA1 a1d34b7c4c0efc931086126e93e9e19c6e827923
SHA512 dd83457e7b0bc699e9f838abfc6aff8a774963e1547dcbf4310c251f2a01e04d3f143c79c20eea8cd684ba205113ac0b7863a904480f4ea0fd2a5c642640f76d
SSDEEP 24576:YVbqPb88hv/l+YZ+dicaamo0sCBxbtbNQ0jJ+9Ms5T:YVO88hXl+AY9aFTtbNQ014Ms
TLSH
T1DE559E66F6748331D073C0BAC4D3AA9AEE3234415B318ACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 ba6a4faaed3702eb37fddb9141f12900cd0315e0ba32663435c3eb094008dcb4
MD5 7585e01635dde33d236d0db3c5127ffa
SHA1 6fdca9f04e4a001eb442926d6b80d6d101f1fb11
SHA512 1e3f43cfa19c45a456769361b16d622cb6ce6eab6489f3347759c69ac9a905d40ef12b2fcd2453f1cfcd80c05c5e3b05c012ee155e8e1e20033eb8d473137b33
SSDEEP 12288:ALlYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:ALW+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T128C423938388E836F16E813484F7BB874C3A5C687C85A53D4628E786CB767CA5D4EC47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 51974a06aef96c38978abf38f2a1aa8efd2c5c2cbe58eb1b62d99de5e2e23134
MD5 615c11cbe244e869dcd149596173725f
SHA1 0b397d89568e13c4df2d5683023f6d19bbe1c61a
SHA512 9610c9a021a34d8816fdeac9e9e1a3e4acaa12aea453496e7cc783cb62fe4f3c6d8f6e4239d1896832b94cf3ee7f14884e0759e76a214ea9cab6ea05266c8f98
SSDEEP 24576:VJIUx+dicaamo0sCBxbtbNQ0jJ+9Ms5T:VJIUxY9aFTtbNQ014Ms
TLSH
T11505CF7BAE28FCE2C27E89B85A9186409B7274304F52A3CBD165C30ECE235D55E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b0ba37b8736821691a3cb36f6bcc4c7ff9612d74305b5e4d0e58d19bcba93e45
MD5 0aa6350c7bf11b6aacd431c7a17cd985
SHA1 8a11d9aaae2fa90ca1cd6a240e8606b61c3a024f
SHA512 4bac90cecf6eab54a2862fe05a92cd9e46c27c49ccdb70766044f2850a91fea65e60fe5a7ea66dfebfedcf00c99f98219ba54271df5094f483693a1d437d4445
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THe:MQvGAdlCEL8c/DRNw5CbaFxq0CM
TLSH
T16B267C656BF880F5E0A7D138897AC6B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 a8bb1b32a22cb4a2ce9289b08bf4a7d2a35d94263dc503154824975ea96cfb59
MD5 644b73d8a04e32d01c02f44a5eaa2216
SHA1 2cab579589531326c696e904c6b1b0e07635175a
SHA512 a867b3a1752207ac933cd9466845abf192ceef86222bc3f0f98c2c25f4d7899c3a9a17d682dab8daeeb9573ced83950503cf7acd1f7ecd971be06428c71ad727
SSDEEP 24576:20ewsAj/+dicaamo0sCBxbtbNQ0jJ+9Ms5T:nlj/Y9aFTtbNQ014Ms
TLSH
T1F815E031FA74E436C27F0DB61B36D716183D79204F511AC3E3A88A9E99702D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 af7532d8fd12c982c245d308bb865a63059179f8181de02746db69f096de0241
MD5 1f1e54c21361707d548d22f41e0458b6
SHA1 4863fdbd2dd534a4f733c02af40f4fb98adc9554
SHA512 0e55b6710df558eeb836edf0a0afcfe65fc227bd096c6471ed17fbc0d53b5a79b1b11fc48e251b9b55b24bc668bb7fe9ad2ba8adc9e24efffecc8be489759d0a
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHSafs:gUEtQevvqc2W1cpV2tI325fs
TLSH
T17D474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 77287dc418ed8e9750b237ef79c1e784d858eba3207d78dda9575c9d4809e726
MD5 f959a7e8b717bfa7c314a16066d5383c
SHA1 f0ac4f07a5e729ed3059bd4a0408526a1b3e651f
SHA512 f5123a94e298b97465e70b80752b10020f3fba858c5cdffd16c2fbd698a5e76761d87ad104853a39d988b0ae493025497d23cea931771ad756e0fcc8ac5b7d8b
SSDEEP 49152:gCbRquA/m2yL5zTfFiV+XenmE3/zfY9aFTtbNQ014Ms:poquVjnmfaFxq0CM
TLSH
T1D4D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 05f372296c120ce6c018a108d4104b9b40165ff550fe08fae3d76a402eee2b05
MD5 25ed0f98754186a2eb99cb72284a3b2e
SHA1 7984068e87f46fa6c57a2fab2a56bc62a12c5300
SHA512 1a448f6427dfda0351dcbcb5c2a55e1e6ebee0e1f4a17f8962f680452180be4985cd934088b0f11c5573b2420b344554ef18f5b6d7c213e80c380bccc16e0d42
SSDEEP 24576:sAhGL3IFoiwtA5l7S53U+dicaamo0sCBxbtbNQ0jJ+9Ms5T:sAMUFoiq5EY9aFTtbNQ014Ms
TLSH
T12835AE81E7F955D4F5B39A7899B69171EA76BCA95E31C20F2160C21F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 876658d0921b3d27e115c6267ebe8bbeb80d3c8ae8ef3f2c48790ad4262eb601
MD5 b7f4093d76d54fa9dfdd25481854c5c1
SHA1 c91630c071458d3dfebbe8f3715351b7a2be4110
SHA512 22517d6dd61ea16c21b7f176cb6818b6fb47e1893f3cccd11d74348036d7776d1c2ca5194ff9baaf0247578073c683d18d760f73564f088871ed137b8f0d3191
SSDEEP 24576:Lwu4OWb+dicaamo0sCBxbtbNQ0jJ+9Ms5T:LwvOwY9aFTtbNQ014Ms
TLSH
T13705F14673A85CF9E56B8238C597D536EBB2B8112A21D72F0360C75B5F333616D2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 8d4555e9eac10450a0487a971c96bdc30f2735fd60f67295ac4c99f0cdd6db5b
MD5 ad6b4855f8962ad64cd2d0bf700c6b37
SHA1 94ade463e534f41248ae347af116ca261f247e1c
SHA512 fe1f58a5310179f9df0687e6a558de5b405f1fef0d05316c7516cb46791f9ff42a0f91fa1f0f0b3969d5814ca84183a6b3808ae98757bba9233a1d466cdf485c
SSDEEP 12288:oeZ1IySYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:5ZuK+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T16FE4129623D8B0B9E06B823CC8E26746DF327465276653DF062483965F73BC61D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e21769f2110dceaf44487afcd1d9a8cf7304f7c2f4ef851bc9a49a9ad766f134
MD5 878862793a69f35e8f4a124119007026
SHA1 88e642958dc361c5145f2d82dcb8b9ce795eb30f
SHA512 09923bd64b44fb64e0e67b38b8f556433c6a45166ce6d6dc5018a8521c65f9159bd4edea43f719a26ee158c0c631faa0ee4122a0a951313d2a90ac9cd1db9114
SSDEEP 98304:2QRQyi36YOcPbLvw2gAf+PN3EaFxq0CM:9QyiKa/X+PN0afs
TLSH
T1BD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d03bae8ae7061026aabe8e5e1be75a6a7081c9b4dc922c3891da0dcbdf8f6e91
MD5 d1ddba6e36863f5221360d0e5baa7adb
SHA1 580fbe4ecea458d374b60cccc39589925a81d1b7
SHA512 fd9fb17a444f78ab9315fef2f93f378686a080b08240e044de9ff5c99179a3c93219f61aa69a66aefb872a0715d85a2cdf6a1c186fa4a15b7dc20ddf88648165
SSDEEP 98304:BQRQyi36YOcPbLvw2gAf+PN3EaFxq0CM:YQyiKa/X+PN0afs
TLSH
T104667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d07c951fbbd2aa3b67ee1639e7cc841472aae9f554f3deb282cc71c3652cb831
MD5 ecb53bdb48dcc1f54678a2198f680190
SHA1 2740545674dde2280a4eff62287cb8434409811f
SHA512 295a4a99114e398de44410cd0df043368dbfe56d68607ff87848a7617186d31ef934ba38da39fdc08848ebee83a82fca7e5785c73842e8c2e6950c8744827e50
SSDEEP 49152:J68Qg55nhceWu7PNU3/vY9aFTtbNQ014Ms:XthLRc/aaFxq0CM
TLSH
T1E5B55933B2F600A9C04DD1769F4A972196E27C758FE0E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 71d273020045e36218267926d8c0a84b2fa022e54fd64f07428f8520c305a9d6
MD5 2cc76508b5c2ca66341fcd5f5a30b22f
SHA1 815149fdffba123b8a73f3fb6cf56d55e858487d
SHA512 8487ab4d0a1744081e37414f2ef02c9d69a15ed9074eca77e7dc73e08eee4e8ad528e966e84a7a320a8815808ae328972a7a159d328e764143881173f40dff23
SSDEEP 98304:Wy5112gYy5azzVvt69nLKnhZdaFxq0CM:HLIHEWhnafs
TLSH
T1B6167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d77ec7e211a249a808d59d9a1e69774d297d8acd147fbac44cd94247001c6a44
MD5 1d3c6ed4031bda02be68d732f99816d4
SHA1 e5a5fce53220d55711ce69b8c95db780654772c8
SHA512 a5eb49b68472c5e9df602cb5ce3da1180b5b2cba9695606165f4745a720f075fe3d49193893f359bc37e8830d3aab45eb916d8f046e6f5e76b413aab11708c81
SSDEEP 49152:+B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glFY9aFTtbNQ014Ms:su6Jmdxd2dcaFxq0CM
TLSH
T101D59D13F1DA01E8D06ED078974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 68091d4e0738ec761446c3fceebb53f06b7d5a1e0dda36286e5bf7dd27c31ac5
MD5 f4dbb43df43b2ba3a6055ce7851723cb
SHA1 b4981c8d0378ad142f39bf88338daadc5532513b
SHA512 cad3b0a91b76e84afc63a95523ed33ee9a52bf6a41de6f02f1f28b7ee4296dc813b487a143e33703fa371c499a972a6e6fb0526fde4dcbc1e943b0801d628e3a
SSDEEP 49152:31hpsNoJpF1A63U44CwH7R4xRY9aFTtbNQ014Ms:3mifPWRfaFxq0CM
TLSH
T167B5BE13F2D901E8D06EC17887569232EA62BC450B24B6DF0A90B7961F7BBE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 79866aa2a721dba6876dce457a8b4d0dae162a93a5844d665d411bde92bdd4d5
MD5 e31bbc775b1cea4c9a8fcfc659592a66
SHA1 5ec499710d230d962139ef84423ce058f5d9b7a3
SHA512 2d583050179520eb4ac96467177ef9ed0709ff7edb315b6ccfa2860d4d0f37ed3b3d7f3ea5388909b187291ec8b93262d9271ce4f2d0eb3f8e2f5bfd46fbe299
SSDEEP 49152:NSuZQIY0Be2KcRVtOnks6NMHqKY9aFTtbNQ014Ms:D5dKii61JaFxq0CM
TLSH
T10BC5BE03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5451e40ffa5a5f59fc9d9cea42def0946303278c9524647ae18407a890c11a34
MD5 0e1988f42e0eaa3c2c9a72433124131a
SHA1 59e561d94a0469955f9f0e5329e5375a3fbe579c
SHA512 ed44a979500cf9452776b40408d55a04838dcf6ebd6eaeb1b6ebf1da9713c4536bdcb0d4a879a1a9476627d85982461adb769183be871cdcc5df85e7918238c0
SSDEEP 49152:xhtSn8EApI0fig3giDn0AP5wVY9aFTtbNQ014Ms:gX2imphDaFxq0CM
TLSH
T11895BE13F2D900E8D06EC178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 26f0a0d509e55d7c7324b018c793672019afee9507d0606ec07d7ff8a19e7d49
MD5 c5d1e19de00c1ad1b13d3ba6c2b74586
SHA1 17ba9d0556f95048b06379c1473fcb2dbeba0056
SHA512 daa33f68987f59c9eda018cb3ed427cfbccafe2335607f3aa700b3ad3aa468d6100256622e3b2db2ee120ac5ca90f3c9fde11487e0441bbad6406f80ebba3202
SSDEEP 12288:j9YLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:jO+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T188C423938789D93AF02EC27488A7B7875C3D54687C86A17E462DD342CB737CA1E4EC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 cc8cfd2e8b984494694d6693645cacf10ec59962f2a3929c01d2688f92fad9ce
MD5 1661eb5d286b449f67bdca941f3a9e6e
SHA1 461a7e05a5a5453cbfa86a15eae0a881d4c900de
SHA512 ac3241c49e150154f2ba8c5bb9a80182e8222d5501a97ece5870204eb2269be3cc26f43f12d5d8fc2bc0dd70a338165acd597cb678254c536eb2bd2f847e3ca9
SSDEEP 12288:iOYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:ij+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1EFC423938789D93AF02EC27488A3B7874C3D54687C86A17E462DD342CB777CA1E4EC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 c83f57f54733261121b7801f8bb6b388f05306a67a9c67784c3763d3ec2c7919
MD5 438f5929f715636cafe7032e2a49b6ca
SHA1 9da0d4cea0fde04c29307dd7e46eaf90cff6c85f
SHA512 56c292e12b39dea1ce907203b67fd8679831af62baf1d3261f579338f095adebc683cba23f4c14de28b9be8ee18efeaab35736a29e4aafca6e1a90ef9dce9ac7
SSDEEP 12288:5MYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:5J+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T17AC42393878DD92AF02EC27884A777874C3954687C86A17E462DD342CB777CE1E4EC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 252544fde30504caa367bbfd5a8410245c713fd50a9e6cd675dd1b930266f889
MD5 d8ffff179ca18d065ab64f4ec07b93d6
SHA1 524212bab0d651eac7fcb34c474a9c7471065488
SHA512 be27de1743bb2eb1a761d5fcc5025e6ee9cf3b9d611ff3beb60231b95a1d68dba9c348061fd5d57b8d793f3db81d59123d1ab0587f98b819f3badcda1edf3cb4
SSDEEP 12288:5VbYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:g+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T12CD42393578DD4A6F02EC278C8B3B7439D3A78687952A2BF471486468F733C92D2DD42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 6ba3d78a0eba5ced168849ded3548d611db9ed5e36f04b06e9d653fdc3b8f425
MD5 dedfe2ad330b585c504ef706f204efed
SHA1 086ba35b61313e01cb07d2889d29663166149096
SHA512 e881c1d30187215c30d42d9064751bcde7ce12cfdbd1e93de92b7bb69766924212a96d4f6f249d1c02a4236dce40e7f55506d78ef3abe410b400121b9d553185
SSDEEP 12288:6DYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:68+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1EBC42393878DD92AF02EC27884A3B7875C3D54687C86A17E461DD342CB777CA1E4EC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 3edae9093bf8aec9e339c7544d005ddf1e7d1a27a90f23fc0dbd6485e1a824e5
MD5 bbeea509c22f49cd1ab1f73fb510c74e
SHA1 a38ca8f19c94ca04d57f14ca8edea4f942064d11
SHA512 68400e6f2ceea23bacf542d39d9c63ea37d30c3ad222829210386d805e16658ecfd4db00aed094ddbca1a0350b26fcaca26b7a89b908d27df3ac602b1418b0ee
SSDEEP 12288:K6YLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:KX+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T11CC423938789D93AF02EC27488A3B7874C3954687C86A17E462DD342CB737DA1E4EC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 0c23cb0b14f5778deb829b2249106fcb5ddfe4c32efb05be3f985b552c3843fb
MD5 ce45d29f24b36719940112462037112a
SHA1 aa1eacfd991493ce8603ccf43419afce792a3a50
SHA512 4fd5c1949fc6d6147394b7b8dccafbc8c1df486a3db23b28047ec195452f87fc53699c895b004a57bfddd3b232432e927470dfbbb43fcd32e3a88edf8bb7386a
SSDEEP 12288:W2YLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:WL+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1CDC423938789D92AF02EC27888A3B7874C3D546C7C86A17E562DC342CB777DA1D4EC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 37cc76835beb2e22887568204fe2bb40a9d8f6cbc3bf4f6945ee981402185a6b
MD5 54340112a8e155d51b6457db8884cfba
SHA1 49dd34a610fa3a06e99797ca5d2a20c67c721cf8
SHA512 18bb9005c67bd8304fbe11d36a54b3c6eacec8ff20a0a734a7ce03face63e3e62b4d490b5003aec2b694c5a43cbe01e2b58c0a2b64edc8b98433bb079c0580b8
SSDEEP 24576:iZMRzFVSOD+dicaamo0sCBxbtbNQ0jJ+9Ms5T:iZMRzfnY9aFTtbNQ014Ms
TLSH
T10A050295B3905CF8EC67813ECC669906DAB27C291A60C61F03B836675F333911D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 ec5d3821443c8d200684ff2b936a8b962a6a356460782adbdca8b1efb8f3f2b5
MD5 c670acbc7cb5cd3a5b8d4ffcd174e7ab
SHA1 8537210f4ed9c95232138bd2694cfb2f0741e12e
SHA512 9aef279bb4895068552fb6d5b00b9adadc703013fcd924b1cccdf4585d90a0db43c2808ab2c0de0fb248531d76cf34576c0772a20ef21ff219bd8e240d460870
SSDEEP 12288:uxYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:ua+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1C0C423978789D92AF02EC27884A3B7874C3D546C7C86A17E462DD342CB777CA1E4EC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 f0e189e93b82c2f4301ff97e4e93147e99c9722166bfab3f2ea8f7ac68e13e07
MD5 49ab23e15e1fb7ef8bcf0dc40d58343d
SHA1 9d66fd6da7df39fba1faba2afe210f73dc1c59c9
SHA512 c7f826d9970dea0f0fd008d4a5ded5ba16decb3ca2c040883d6ef00a428e3d7e373b5e3f880a6446394cf950ecefb4e3b6a2adb90370ffb46ef87b3b2ff15978
SSDEEP 12288:MVYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:Mm+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T191C423938789D92AF02EC27884A3B7874C3D556C7C86A17E462DD342CB777CA1E4EC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 9b5b757b5ee8c0b476adb819a1f937868426f20d1f38e29ee6bb83e231efde08
MD5 e899ac6dfa0b13f2754904921da3059d
SHA1 45ea67c6910ced03d87f78abdb97462124583691
SHA512 afe91ac3ec996a3abbd068aa7dc3d1fd49dfcec0a8f15a5221821e2b4281cb8f322d0ef3afd5e1a096826836cbe6de96fd1598c3444ee6db1059a067e72e2d85
SSDEEP 12288:NyPz5L8SYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:kzyP+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1D8F4024763A570F9E03A8238C8A22A42FB3678351B509AAF136443765F337D55E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 dd5f1873e6cec6b06e14fee99fe754bd304dba936da1d569c4caf67d4a6b6827
MD5 5a27a469f815d05db84db3f3b8acba9b
SHA1 b197e6b67f9a8498a9eab32ec1e8a7a7ac1caf07
SHA512 89e78cf335cb574cd09b23f29d26d9df71e6dc546a1f30f211673416491d2e766f88a4d966acdee62a4dcb44f8fb9943a1a5b40066a55397e1a84c70ebe0866a
SSDEEP 12288:LxYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:La+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T166C423978789D92AF02EC27884A3B7874C3D546C7C86A17E461DD342CB777CA1E4EC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 5c7568da6c647915495c0888530f887bfa44a49b4f7a7f28e0eeaa7d19eee235
MD5 3cb55d9853b13273feb3e41b5da3183f
SHA1 6159f832915aca004e36376ad4cb5afd59df1ee6
SHA512 418bd5383357748551b8b45fa7be739c52593bb26c4f6236c922d2a733dbbce67a0e44e5db58cf225a44892b63fd425f439f74251d8443c1d92d2d8fb1fdfda3
SSDEEP 12288:dxYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:da+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1EFC423978789D92AF02EC27884A3BB874C3D546C7C86A17E462DD341CB777CA1E4EC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 4c4f093d9178793978e47af149538de58f735b104532658fd76c894b28954288
MD5 2dd9861fb10b098f92fe0920c74c5b1c
SHA1 9a741de24b567f0cdf926393620d5cda8b3b131c
SHA512 b2cc5be1fee1a3b6f4abbc53f9006d2646935c301ba26d2e283a786e6c14624c1816cdce1a70d05bd508d6adc0398c6f33dfd4cf195948b003eb26b8f3a23ff0
SSDEEP 12288:kyPz5L8SYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:9zyP+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T108F4024763A570F9E03A8238C8A22A42FB3678351B509AAF136443765F337D55E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 3373e7834e1ae09db8b6b55a8ee69b38451d3e027c5a5804ab587617cfde624f
MD5 30b262edba57a3897ee923f5de2b9923
SHA1 71651b918dbf7314419283d28aed812e9c6dcb45
SHA512 1812c07f2fe58c2b1fca23fbfa7f39bb0a567066d62cdf31209acac3cbf92987b95539b420d05fc8ca400bd8a770b1eaf6f075d1482912c552c54944cac41c47
SSDEEP 24576:0TDaLl3z0zD5+dicaamo0sCBxbtbNQ0jJ+9Ms5T:0TuLljYY9aFTtbNQ014Ms
TLSH
T1DC050295B3905CF8EC67813ECC669906DAB27C690A60C61F03A837675F333911D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 47afe5758e5c733491ab97f4c58588a809dd21b6f757880d9629f9d2dbaf9d70
MD5 e64dd2f22153680d578579def2262b2b
SHA1 5dba81cf4bfef109bda480c086c70d15669a967a
SHA512 b4f0a186e6e7736ee498ec86f64e0057dd5a9cecb0bac98b014d0184fc42c36f35b717ac7b1b901fd41878638a34d63ebd24436cce1a63f293953c05998e7558
SSDEEP 24576:M3vd9CHKy7GZt+dicaamo0sCBxbtbNQ0jJ+9Ms5T:2vd9CHKyanY9aFTtbNQ014Ms
TLSH
T19325CF90F3E814E8F0B7CA35C9765502DA767C591B21DA8F03A8665A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 ac2dfd8d90c27320a430b0db542eb69f512436e00f57bd124656ad9946adfea2
MD5 852f82e5d42828bdcaa4e7506c952241
SHA1 7359691c1725ae976ae7597e416f9dfd6fa4634b
SHA512 999c4cf345adda61ca6f146440946f8fe657290e8d4486ade92f2643e1a421cd062b8959f8e37529f541ad223ee079cc4a9bf4103b3ab254f48e69c089479cbe
SSDEEP 12288:psYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:pp+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T142C42393878DD92AF02EC27884A7B7874C39546C7C86A17E461DD342CB777CA1E4EC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 c0fb57921b955c91bac60dc5e57dea9208357528f955c2a9efd51a079ae2a734
MD5 a5bc9e8fba4e06e84189c9a13fd6045e
SHA1 74fa386fbe88c0010dc543656726500ae5574f91
SHA512 23e043699065f858b9f6a31db56428c804203d50d872a461208bca7bdf3b2e2278dbb18b179e88e2fe82a1270deaa57298c0122817df3cec8709f90de5a10d69
SSDEEP 12288:nyYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:nv+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1ACC423938789D93AF02EC27884E7BB874C3D54687C86A17E462DD242CB777CA1D4EC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 327c7181bba76dbde56993c26b5be13f1b13d801bd0ccaa7668fc8648ee04faf
MD5 894148eb859ee9c6c38620d677355da3
SHA1 f33281e865175b88209dc0654ed15554ba61ac98
SHA512 6e91286295c3dd74a1bf96c86ba36ba9462747b2f5f7cde83caaf86533c9324386f1c343bb240b80ba6320cfadd0cca93b09bab77c7f6991f8747baf88c46d01
SSDEEP 12288:rvYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:rg+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1EAC423938789D92AF02EC27884A7BB874C39546C7C86A17E462DD341CB777CE1E4EC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 cf2131d077a209ad02e4a6708c15294e883490982b3d88b16e5e9df134de14c3
MD5 b95c6492db71e24426830d70587f1be2
SHA1 851f2baa11e1d151c077bb99d516a97edfd66420
SHA512 c0089aaa27239d9e544b5cff99a7ed47ec3df2c65acc653db3c73ccc3e11a61fc26f53793dcc17d3a0163ca4e5a11f3e9fc4d12140b7243a1caaecf9b76e9d46
SSDEEP 12288:cxYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:ca+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T127C423978789D92AF02EC27884A3BB874C3D546C7C86A17E462DD341CB777CA1E4EC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 c6624f5d6ce26e68de16c31a2f8d683b080fa405c890e48d4b498c576c6907f6
MD5 3a971eaceda0b5917650c8e5807805cb
SHA1 2fa72d283d60ebd76ae06bd89ea669fbc3c2b265
SHA512 11ac2d675e052e6efd364900ed2b308b9a4b585b6aa776ee4811949dcfe85daa7104122929140e336b3b3e6594289838b760626026d3b36d2fdc573b0b9c26b2
SSDEEP 12288:TsYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:Tp+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1DFC42393878DD92AF02EC27884A3B7874C3D54687C86A17E461DD342CB777DA1E4EC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 ad9a15fd93f0f4e1cd7b61d71d6c49dc38382df7809c3ec42be78fb305428d98
MD5 b48510ad194a2210837683beedc7aea5
SHA1 e9052c19d8c62f3159d944bdcdce64bd98dce78f
SHA512 0140349e45fe98d803abca40070ad2a744c7b93736df289162d8582dfd8b17212ab4c75b7bcb4331b8164a756a3b4d567f76f49e78b3d513317a0d04872c78a0
SSDEEP 12288:dZYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:dC+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T16EC423978789D92AF02EC27888E3B7874C3D54687C86A17E462DD342CB777CA1D4EC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 2fef14664f6ae7e36a53325c5b56e146376e8cf85f31d929224df9b9180a26ff
MD5 6cde715bb880502b249480f595398b5e
SHA1 4d7557a1293cdc446ee267d844f68b92fd131872
SHA512 7b15c412d3aac3a84f06a251879e9ab2e0f8325d4430bdad98a7d08db89739b1ed64dbf5f959bfc1e393c19bcd0826e3807cb2bba050666460ca37781594685d
SSDEEP 12288:BDYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:B8+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T123C42393878DD92AF02EC27884A3B7875C3D54687C86A17E461DD342CB777CA1E4EC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 0119a178ba1ee89dea92bfa2dcdf4e6eb7117b35daea4558f1b99b8aa13b0cee
MD5 36cf45478fcce34047c5f10f9bff42fd
SHA1 3c6b651403dcc5f6f0cacdab72803efa626d9a8f
SHA512 72d0eaa1f925efe9f52bd4b23dd4f2d3fb9f8c83c4597f9b40396c189bf3ce215908f0184faa571869715b194b1807bc2bc0a8bf767edee8df3f17794b024d93
SSDEEP 24576:8fwvUk9RX6wkyAI2+dicaamo0sCBxbtbNQ0jJ+9Ms5T:4MnYI2Y9aFTtbNQ014Ms
TLSH
T11E35C029EBDC44E5E177823C89B7460AF6B178691B31C2CF025A53AD0E37ED45E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 df3acd4bf310dcd4ed43677b08f0f7f77d2ddee3e106d39658ba92eba46f1610
MD5 6af6e5e5d1091c90016a7282a5c010d3
SHA1 16cd0c7e2a27fa663d339e243532dd06b4795770
SHA512 b1d72b6ce0db994217bcaa1d98fde2c1a83df5a9cabb7b70bc55b0aec13f24471774d33ad06d7a012edd68d427706f35e06b8f7642d13eefbf23e48fb20ddb10
SSDEEP 49152:6YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK01Y9aFTtbNQ01+:BySzPkaFxq0CM
TLSH
T1F9067C96A1A841D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 db25fddf7d96ff5025938ee34f9853da6c0cdb744af57a5af7e44482c580a086
MD5 ef155493f44f2dde71dd528123896843
SHA1 196f8633284e5e7892645f5aa81f8f535db7b32b
SHA512 e031202a3fa06cdf5434eb95ec67930ffbc89f74b17fb797f80f881062af42043005bd4aa9e41e36348bc951dc31ea303b2b8aed65a481779669cfd8e941d598
SSDEEP 24576:U47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYT+dicaamo0sCBxbtbNQ0jJ+9Ms5T:U47JUQjTirIhCnDHUPfF/FY9aFTtbNQX
TLSH
T13F659D1EA3EC01E5E1BA827885159A5AEA71742D1F32CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 216534792b4fd82e964f1b1d1b3e49ee106672209aaafcfa01aef38273bb49e4
MD5 6ee6172d677301799076110f13f75f79
SHA1 ecc9cf710118933ae14f011fb7a5ea44d109a53e
SHA512 bc0212b5fffe9c302a3424af20420d4643794ed468c91f434d0025b9fb2c6f8d2bf0d8258147c9ac5dd06fe2c6e337750d2ce7cbfb273e22a1aeabda89f9edcf
SSDEEP 12288:ibsfBYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:ZK+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T1A7E4015AC28852E8D06E8279C7965A41BB373C2497E1D3CB53D0F63E0F766C45DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 98b5e2bb9241fb8ba48bf8d20ddeb72189c51ee6e1599564baf826ad7c8d2b7d
MD5 dbeaa9bff34721253e644a773ccbf45d
SHA1 355ec8895486db251ee68e0b9d4607037b7ed7e2
SHA512 6c660d2691806651be53fad6a999529c2e42fd5583a165fdb83321ba40a9a5b430317922dc7dbcbdd03934762b74ca9d4bed6efb0959c1650817635379613c0c
SSDEEP 12288:rTpCU3f2taHqXCqj1kqppBTGyTINfATtmy0sll:rTQUPuTCqZkqLJ3INfGt5l
TLSH
T1573518117626DB4FC6A940321E33D2CCAB707D06EE056F1772C9873F9576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 3bb111dbf26a05a0b8a2471f55dcf9c99e5583e9faf7a469e9803484d4ac488a
MD5 d94843faa140a99e83361890cdf7ed1b
SHA1 53cc7a36fc5c47ee9670e20524e31075d45ab5cf
SHA512 520ba38e2453b7f68404a13abb839e6727869da38d463345b354c02d890cb3fd4dc482e54c9af002276f19e6f3dc79e28d6b72da2f068951fd64e81670325c69
SSDEEP 6144:+R/+nq0XiXubzX1H+qnul1lCz38/Jv49U1BvEtMxLvEtMxhtGadq00G5wYrLLyYZ:+rXsxHvsv4+1Db5hrfyYf
TLSH
T17765F940A136A68FD1BB2032073A5B8CBB64EC17B7056F2673D9493AC867755B1F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 630efdbec1ab9d7bd5e89a4481e309950bbc3c634767627cfc15868c91d2c011
MD5 e5ce958e64303208bf968401cd701bf2
SHA1 38e751467caa4d40d1058ea70849c91b5cfffccb
SHA512 7ecd06333b09f601c6e9bc567d1508844583e3a24e7a093b4e3b99a6c0fdcb36fb071c531f7a38e15856ed4d6b6f41f51d077fb92eaf750fb34c84d64bd5704a
SSDEEP 12288:Q07pYLK9JdU/caakho0Ypk1B/cMbt1BNQ0jJGR1GE3Vi87EA5TRIG:dy+dicaamo0sCBxbtbNQ0jJ+9Ms5T
TLSH
T137D42393838DE92AF03E827484A7B7521C3E65786F41E0FB9519D386CB727C91D6AC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f606c18420e13f0b53e808dedf9250dca95ce91e0231ce5b05a6568ff0d943c3
MD5 fb93e26f73e93b0e72d80735bb4d4d28
SHA1 5b98d17930a6f073def6cad7a17f212905016d32
SHA512 dce5adb260be198093450bf1caf4271be93235f162d77ea48796025c1886af5edfd1058fa45b1d45a1398842000efeda06af72cdce6bd1b68c3ba35b21482af8
SSDEEP 24576:Agb6bmBIi49WNNFpg1rSvFv7bYY+dicaamo0sCBxbtbNQ0jJ+9Ms5T:Agb4mBIBhGFTY9aFTtbNQ014Ms
TLSH
T1BF65AE1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b84590982305e171da777decbd3a11bbc227145097ab0c4d616a0d024acde2e0
MD5 3d9621db169e7a934aeb0b4f472128ea
SHA1 866c4e74cecf564859236e34b2e2f376f65600e6
SHA512 0eadeeffa84b22fb57d145dc6f2f1652619d175e0e999617def888746b2cf5214b09eb51076242c91261e31520294ce925e523fa06fd84fce2033919d725b6d1
SSDEEP 24576:uG88u8FpJqH1bzria7/mD+dicaamo0sCBxbtbNQ0jJ+9Ms5T:l7ZFPqVea7/AY9aFTtbNQ014Ms
TLSH
T14935F16667E501F1D47BC13889824663FAB2B4251364EBEF07AC8B511F23AD50B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1c2562a0a5c2166191bdb8c54a462eefc2a9a6612c57e4b00224ea2e7f076abf
MD5 58ee4023d9e3cca8caa751ce983ec985
SHA1 6f589b4acfd6aba5169129baf3a86ad6acf4a889
SHA512 d74120481d1c4dc5c367f4fa69f63d73468d4d104cbb9e6ef334391f955565fb6b0274eb0e274fd4d51de99ca0e7945811148f3edd245b1c47a67aa2191f63cc
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXY9aFTtbNQ014Ms:YG05lO43bFaFxq0CM
TLSH
T1CDD5BF6E62EC11F9D1BBC17CD9C64A0BEBB23425032556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6911ac219734a95809e392712e6d23e9dc1fdb9594f5ed2c33e9d96ba9dc7645
MD5 a8e7984e9ad1c047c4b5254676161551
SHA1 393b14fd4cddd09f91c05b797f65876ad899ee3a
SHA512 daddd42ac0a188505c14feeac52126318677e8f9a929119dcfca3e7930a1d0c1d66e8ddf320df848a8ccf0aa8063c9ea0b28544349c160da9b979e02cdebfd92
SSDEEP 24576:bfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn1+dicaamo0sCBxbtbNQ0jJ+9Ms5T:Da5POZ3BJt2pasx2+mvY9aFTtbNQ0147
TLSH
T1A865AE5EA7FC01D5E179D17DC583861AE5B1342553329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c452719d71e2dae1692b431e7339642e6767b83bfc8bca5367e8095c55a3c81f
MD5 dbfdbd136f9048e76d48f0de8cee83c1
SHA1 df8567d8ef1982e2641cc78356b26bfcc8b24fdb
SHA512 4f0fc5ff0383ffd938cf09da69d7201ef6351d4121b3951593b7c50039eac19621e490e5a831100b355516ad16a1f8f43d58e34702a9361b538c27615a872cde
SSDEEP 24576:wNcwHdjbyQ4nLC18lb/EOjowL7Fk7+dicaamo0sCBxbtbNQ0jJ+9Ms5T:wNc/zEOVHFgY9aFTtbNQ014Ms
TLSH
T11A857B5623E901E4F1BBE1BE89779646FA717869173086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bf98aca3e7814cdbbc5a8885508fb3111f17a9217bd3b887ac0ac145cafe1f91
MD5 58f939c7bc1f27f512f8cdfe1afec3cf
SHA1 91aa0910c5d71840b6b5baaaedddf3fe6fd0a62b
SHA512 55de0b3d582e1ddf61812fb2d7b98e860149986900e586744bc66ca979ad2016b1de2f74f868d1c3fe914709d08de4158bf9cc0309d3f6a4598e8db040a5de43
SSDEEP 24576:VTkNvNnaFeYhJNtmZBmB+dicaamo0sCBxbtbNQ0jJ+9Ms5T:VTMwBtOmBY9aFTtbNQ014Ms
TLSH
T18355AF6EA6F846E4D1FEC6B4CD238512EA727461173293CB4290C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 f8b3105483060affd29b087b46f047331cab6f825079c67ae783cde2a852be60
MD5 790cd4db872e6468eb5f63fbf9d63c5f
SHA1 323ac8a00d311b41613426a4afd5fb33de2d5bf3
SHA512 a65aaa3b3fe4f28f6f8984b9341b11a6eb1953cc5e44e29733acd4238cb3d8019ef7c22b28f4fd94f555861903757e2ac81d847ea8d1a411f8e70c2aa76be329
SSDEEP 24576:HPUr+NQn+dicaamo0sCBxbtbNQ0jJ+9Ms5T:HJQnY9aFTtbNQ014Ms
TLSH
T1FD05E12F62EC18E5E67AD17C89829709E77274621712D2DF02A0817E4F63ED87D3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 741d15c5ea5f6794f1657e59a34bccf15dd7acbbbdc085eddb032a9b0d4d1b38
MD5 404d89e1fcd7dc77a2ce2dfcf3802155
SHA1 4c9d842aec9027882bc141424b20735eab5f1527
SHA512 8270135694166ac219f3beacbbfa803d8c88b22c6f476aecff4b3158121ec90f7c5942525dad4d98e82567c93fc85990cb285695c175a9384ccc50280ea88108
SSDEEP 24576:rD3FHshBIYQgAu+dicaamo0sCBxbtbNQ0jJ+9Ms5T:rDVHeBIAAuY9aFTtbNQ014Ms
TLSH
T15325E17EE79C04E4E47BC1BCC6639A06E67138A9072265DB0294C1B65F6BEE42D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-79-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/248-303-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2368-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2368-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2368-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2368-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2368-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2392-68-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2392-302-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2392-66-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2392-74-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2448-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2448-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2448-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2448-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2448-82-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3464-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3464-130-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3464-127-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3464-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3464-121-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3600-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3600-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3600-307-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3600-102-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3600-96-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3600-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4636-0-0x0000000140000000-0x00000001400F0000-memory.dmp

Download

memory/4636-78-0x0000000140000000-0x00000001400F0000-memory.dmp

Download

memory/4636-9-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/4636-2-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/4980-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4980-90-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4980-83-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4980-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4980-321-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4980-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5412-306-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5412-109-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/5412-115-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/5412-107-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5468-52-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/5468-287-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5468-51-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5468-62-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/5800-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5800-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5800-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5800-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5872-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5872-40-0x0000000001650000-0x00000000016B0000-memory.dmp

Download

memory/5872-48-0x0000000001650000-0x00000000016B0000-memory.dmp

Download

memory/5872-59-0x0000000001650000-0x00000000016B0000-memory.dmp

Download

memory/5872-61-0x0000000140000000-0x00000001400D5000-memory.dmp

Download