7b9b1554bee847bb21b7287929e2aa6a3511448cb8e7d91cf3b399cce73f6ab7

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 1.4MB
Sample261002-ws439sxtat
SHA256 7b9b1554bee847bb21b7287929e2aa6a3511448cb8e7d91cf3b399cce73f6ab7
MD5 2477005760383ef6ed8bfe18a1e8558b
SHA1 a522ae788f9c9639dde2d9fbac03307aded0b10d
SHA512 2f0d2ea0cc2c55cda7d8d84e474012fc01a5b2008b92a412dd9daa4a6c9e451e38431c6938f20f346d99abfb188e7cef30443dbc102a75fe39b57a7b8c1531d5
SSDEEP 24576:mVrsHVVCssH6M9+JbESZKWvfWiGGC5SYCWatr0zAiX90z/F0jsFB3SQkI:mVrs1279+VtZKMkBaB0zj0yjoB2
TLSH
T12365AE2DE6A801EAE06A9139EC554706E7B37F15137186CB33A0765A1F376E08F3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5980	elevation_service.exe
5816	elevation_service.exe
1176	maintenanceservice.exe
4720	OSE.EXE
4592	PerceptionSimulationService.exe
4624	perfhost.exe
3340	ReFsDedupSvc.exe
1996	SensorDataService.exe
5812	ssh-agent.exe
1108	AgentService.exe
800	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\F:\	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e216a2ad7465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ce4b6909952dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037f5c38f9952dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000babeab909952dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000999339909952dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003e264929952dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb392f909952dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d6743909952dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000940a86909952dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000974d44d39952dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
5980	elevation_service.exe
5980	elevation_service.exe
5980	elevation_service.exe
5980	elevation_service.exe
5980	elevation_service.exe
5980	elevation_service.exe
5980	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1108	AgentService.exe
Token: 33	800	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	800	SearchIndexer.exe
Token: SeDebugPrivilege	5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	5856	2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	5980	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 3116	800	SearchIndexer.exe	100
PID 800 wrote to memory of 548	800	SearchIndexer.exe	101
PID 800 wrote to memory of 5944	800	SearchIndexer.exe	102
PID 800 wrote to memory of 5340	800	SearchIndexer.exe	103
PID 800 wrote to memory of 3248	800	SearchIndexer.exe	107
PID 800 wrote to memory of 2244	800	SearchIndexer.exe	108
PID 800 wrote to memory of 5652	800	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5816

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1176

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4720

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4592

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4624

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1996

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5812

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3116
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5340
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3dd62f6fec37303086f11f0e50f3f0204be04ed1d73b900d5b9cba1eca1863c4
MD5 c80ec81f9fc0d92f8734d946dbf57153
SHA1 56ed6276798fce707fc35da53fdb63f334f66d50
SHA512 7d38d7a7ed70518ea80cbd52816ba9a76a3e8b13a353bb587bc4025c3bf96b8f22bd09f312b92d12a0e374a938e48de06d25707d8736215f765fd7747d672110
SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnKaB0zj0yjoB2:K3q6HjB2B2Yyjl
TLSH
T1F2D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 62cdbbedd18c037679edef8ef92432b0dc7fee91527d27ad154a887b48c8e484
MD5 0b6fdea1f264d2c3e1e0fe185c24e920
SHA1 f00ca2a81a5ab2d1ee80bd982c0a793ecb511c2e
SHA512 0b385efe60c3b5aeda93b636bd3ad4ffae98e5ee0dcb463c9ab92ac3af27f357a48773d78709044bf471ca222089f91b255405774df170d235b00b7b5d788685
SSDEEP 24576:kXYfDtczAnatr0zAiX90z/F0jsFB3SQkW:Dtc0aB0zj0yjoB2
TLSH
T12A650229779504F9DC67823DC9A18506EA73785147A0E7CB03E4AA2A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 0c20561fd51429dc3a4b9b4699dab3b14f244a7230e5903d08e0989adf685560
MD5 6b85b5074e797c9a01f43fdfe5203842
SHA1 5fba7f43ac2e6224a53260ccf89f7000c138c131
SHA512 3c181b653fff2c986e0f57efa395a4ab4c1e769d91888c1c293a9a6b01dd57852e0112ef174c7210d3319964cf250952da7f1cf2433f8c567f10090181dc3352
SSDEEP 24576:E0Le5ji0hmxirMiatr0zAiX90z/F0jsFB3SQkm:EPji0Ac9aB0zj0yjoB2
TLSH
T115859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 21046930e2e9a1c3438f8b937a95f355a036dab22470bfb7874d63110c81acb5
MD5 7dcd80f56224f8791f0a2a25dc3ff204
SHA1 64d9c71489d17b18e954c3526bfdd1646df6cabf
SHA512 c34b8bd5c6a57013cdaa8dafd205135325b925efd0f112734f685153e5cb88e59281b5731f40a30fd519d5e3fc001a34e969b266ae1051f4e7c6eaff3f2c17ab
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWE6q8wyuEatr0zAiX90z/F0jsFB3SQk5:g/ezSC6vUzPvxHjyZaB0zj0yjoB2
TLSH
T1D9755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 94b2fefe104a8d447cd34333ca083edf7cd04a1725ac4d6873e151e4e4e5f8cf
MD5 4da509a25db69c2fea125c8fb43e0cc9
SHA1 349d798887f3e7001d573a1904c8ee8188628872
SHA512 dcdcb147a136014ea00fe10ed4019eba67e10afc24f456f7a5dd4d75a15ed1276fcff9b9f10322675dd787815838670b8de3259581cfc8600189f6422837f2f8
SSDEEP 24576:5VbqPb88hv/l+6batr0zAiX90z/F0jsFB3SQkY:5VO88hXl+OaB0zj0yjoB2
TLSH
T11955AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5e63dbd8d4cfe490b870e822cd6bd8f8eaa25ca6676c861b9731c2bde60a9aaa
MD5 bc4cbf12357fdbc869ae20ff1cf51e9e
SHA1 ff64bf89638b1abd60eccae5a1e7350dbb2765b9
SHA512 b17849c946154fa35326e8b16d481126e09fc36a17b2b5c17d1ac547bf7764bbf9af71386b0253bd368f3eb6fa31f47defb8fc9d9b7a28293be4129cf02a2a8e
SSDEEP 12288:GRWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8J:GRWatr0zAiX90z/F0jsFB3SQke
TLSH
T1B445230B340E80F2CDC32B3566989C4B1ABA9EB065E2AF45E1913F4F9D3C2C6D5656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 634fb6cab5b84bcf6185405e53ddbeab3470f45b47132c6397a0851b38c2a696
MD5 ebdd9412b032096cd9f78c67a1861ed4
SHA1 8ba36797bd5ecf9ae61f93c6e7239546b8edaa5a
SHA512 f119938103932c1f2f8e506b01796bb8fab6a5ef1c60e11158b3423b3ac02632730d13b178d7f2f542b6e5a90011e1b4bacd2ddfddccc0d548859d2a9a55c08a
SSDEEP 12288:2eBNUbTVO86UTUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Q:2JIUTatr0zAiX90z/F0jsFB3SQkx
TLSH
T13C65DF3BAE28FCE2C27A4D785B91C600D77278704B62A3CBE165930EDE235D15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9983d4a4c145c94ad9867fd729c90fae5e9a43be6b7a44b08de8262f78fddf05
MD5 85d907c937ea6b5b89df5cece01735a8
SHA1 18ff01b8db36d8db0a00ac42e127b1ddd7be69ff
SHA512 cc85c9c942717da3bd033dd3751690f0973d133376cb6255ad7d1689359c773ebf5ede488a0dd88865d22490d7d11c4b2e8a72ed77af8298a098d74b4f325622
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH1:sQvGAdlCEL8c/yRNw5CLB2Yyjl
TLSH
T1F5267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b7ef030ba91cd0c24115b3d93fdd20296eb053d4d9afc92eb7c85afa0f47882f
MD5 caedf80b90cc6315f7edf7a93dbc388d
SHA1 d829d4a36b0e0147ec6b190a218f85d8eb0b845a
SHA512 34791248128be91acabf3923802dd7c595a94d634ebe787599a46527a838a8991566ee53ac5c7ee55dc931167a69a76b4bc2a310bfb5dac7fef51e74472aa474
SSDEEP 12288:eAwSfxL/2Dc34DLLmt0LDQewsAjNUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHE:DdewsAjNatr0zAiX90z/F0jsFB3SQks
TLSH
T12475E031FE75D032C6BB0DB61B25C706147D7A204BA21AC3E3E86E8E59342D22776E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 db2489029fa64d04b0993237f50af8f1da400547dee605131a922dc0f14c2d64
MD5 c05b84b0920ce1fe44eb856b8de0a5ac
SHA1 5ae676deadc9aca3e6a07006beeff1999784182c
SHA512 74c9f65981e6b50efa73f7276801f2d1bb4cee8d43344b1cbbee914d47683133212acfd82fd8776d47e56a326721f137effd6bcd1079aeb11854487d8d120399
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHEZ:fUEtQevvqc2W1cpV2EI32G
TLSH
T1F4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6a6457b18995f9fc41537fe80d415f6a35e19a4b83918f8ce242f1c4c3509b78
MD5 42879705b1c7116d907e93843a3c6f8c
SHA1 39558691607f4fe031d10b1f6280a10d3111b009
SHA512 418356710e031423db154d24380095b045dfebe2739233ecdff69a0a4f11ade335428e15d8521c65513c6ab05c40cb4c1fa7bb57b2a34f388fc6a38f84e4d3ed
SSDEEP 49152:MCbRquA/m2yL5zQfFiV+XenmE3/ztaB0zj0yjoB2:loqtVjnmPB2Yyjl
TLSH
T16FD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8dcf751ecf27c3748ec626b3b1f17a78365fe40243fcb5604010c6d89aa1f20f
MD5 294cb54b9d270920df7d91921e0e2330
SHA1 5c848b367138cbdeda628fe2efa0968748206733
SHA512 2748c832a335a846e984858e4fad130bc7ac9fa2697ccf166773048f89ba4379160622fc92aa0e764e11a2752dc75797f3282b30b5b85d7ccd4f349f0dd44c1b
SSDEEP 24576:ZAhGLJIFoiwtA5l7S53Qatr0zAiX90z/F0jsFB3SQkz:ZAMyFoiq5AaB0zj0yjoB2
TLSH
T1F2359D81E7F955D4F5F3AA7899B68571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 95b1bb8099db843ca613b001cdc04119e4fd2406d196fb0650e1b553f644e24a
MD5 28c1eafaa943140e5669cacb75873509
SHA1 4ebd59705d58b35c1a0362fdf8614a4a0a4f6c76
SHA512 357da42259c634124f014162a52827c761310ae85aa71055f02a81c8b5183edaea9652c44edcb9a6ae4b9a25e976da05a817c0fe8a32a183fa8f630bf7e59f34
SSDEEP 12288:rmw5HEjsChNVBFgl0WDm+CkUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:qwuoOW5atr0zAiX90z/F0jsFB3SQk4
TLSH
T14A65F14A36A90CF9E9A342388657C436E7F2B8112A61DB1F1360CB5B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 30e41d452344ffcee58f33a6080214dab54654997bd0991d6f54c26752a04a64
MD5 c603f7cc70e7728196930f93d0932e78
SHA1 64859ce676b8109359adcba47eca67a17fd103ee
SHA512 26120be9a3abc77c44cb9fc384a8832bf035dfb390404392266c1f8e0172da929695162a4777419aa0416f3112c999d1bc40cd2cc49b9ca555bbc410d84079a6
SSDEEP 12288:vBZ1IydUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:5Zuaatr0zAiX90z/F0jsFB3SQkN
TLSH
T1C455124B32A960F6D5D3523C89E4490AD7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 92220e1756b3afc46769f4048aa6a34d292bd58f5e99aa2b5d530c6fb8cebc41
MD5 0aafbef5de3457b15a642bfe94d73e81
SHA1 1677cc06bb8241d9bd526e9c551a30dafa903379
SHA512 b2fe41615c4a4d16abe8fa72d91b123c3ead011ad5d029af0eacb46651cba8c375bdf6cf4b87afddbac715501e3ea5e61a5c2506f3481287fd4c55e872ebb316
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:8QRQyi36YOcPQLvw2gAf+PN3SB2Yyjl
TLSH
T10B667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ef000b17cd177cd8fb9df0d86b18cd3e678ee2c4b404746351fd6d78ee5b4710
MD5 7860103e9ea54f33ba6cbff7919797c3
SHA1 17400f97a177d53c2cd632094013541a59310123
SHA512 1899f13baf566fceceb37e1663bad6c4a35790142328293a07c56e681a5ddfcffc0b0717c3129b825deb08de8d05238361e118ae9ac25373b6cbebea7ab6f206
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:IQRQyi36YOcPQLvw2gAf+PN3SB2Yyjl
TLSH
T12C667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 dffcb564708d859b46c7d74c28f5dd23374196b1df7158214231e2907707ce02
MD5 70b41fbaa4ed80a3ef4a5d14f3a78049
SHA1 b8e80b5b252cf34139a599a21c3c920f08c0b091
SHA512 1d81c65f7d0f035d7858d99da7b2211afaa65306346eb7a127e8359c7a07039d1af5a1780242d7f4dd1da46a35ff7fa7e9c6ee402aca5b6030929d06c4a05e79
SSDEEP 24576:lwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Katr0zAiX90z/Fo:B68Qg55nhheWu7PNU3/9aB0zj0yjoB2
TLSH
T17CB55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 46d8a07b22f01d0a804bb22fe58eb7d9afa524c228b78489b5ab9884a82afce6
MD5 9c56fabadce5619712a1eac30cf4047e
SHA1 af1b5993538877357ba215fcd4e7a4da83fc9c13
SHA512 fb13c224ac58da0a4e144c89ad692331592b4bf8368ec422be24e16ecab7ed875ae09b215f9f63b72e4cfb930092de422fce95bcb0be924b42dd7043df8411ab
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99L:ny5112gYy5azzVvL69nLKnhZhB2Yyjl
TLSH
T1A9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 32cd62600f26e89067a72a55af88f63eb1e51ac5f847d2312f6798de383b5b90
MD5 a31ebcc817b9989eb1428352c6b67fbd
SHA1 76316a98bb095f093b8a21fb1c55e5339599682b
SHA512 b81290bef3ef5f90ec35da33af6d16f494ff4968ab1f1e306d3f8d5df998c74e3769fc19036e022b6e1c81245854d28be2264e00d8720590b92ceb103b0004c4
SSDEEP 49152:yB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glXaB0zj0yjoB2:Au6JmVxd2dKB2Yyjl
TLSH
T13BD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cd47c09f7c0d478a075714cc43a7d29805e0f40346f7c7920e62b20da2bb3b90
MD5 681f866ba1969ee2a1eb86c5b9f2323d
SHA1 2c80c26d19e4b445b06c7604856b1e927b0ae7d9
SHA512 8817a2b462b0a940cd4e1a78a5344f0e6ac8a8ef4cbc73f965875355a60919e9f4bcedf79e68f33a0ec710f9f9062fe3f436390962269918294d3b6c2ebdbba9
SSDEEP 49152:d1hpsNoJpF1A6UU44CwH7R4xzaB0zj0yjoB2:dmifPbRPB2Yyjl
TLSH
T11EB5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c8a7e36f3ea887057b00ac63d6047dd98df018a9a15c20d47ea5cfae90fe31d3
MD5 2f29261faba8e3422afbb17873a18d87
SHA1 1bc522a949c83407919932de310c76f87333e328
SHA512 f9263d5fe427ad8998a8b406952d469c511616555ef3185464bd7b4b1821d6b04b89fc4ee9cd91b15d6308e2f9b650cf0b0bf664505fef015935695dc05f6082
SSDEEP 49152:5SuZQIY0Be2KRRVtOnks6NMHqaaB0zj0yjoB2:X5dKTi61dB2Yyjl
TLSH
T154C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 aa9f1a2400b79a2bf779bbdd4a52d85203799613ce62d145b1bea27e07e8c877
MD5 9283bc4b9d182a27fae71f28cbd82e40
SHA1 413d11a74f1c3d8804202e7393c52e16322a7ae8
SHA512 9112dbbd1da9eeffc8cd5b2dc6ecdf74da05574433b4715a72e519d2116c4685b92ad1346936c7db5c2e8f8038857ec3e24f57b2b0c6342e73a3ac9794838af5
SSDEEP 49152:PhtSn8EApI0figngiDn0AP5wnaB0zj0yjoB2:eX2iyphTB2Yyjl
TLSH
T11F95BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 037dadfacf7cac5c70f78086467d4c985fbef8ce3a4c4717ed6b74e963580c10
MD5 0f36e247154de703e01c717932bc053a
SHA1 b325a9444d9a636f4f6b4fc524fadf2f0014408c
SHA512 6e28ccdb2b8d510e66436534ebe2ebf6d75a110ad4ffa5195a3f0cab185f532b6596044d9b25ce048823a9ce3f21246bcf0d7bb2051de935ce21881e9f0d8bab
SSDEEP 12288:VOUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8v:VOatr0zAiX90z/F0jsFB3SQki
TLSH
T1BB45230B381F80F3C8831B355684984B5AB95EB4B6E36B85F2953F0FDE382C615656CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fdcfdc05b7aa0327d96599a7fa574d3808c4a20fd16167ec6dcab8f5553b1bbf
MD5 655f9c6729f98a716c7e4d2b39acc8be
SHA1 cd94900f8d56aa9214fa0edf0e034139be1817f1
SHA512 c4aabd87f82da9bc37056349a87eb7e64b77126ef1fa2ef6d362cd5e919353da4f4ed3680d8fd6a130df3c7c9e114a29c0b6434e9052d41a0da834e61fbf35bb
SSDEEP 12288:bBUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8v:bBatr0zAiX90z/F0jsFB3SQki
TLSH
T1E745230B381F40F3C8831B355684984B5AB95EB076E36B85F2913F0FDE386C61565ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 090d0ca6cf458069ed5ff0eb2ae225112daafa3b4b15a375f59b2e052fa61e3a
MD5 f7f2fef165b2897f3dc359ef598f9184
SHA1 d81f7e2d8e368dc9243beeb97375bd715bda841c
SHA512 4a2f33a56bbe6db50c0b825ca7f2a4dc31b228261a933665d1ba86cf10da30ea025d846d6c139c6ffebe498e2f079f5ffc9667dd99d75a52a32f1a22b7f12031
SSDEEP 12288:sLUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8U:sLatr0zAiX90z/F0jsFB3SQkd
TLSH
T1AE45230B341F80F3C8C31B355684988B5AB95EB476D36B85F2D13E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 0cc4c22afe5adedef5d10bd81b797e4e9192fb9a5b6fcc9c4a1f4b00264721a6
MD5 17a0ea1a1e3e63d035c7d4d28cd58ed8
SHA1 e87c7e6a79e746c07a5b4b8a8fa57a7e0e1378ae
SHA512 af80d4595ab800cfb01fea92aba2ba7050a806be22722ad1037c045443f96ce88fa41070b0fb4a14d5d0b640d16002e693c07ef199b7d6db4a0b90693506ab86
SSDEEP 12288:8VwUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8j:natr0zAiX90z/F0jsFB3SQk2
TLSH
T1D845220B351F40F2C89397358694884A96B5BDB0A7F3AB9FA2413E0F4E343C56934BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 28d566bac5f12715ed627da9f077ccb86805f93e36c9ce49d57f95f7601bd750
MD5 eda4c97b22c9c2ed765f619184878303
SHA1 876c99f668375beb14085b996e2087da74656da7
SHA512 e4da2534a74d6695f9b93542a08738bc89034924eb5fe6b3954c644667c91c5af0482f7ef68d11632ddde1852a09f5422449bfaf1a7ad9a455695dfde39a245d
SSDEEP 12288:tYUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik83:tYatr0zAiX90z/F0jsFB3SQke
TLSH
T12B45230B341F80F3C8831B355684988B1AB95EB476E36B85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 31388bf912adf4f13c3ff83bdb050bab4075b71d78f191c98bf343c19cba5ff1
MD5 e5f6a08b45d2be984e7768f131d0e501
SHA1 2899fc85cb9d2d2c3ceeb969ff076950036f8f7d
SHA512 c276e693eee93ba1a222fd9916b1a9cd7f90f7456c4e7aa0f2d2de734253c664c37490aa9235ce4dd4221e5510c6fe9f72f6cf493d48b4aa726dde06acc9292a
SSDEEP 12288:5lUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik83:5latr0zAiX90z/F0jsFB3SQke
TLSH
T12945230B381F80F3C8831B355684988B5A795EB476E36B85F2913F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5435de30ed04a160e2a71f3bc4e04570487a5fbe4b1bfe752e6842b6fa80c4dd
MD5 82a5b15575494038127633b04ea9d9b7
SHA1 f12ff89b3eecfb7b30c22e3cfc8e7853d7ec0a00
SHA512 910b3266fff01c7217fad243826b2082bc7b99b4cadeb377f83592eeed800430055d98ebc55fad210bac245f2182d7d6643eb7b497b82a1c92a61c66ae1aca2b
SSDEEP 12288:PpUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8v:Ppatr0zAiX90z/F0jsFB3SQkW
TLSH
T1A045230B381F40F3C88317355644984B1AB95EB4B6E3AB85F2917F0FEE3C2C625256DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 75ea14346d5097bf68a4d889b2578551d1a621333e9e437758263755dfd40356
MD5 2f79e017cb73ed13d4aaf45873badd63
SHA1 159060e73128592dc5c61a2aa746fa64046e5106
SHA512 4006cd538a1f98229585681669b059b3aef67e7b834412c373a0cd31ac9985efb13b9d282b39757e55d4fbff1e258aa4b11d241ecfc2730c03a15e1ea4dfa2ab
SSDEEP 24576:yZMSzFVSOhatr0zAiX90z/F0jsFB3SQkD:yZMSzf1aB0zj0yjoB2
TLSH
T1C665019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 dd453dc53f563de15ad8b589f7b6ea2490ff6f6650a8a46b2ff1886953e828fd
MD5 f233cdfba5b4b9ddab562e497c47239a
SHA1 f4e272179e1b9396875afa8bfe11b190c18f8dd0
SHA512 36be42688a1aeefd2dc28f393d250fdcd2d1bcd70fcf15735ffa4fe6e009b6db276b0f7d63130adbbc1526d26df6b9f21081af1dca587db3d7956870b732479d
SSDEEP 12288:vqUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8I:vqatr0zAiX90z/F0jsFB3SQkJ
TLSH
T11445230B341F80F3C8C31B355688984B5AB95EB472E36B85F2953F0F9E382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 496d7647384c29c816865449bef5c47d3c98e1f52d8d1b80031c3893dcddc560
MD5 e7729ef0299767e3ae0388a4a289585a
SHA1 c6c8c6da0782010ad22bea1ac27cc96cbee9e449
SHA512 5989bdd41895c1e6a91ec1f4281ec4ce50c665063bbe528fc6ce8a0d0617a6c9c98853d28758a1b371fbfec6b42d9b064322f76ab61599abf213b3ac09c0d49a
SSDEEP 12288:gmUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8I:gmatr0zAiX90z/F0jsFB3SQkJ
TLSH
T14C45230B341F80F3C88317355684984B1AB95FB4B6D36B86F2953F0FAE3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 241fb5ead18c36dccb5d9fa203776e1a1b5c1fd5df1b66bd7974ef3fc5e2462a
MD5 c0a2f7baee5e34b99883b9bcac2e85da
SHA1 4b04457b90dfa25706d335b18aac0e546a841c79
SHA512 aca00ac93a0bde729e5a9b30631b4c39acd4656bedfa7921c4cc62ceffdc264985f302cef7dfb1abdd0791abf8a20f594699ef57e99abb8655264653253207fa
SSDEEP 12288:0yPz5L8dUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8i:tzydatr0zAiX90z/F0jsFB3SQkH
TLSH
T1CB551207326620F9C4639238C9911906F776B83117A19F9F53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f0a02763c24f719730dee0811e8dc2cd2290c2860c0e9257be93d088afdf01ec
MD5 d3c40e778405330fbd3811368d6fa586
SHA1 c772109e54f31d236eb6ab5a48f7dadadb320bb2
SHA512 f18b865e9aaf1a49371b3ac05ce5bc04d6761443354f07dd17a3805b1f1c644fbf2269ebbedbabd3f36ca9eab0bd4c8adb336c64b6e3ab3161b2bfd54b1dbf1f
SSDEEP 12288:wqUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8+:wqatr0zAiX90z/F0jsFB3SQk/
TLSH
T10B45230B341F80F3C8C31B355684988B5AB95EB472E36B85F2953F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 163a6a710317196a981379d3e4f3e0795421c2896ec1b86d7c25b328157d3b52
MD5 ca18d35453659c1cb91b7b9a18094103
SHA1 dbfe20e3049c8298253204350e72391360d8794f
SHA512 1261de71a27f4d733cfa9ca3cc8b88d67359b8968d07fa642e4c24acb602e8c638f4ccfa834f139654be61a72798b7c33a8ad6320ac681f03b5fc48bfd24f1b3
SSDEEP 12288:oqUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8+:oqatr0zAiX90z/F0jsFB3SQk/
TLSH
T16745230B341F40F3C8C31B355684984B5AB95EB472E3AB85F2953F0F9E3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 4d48bfff434a0a81f08299c2a9e3a68683858517c956da055f5c38f36bcffb00
MD5 617184a20333671369b36eb3e2c60e98
SHA1 80430c5f2067194cc8363a0b8adb23db9d0da361
SHA512 b74a2990c70fe4d2d2e03364580f48f6078a6aa8ff9c2f007e7424d7bee0aca65b990ada4c457f3c6fa731d3fb70f07a6360b2310d25146e6a50a2fac306fc24
SSDEEP 12288:5yPz5L8dUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik84:4zydatr0zAiX90z/F0jsFB3SQkV
TLSH
T198551207326620F9C4639238C9911906F776B83117A19F9F53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 486ce3272c7896c8dc35ecdccc2451382604d753ca190e65301b075774c6b4ab
MD5 f6a714be8d7d3c1decb42ee0ae4c519e
SHA1 58610e30ff17ee5d8641bd9acf98c579a5118148
SHA512 c11bf732e2a819b37dcd6fa542cffa02321db890574b2b1518a628f31d0a84ec341d4014d20fe5892d19300a4d4e4bd1dbf4b0d715785b33401cd18bd0e94710
SSDEEP 24576:3THaLl3z0zD7atr0zAiX90z/F0jsFB3SQkq:3T6LljEaB0zj0yjoB2
TLSH
T1B9650199735018F4DCA3823EC9558906D6B27C6A07B0CA5F13E43A6B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 3d0636b9c7a7205fb7710d608add112698ffbcb6d5a276c4f41e62564e226f0d
MD5 1d1c30f5cd7a9d49214317d046380839
SHA1 951813f4bf0c2c951f910457651c3682e5f7b233
SHA512 f94ced28ab7ef02d295b2d83516afa580920b1da33ea46b8872cead7141e8f82ea5769a9b35e1fbd30170d68435170c7720e7e29cb7021e7e107175677e11b38
SSDEEP 24576:y37d9CHKy7GZ/atr0zAiX90z/F0jsFB3SQks:U7d9CHKya1aB0zj0yjoB2
TLSH
T1A375CF91F3E810E5F0B39A3589758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 561ec6a79406a4045b8af52780b39371f74c4a015d9b46c237dcc73f9947045a
MD5 818d0ef19b4ff82112fbcf7286a719ce
SHA1 b35005e9529449a33c32d6528641b9e8b7144b0e
SHA512 bd1ac5b2c592646c49d90d0b6d3eeeb70d6ffabba28ed686a8b2fe6cf68a04a426f6527d50ca9c1557c02a538f712894b475a510ca69a6d5e248a413b39fe562
SSDEEP 12288:drUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik89:dratr0zAiX90z/F0jsFB3SQkc
TLSH
T19245230B381F80F3C8831B355644988B5AB95EB476E36B85F2D13F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0b4e96741618caaa8b83763d8a0016795dc6376c814bf64abdd3d56b9ddfc52e
MD5 f5732b8d729d9f6b9ee7596a07e9dcc1
SHA1 a4d74ce03cc2d03dbc40ed297e62e0582c54dfeb
SHA512 f04076886f498008cf805ce122fa629288122eff633b992c95fa13fc38a855a7b9f74548e6e1e19dd421f0e29554383e8d61ab9edd9e53406c8290b74e31b501
SSDEEP 12288:H9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:H9atr0zAiX90z/F0jsFB3SQk0
TLSH
T1B745230B381F80F3C88317755698884B1AB95EB0B2E36B85F2D13E0F9E3C6C615656DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0009486253119dde8a30e2160fccb4e98f484989a386b3bb6fb2fa6f145c54ba
MD5 c2230caec9e9e5097b54b80d8607bf40
SHA1 1c4212e79f76049142f0b1cbfde9aaef39b698f9
SHA512 ed07270bd84401c738688ee9745a024c52e068e33323191f15aca9a414834cb62121e20fbcfe964136eaf934fa790860914b4bb7c6c6d15c15831a41097bdbf0
SSDEEP 12288:nsUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8b:nsatr0zAiX90z/F0jsFB3SQkW
TLSH
T1B545230B341F80F3C8C31B355684984B5AB95EB472D36B86F2923F0F9E3C6C626655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c388dff7e43d885d7e229ac7b8e11e499854ced6006dfe685ef6fd2ff0f2a157
MD5 afc038d26ebc9d474a222fffbd0520e3
SHA1 86c15a544bb8b44834f709fd21d82e6161f04919
SHA512 c1dd09ca07d89b433528ba16368fa8b4dc0509a7271ce94debf8e7f523fa260d7e6a12e6a0e8c24784cb956a2b329187d47a9c4de85647bbb4c055ed0a4b478d
SSDEEP 12288:RqUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8b:Rqatr0zAiX90z/F0jsFB3SQkW
TLSH
T13445230B341F80F3C8831B355684988B1AB95EB476E36B85F2953F0FDE3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 db1be157257773a8cf6383cc790d1de3715badb624aa8f57d150db58c8ceac3c
MD5 be06a11092b7e1a43c81e62921e9ec37
SHA1 6449c759b71940984289cf7b52b997d24edccae3
SHA512 1c23da6211ed95d2d97719705541f7d2b898561d8cc93dfe164b4c25a1a949cf51d78ad7ac6a1cbc0798d119906b038f5c98f526cfcbd78080982e9c95fb1f4c
SSDEEP 12288:8rUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8X:8ratr0zAiX90z/F0jsFB3SQkC
TLSH
T1D245230B341F80F3C8831B355684988B1AB95EB476E36B85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 48547e1b042dfdf50929eacc4bb4532ceb81af4f336fc866b1aa67800bfee75e
MD5 ca50ca24451730bf03617b3194fb0658
SHA1 cd12c31d2a07a8f04e518fff60bed6580e30fd44
SHA512 9ba535edc838ca78847df84216c72f7b8efc9716573ea5abd71eec2ddb694787dad3f0820663c5b4a4ee36355d94d6665d22ee4272796879ca8b5bfb33652dad
SSDEEP 12288:gSUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8G:gSatr0zAiX90z/F0jsFB3SQk3
TLSH
T15945230B381F40F3C8831B755684984B5AB95FB4B2D3AB85F2923F0F9E382C715656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 3040b9a5665af87af82ab8da3f1aa533b4dba0aeb6bb4b50ec0fa413d7973df5
MD5 8bd60a762e920162f376e6bf9f689100
SHA1 d141364cec0dd00885080f70aae51738f492692b
SHA512 a60a3cfb007d94ee0b089a1142f7e61565236c8167cc5db87ebfe4e56db69ef3cdf02dc071eac82bdcd96c94a5bfe52116ae1dde800d287888e47e234f91f973
SSDEEP 12288:YYUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8q:YYatr0zAiX90z/F0jsFB3SQkL
TLSH
T18D45230B381F80F3C8831B355684988B1AB95EB476D36B85F2D53F0F9E3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 58125b243c839453711528114d45378c84e8c90064c0a8498d998e26e9019f1a
MD5 c5b9581683c91a265ad6eaf16aeb3ce1
SHA1 34bf8035ff32ad647687ad9e923a95ad6f55ca12
SHA512 d51f3784d4a67e1be78ef62ea546cca47ec0723445f5eea8b62c7f3e7eb5b1b7f4a1c010e15c56f0e57cccb0517c3ec0291eb1ea9e75883939a2fe6cafdbff80
SSDEEP 24576:lfwvok9RX6wkyAI2atr0zAiX90z/F0jsFB3SQkz:jMnYI2aB0zj0yjoB2
TLSH
T11085D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 85efb34bbfb09cdc9a45a5476d8b37e6b3fc48d02df0c4911199d612f6401c81
MD5 f7eaec90eec3c41a98e72b43f5427178
SHA1 27381c14def7e8d507400556b3c6988e7616f3f7
SHA512 0d3bef126be15c46c68283485a0a496fc95d09f90c9f6d4ea4144d9d8be2eb9c923391e0f331db1b05a45645397d168b79980f61bade9ffc3bc03245e2a20d68
SSDEEP 49152:BYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HaB0zj0yjoB2:pySzPyB2Yyjl
TLSH
T13A066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9bab900acc651afb6c3ac454423fe32751b7079c2acebd43c459b0c04c8bdfb6
MD5 98c19b9ebe077b3b088bb66a002646be
SHA1 12696ed928b35842f0586ef6d0d3d472e434b2bb
SHA512 f52144e82b84cdeb64d6e3f347c71c8ce596d0869340e0b032a3cce63c45068bc694ba9bee22298dccc5c88d54808d5e2fab524bd37fb8b8587cda1beedaa53d
SSDEEP 24576:+47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYxatr0zAiX90z/F0jsFB3SQku:+47JUQj1irIhCnDHUPfF/XaB0zj0yjos
TLSH
T12965AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ee50671f42600aa99c31f93d721366b89d178c4bfebe2ddd97756a73c9435b6f
MD5 c10430c5bc672c24fdee51d22fdaea6c
SHA1 f9956b9aba33b176fb7742c9f8450e8098af7426
SHA512 1a1545c2abd8d56df01fb0339d6c346e540ca4a4b99fbde2484faf34e6b3d1e8e73d22357dc0f73c128a68794debde3590521f64b3abeb19dcaf7dc7d1ec0b9b
SSDEEP 12288:BNsfaUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8/:Gaatr0zAiX90z/F0jsFB3SQkm
TLSH
T1E755F00AE25801E5C0AE6235C7544A42B7777C6593E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 0bee80fbd99a8a2b565ddbb504634545a41738ba847324e5c9b507dc5206d673
MD5 e5e27ab1e7d2c46067d9f03bfff53560
SHA1 170c75ec2059a4824458ac6864a08a372bceb489
SHA512 b85c86bdecf7818a041f978fb6abc35f05f46ab03fdce72d4cca34d2c0c2d6150f0b4fb7d31ee36bd3ba8177c7be352c8f8f51246fe916e763bff3f31fbab18d
SSDEEP 12288:7t4HMX3U3fbG08HRYMlxRQtEE+h5n1piND346hJcA:7t4snUPb2RYyQtV+h51INBwA
TLSH
T17F3527017626DB4FC6A940325E33D6CCAB707D01EE05AB0772C9873FD576658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 2b3e6b827a03e647f7380ac703d9add545a535037e03cfef221850acfffe17e6
MD5 a8589782122b404a7bdf066b45a50bea
SHA1 baed3044bb54783bc36813b63f2b7997dd6bbd2c
SHA512 bb5328fe5e49acff331929e0ac1c2582d5b8562efc60b1767f0daf96ceaae52c38e27fb83ccbfc89313182f8f54184f7a8958297214961bc1ef8248eae619665
SSDEEP 6144:8ErWuI1+rjnQMsq6ww2QaLq+KS63JL2zEmXlqFQ7QytMxeQytMxTsHd+sfTTy0MP:8ErWuYMsq6ww2QaW3NZKzLXgFQvT36
TLSH
T18455C7419137E78FD1B76032072A5F4CA7A4EC07B7096F27B3C9453AD86AB51A0B83D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 82d6c33aea327c2b7dba6effde9d62e23d47de1098142562cc734812b8d8833c
MD5 eab677d4ab19de4277c5aae9746d6092
SHA1 e3dcd34b69deccfe243812c72606c9f3df6bb688
SHA512 d76f7c7863c60a4f0199421bd1e6c18d08bdd7bd585697703d05a2da8827c410a471017fe93213a9bfa984d1b0c147768c858ed1cf01aa587862517f46a3a447
SSDEEP 12288:6M7CUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:3Catr0zAiX90z/F0jsFB3SQky
TLSH
T1F9452307351E80F2DCA32B3416988806267EBA746BD29AC7F1413F4F9D386C65E756CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e53dc7f6c24a51a12dace56e9c072f49894849fe91fc644b21ec9a0a689131d0
MD5 004a4b3c47c255d6e336cc068695c65e
SHA1 dba7cb4a1bebe796af246c7b28e874c4b273f27b
SHA512 124ff2bdbb4518ced7210326d95ef4e1f9fbf754c779004bd31c846dc41d7b14052e7517c1daf162733b3b0cf663ce40c7b3771a5f2e80424680e3eb1dd60a04
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bYEatr0zAiX90z/F0jsFB3SQkj:igb4mBIBhGFxaB0zj0yjoB2
TLSH
T16C65AE1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 fce453b373203101b515f3856feb79e89bb98bec789fcad492b9bef549b97234
MD5 79eef08255180c470cf2f5a8f9afff31
SHA1 5cc094d6503544e644785f76c1012fb6922bfe58
SHA512 4cfed1326405fba720184b6fcf14bec9ecfa7fda6917d3e2da51b0f647ba9018f2f5d9ecbd5a492c5cab8a101defb0f35ce90b83ffad8e998670339a810670d3
SSDEEP 24576:iG88u8FpJqH1bzria7/mhatr0zAiX90z/F0jsFB3SQkI:57ZFPqVea7/MaB0zj0yjoB2
TLSH
T18E85016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 60620b3e72b429722170b205a95ad2b084bd682b27afc7663399adbeac7eb1c4
MD5 716db4231808b58fc71920f0893fde33
SHA1 595dbe413a39bdfb52ac87b2fe034568888b9ae8
SHA512 fbb622c76ec48debe25fffd7c0dc434cc5020046ff9c1ba610e188786ab5dfee3f4ceb4c40176334be17c9a61243fff5771337d4150b58e315f5ec0645f7c5d7
SSDEEP 12288:AHvUrBFrEjwaQ1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8X:APUr+NQ1atr0zAiX90z/F0jsFB3SQk+
TLSH
T1A665E11F22AD18E5E677A13D85818609E772B8621352E2CF02E0917F4F37AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b4eea47b2a7d441824c31f279359ed873ae6f82ce290a035dcb499fa448d90c1
MD5 d1dd410060cabaa0eda0d04fe4a40597
SHA1 ec94cd7e056ba83c18e0c4dba1d711f4fd0e0521
SHA512 d4dcd316384281a9491eb4746cec0154c771d3f11529d7433f43a77fc1b1942a3f0ba1b517cb31ba6da0cd71cbeb4277bbc4e687c19a3a82401d739e888fdba7
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjlaB0zj0yjoB2:nG05lO43bJB2Yyjl
TLSH
T1DCD5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2e63a8b7fe2d1fa54fd811b9d96d21cdf6d5106f0c4c9ef4a9679db316249893
MD5 212534de2dfe3d7cbc35a03e798854e4
SHA1 02ad46124a2dcdd86aebc3a0a7c683b402a8b0f4
SHA512 d48658dc55945790564f7363a63bccf2363b84891360620b2e91a01973038378d5d535b43463fb2bd9d28bc3ca4856273cf74161e37b0e75888a74d4a188d014
SSDEEP 24576:5fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnHatr0zAiX90z/F0jsFB3SQkL:pa5POZ3+Jt2pasx2+m9aB0zj0yjoB2
TLSH
T1A865BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 dbe8ee8d30b3025b452a44da9306ec09b4c87953d8487281eba9735a2b1d3554
MD5 fe28c7aa35147d69e2a98387f3d7b2b1
SHA1 1c6ff2d85d96f328f6680e2411f9ea5e144cad31
SHA512 5c63960706c408b2d627e869a63e7a21f640064535216e0f616afc0fb4215fbc3eee6e55b8333eaef464ed60c7c7c904a260cfbbb2c42403f0ad9990aa17b941
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7FkZatr0zAiX90z/F0jsFB3SQkz:9Nc/zEOVHFsaB0zj0yjoB2
TLSH
T1E7858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 436d4f488765d56edcc1018cd2f089043780afb3dce32f8b5fa812a0956446a2
MD5 981c2893731cf6d47dcfc211eab93c1a
SHA1 a4f4216d4f4478ff9a68fab4b7de8916db07a4ab
SHA512 fa0d3b5b254b2cd6154c70f30fadb58e45f60a9581c7274bea14914b8b8db236b8a4fa5a94baff65fff793aa675b80aa8ee5fe36d14fa9b95061fb6393858f90
SSDEEP 24576:F8kNvNnaFeYhJNtmZBmjatr0zAiX90z/F0jsFB3SQko:F8MwBtOmjaB0zj0yjoB2
TLSH
T13A55BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 25e90f5658a69c7f4318cd8eeb88dd9aa50936482cb2aaac15378f9b7852686b
MD5 30bbe59481a1a44c6e50821323260a1d
SHA1 cb81078e046396a6dc6baef3b2a77bb8a35f8871
SHA512 17b94a43efec7831c182e798495b3d00b2acedde0caba8e1ca496a993841f2724874d8eff808ac7d9d0424065da0b2b5b987da12fb52328b29b568cf9719d903
SSDEEP 24576:lD3FHshBIYQgAuatr0zAiX90z/F0jsFB3SQkh:lDVHeBIAAuaB0zj0yjoB2
TLSH
T13275E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D091BA5F6BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/800-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/800-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/800-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/800-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1108-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1108-126-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1108-132-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1108-137-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1108-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1176-50-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/1176-40-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/1176-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1176-46-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/1176-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1996-313-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1996-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1996-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1996-107-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1996-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1996-101-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3340-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3340-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3340-89-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3340-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3340-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3340-327-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4592-308-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4592-73-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4592-67-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4592-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4624-78-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/4624-309-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4624-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4624-83-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/4720-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4720-293-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4720-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4720-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5812-121-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5812-120-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5812-312-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5812-114-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5816-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5816-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5816-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5816-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5856-8-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/5856-87-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/5856-0-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/5856-1-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/5856-7-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/5980-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5980-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5980-16-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5980-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5980-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download