b525cc79370c892d4742b501235de0a79ef6a17aff78468aec67aadcf6ccd73e

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
Size 946KB
Sample261024-exwt1sfx31
SHA256 b525cc79370c892d4742b501235de0a79ef6a17aff78468aec67aadcf6ccd73e
MD5 944c69fb95d80ccb5773ca78de6684cc
SHA1 010681874846a596a5a7d70586aa86494f5b686f
SHA512 ac8b2b9d40d6cf4a8422d93be059eb81950c8f2b86808a6cf1480e989de8456fa9c3cd42404c06a7801723a38ef4502e7ec56a40ebf25473655a1e619cd55b00
SSDEEP 24576:Y8wAB0ZMwpe5VXXC8Ac2YV3swxhZPegenZPwC7:pwxRpeDWh4sCdegmZz
TLSH
T1CF25F151F79500FAE17B82788A428516E632BC154760A6DF73A03F9A3F33AD45E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3584	elevation_service.exe
4612	elevation_service.exe
2304	maintenanceservice.exe
2316	OSE.EXE
5284	PerceptionSimulationService.exe
4940	perfhost.exe
4860	ReFsDedupSvc.exe
6040	SensorDataService.exe
4776	ssh-agent.exe
3196	AgentService.exe
1856	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c0bd2fbdb68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4d1f3ef6e63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000906b01ef6e63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000249b26326f63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068e04b326f63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3584	elevation_service.exe
3584	elevation_service.exe
3584	elevation_service.exe
3584	elevation_service.exe
3584	elevation_service.exe
3584	elevation_service.exe
3584	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3328	2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	3584	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3196	AgentService.exe
Token: 33	1856	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeBackupPrivilege	4860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4860	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4860	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4860	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4860	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4860	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3944	firefox.exe
Token: SeDebugPrivilege	3944	firefox.exe
Token: SeDebugPrivilege	3584	elevation_service.exe
Token: SeDebugPrivilege	4612	elevation_service.exe
Token: SeDebugPrivilege	3944	firefox.exe
Token: SeDebugPrivilege	3944	firefox.exe
Token: SeDebugPrivilege	3944	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe
3944	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3944	firefox.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 1116	3328	2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe	89
PID 1116 wrote to memory of 3944	1116	firefox.exe	91
PID 1116 wrote to memory of 3944	1116	firefox.exe	91
PID 3944 wrote to memory of 4888	3944	firefox.exe	94
PID 3944 wrote to memory of 4888	3944	firefox.exe	94
PID 3944 wrote to memory of 4888	3944	firefox.exe	94
PID 3944 wrote to memory of 3392	3944	firefox.exe	97
PID 3944 wrote to memory of 3392	3944	firefox.exe	97
PID 3944 wrote to memory of 3392	3944	firefox.exe	97
PID 3944 wrote to memory of 3392	3944	firefox.exe	97
PID 3944 wrote to memory of 3364	3944	firefox.exe	104
PID 3944 wrote to memory of 3364	3944	firefox.exe	104
PID 3944 wrote to memory of 3364	3944	firefox.exe	104
PID 3944 wrote to memory of 3364	3944	firefox.exe	104
PID 3944 wrote to memory of 1820	3944	firefox.exe	105
PID 3944 wrote to memory of 1820	3944	firefox.exe	105
PID 3944 wrote to memory of 1820	3944	firefox.exe	105
PID 3944 wrote to memory of 2596	3944	firefox.exe	106
PID 3944 wrote to memory of 2596	3944	firefox.exe	106
PID 3944 wrote to memory of 2596	3944	firefox.exe	106
PID 3944 wrote to memory of 2596	3944	firefox.exe	106
PID 3944 wrote to memory of 6236	3944	firefox.exe	107
PID 3944 wrote to memory of 6236	3944	firefox.exe	107
PID 3944 wrote to memory of 6236	3944	firefox.exe	107
PID 3944 wrote to memory of 6236	3944	firefox.exe	107
PID 1856 wrote to memory of 6608	1856	SearchIndexer.exe	108
PID 3944 wrote to memory of 6672	3944	firefox.exe	109
PID 3944 wrote to memory of 6672	3944	firefox.exe	109
PID 3944 wrote to memory of 6672	3944	firefox.exe	109
PID 3944 wrote to memory of 6672	3944	firefox.exe	109
PID 3944 wrote to memory of 6680	3944	firefox.exe	110
PID 3944 wrote to memory of 6680	3944	firefox.exe	110
PID 3944 wrote to memory of 6680	3944	firefox.exe	110
PID 3944 wrote to memory of 6680	3944	firefox.exe	110
PID 3944 wrote to memory of 6688	3944	firefox.exe	111
PID 3944 wrote to memory of 6688	3944	firefox.exe	111
PID 3944 wrote to memory of 6688	3944	firefox.exe	111
PID 3944 wrote to memory of 6688	3944	firefox.exe	111
PID 1856 wrote to memory of 7084	1856	SearchIndexer.exe	112
PID 1856 wrote to memory of 5612	1856	SearchIndexer.exe	113
PID 1856 wrote to memory of 3600	1856	SearchIndexer.exe	114
PID 1856 wrote to memory of 4780	1856	SearchIndexer.exe	116
PID 1856 wrote to memory of 1164	1856	SearchIndexer.exe	117
PID 1856 wrote to memory of 2052	1856	SearchIndexer.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1932 -prefsLen 27097 -prefMapHandle 1936 -prefMapSize 270279 -ipcHandle 2020 -initialChannelId {a461be89-05b8-4dfe-93a9-aa5d31783e63} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4888
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {3daf7c89-20c6-4575-a133-44ae7b2ba74e} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:3392
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3480 -prefsLen 27274 -prefMapHandle 3484 -prefMapSize 270279 -jsInitHandle 3488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3496 -initialChannelId {95350c99-f2d9-4fe3-870f-741459df5eef} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3364
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3672 -prefsLen 27274 -prefMapHandle 3676 -prefMapSize 270279 -ipcHandle 3696 -initialChannelId {a798e926-b4ae-4baa-91bd-df2502cd3217} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1820
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4488 -prefsLen 34822 -prefMapHandle 4492 -prefMapSize 270279 -jsInitHandle 4496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4504 -initialChannelId {3408133d-e5ea-4b75-8426-7508a653d3e8} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:2596
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5096 -prefsLen 35010 -prefMapHandle 5100 -prefMapSize 270279 -ipcHandle 5112 -initialChannelId {043488e2-41b1-4992-9031-58dea83f7616} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:6236
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5484 -prefsLen 32952 -prefMapHandle 3964 -prefMapSize 270279 -jsInitHandle 5428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1608 -initialChannelId {00e000dc-5f2c-4ef8-a56f-131df28bc30e} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:6672
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4972 -prefsLen 32952 -prefMapHandle 5008 -prefMapSize 270279 -jsInitHandle 4948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1624 -initialChannelId {6dc1c6ef-05f7-4cc1-83c1-654e49dfc115} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6680
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5808 -prefsLen 32952 -prefMapHandle 5812 -prefMapSize 270279 -jsInitHandle 5816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5824 -initialChannelId {d1d77a98-c269-40bd-ba4d-115d211c600a} -parentPid 3944 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3944" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:6688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4612

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2304

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2316

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5284

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4940

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6040

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4776

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3196

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6608
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:7084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2744 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5612
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3600
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2744 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ad088f13d2d97d813304658bd16ae236ac5e1f1160d0c568daeaff11e21de1a7
MD5 81dc3b996f29e6390571f64319d421ce
SHA1 5e9099677c28fe9d47972aa5b44169a1077da092
SHA512 3f1eabd876f2a9e621830e939fd3d39aca1ccc7b25f8debb565d1af2c0a0da5c3ea271333d881a8fe647406c6382e80a72b53f2356ade0c773b256acefaba826
SSDEEP 49152:Qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnyWh4sCdegmZz:63q6HjB7WIURZz
TLSH
T187D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 3ab7ab028de7b6c163ff4d325cac42d3aef03005710aa1f53e99c1a267bd0e1c
MD5 ab9862d34d790d3564e5bfbdc0611423
SHA1 006c18e6a01cb18da0d48beaea532ea332777b1a
SHA512 5d7506456e8a309ddd51d0573e1caf7e2d15082a3cbae44782e1aef7918e2f72b8bf6995a9be8466e12a78fa547f71ba99f38e443675dd11d0995da24f52136b
SSDEEP 24576:TXYfDtczANVXXC8Ac2YV3swxhZPegenZPwC7:2tcEWh4sCdegmZz
TLSH
T151050128A79508F9ED7B827CCCA1C515E633BC544360EB9B03E09A261F376D85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 bcee72c8b6d9d7c248fb67e734d95583f77a236972474159d92aa8ebbcbbd4e0
MD5 fe12bdefcf911dce49763bda16b0a151
SHA1 b5d24ff3c359259edb03ed4cc1a5914018f95382
SHA512 6c83097d6241bceabe59c94c56b475055666d7beb47360d971b2de26d6b5fe19b787ee946ada9f4097392e06b3826517e7cb10f2d2558d8531be50337fe8d53a
SSDEEP 24576:b0Le5ji0hmxirM5VXXC8Ac2YV3swxhZPegenZPwC7:bPji0Ac8Wh4sCdegmZz
TLSH
T1FC35AE26F6748335D073C0B9C5D2A68EED71348257308ACB4286D77C7E6BAE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 99f29cfcde369261b7a81add04aa66d428c767a53e05882dadbf5a4953b02991
MD5 6581369fc31b1b11a564f34b5b883d35
SHA1 7ea0f609c5e7030149d42d62c90d798dd93f4470
SHA512 5704606c26e41076323c7117a9c4cfc97f6e77f5e053dad720392e9185be2054e87ab65363c01208f842933772ecc97249fd5b81efd013558ee37fcdde37e78a
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWE6q8wyubVXXC8Ac2YV3swxhZPegenZPwC7:Q/ezSC6vUzPvxHjygWh4sCdegmZz
TLSH
T1A0756C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cfb0cd76202185afce92eb0b87b5ed5e83fcd8c27f65ac95ee8967f7b4e9d127
MD5 b2d371edb29aaa6ed8f9e422c9bf0c13
SHA1 9cb9627c713b16ca2260e5aa5ea3be2a4969cc79
SHA512 fea5a217716e0580604b33debea5929b0a2d8f796d70e295de0f0d0fe1ce1a2e62b41d5e5fc74673eda1343b528913c32efbbf4c6effe8f218d93d15d3ce37cc
SSDEEP 24576:2VbqPb88hv/l+6IVXXC8Ac2YV3swxhZPegenZPwC7:2VO88hXl+3Wh4sCdegmZz
TLSH
T14E559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 b8398db289ec53afcab717a7e461655f3c017107c47b28f7d0b2a6540b1b91e7
MD5 5429eb2744fb66c24b8b841db702ed3b
SHA1 18a34bffe653747974b79d7c0a341ef832cb4bc3
SHA512 a940c56f163421596dce67aa689dba50a027aff5ccdca6013122cf43d955895ae9ffee478176e92a578682d9f879f82c41681b2ffc53a8d685ed7f4e7eb16c4f
SSDEEP 12288:9RlVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:9RlVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T110C423A2CE0A9467F7BF0674DDE4E7D8E2289F549084CD2992917F1A6C3C89DA432533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 0c4460975f2812b21be3fb0ff4709be2fbb7c5f1fa7ea3db9e66558885db7431
MD5 77b165f688020a9425ddce66c08ea5f8
SHA1 59510769e226342f421cb9e51715a8625e904e63
SHA512 fca39385588d4f445d946b684b9089515ae4b7c0ccd1ec158649bba4d463eef54da107c0ce30fe11d51cda0a235b51f787a6386796aec1dd6d535ec671fb7ae8
SSDEEP 12288:veBNUbTVO86UQVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:vJIUQVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T14205CF3BEE28FCE2C27E4DB85A918340E77278304B61A3CBD165830E9E275E55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 54ae7bc65b715b5d10a5ff993e3242d9c5af5af52dcb8ad066a9702bc127d64f
MD5 ef0e45c8bc85d3c0fd99d8d5a30f7b2b
SHA1 5a9d7fd1d04b784d79878f3527aaf23b2176f16e
SHA512 b0edbe70419a274e23ad3a7667992f36f47edbfad7dbfe048299e9e712cd706cc832ef1f55e864741d595ce81267aea6f51b572d78a7a67da913387085bb76d6
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THj:IQvGAdlCEL8c/yRNw5CRWIURZz
TLSH
T15F266C656BF880F5E0B7E174897A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 cb76d06654690e9ab39d688240625df215083d46f4d7ae6b9b335e6ce0c61b6a
MD5 e858a049101257e2afc8a23391a86fd4
SHA1 4b6de25fc03cd02d43391e4e381885bf26ade2f4
SHA512 2c9e24ffe4dc4e86e8d6185952c77b39a3078ac7372e49bc8ffcfebecabc7a46727603e858086767ecd95ec64d0162d5f5a6f244b57a10bcfb8de9f0abf7fc1d
SSDEEP 24576:TdewsAjqVXXC8Ac2YV3swxhZPegenZPwC7:xljMWh4sCdegmZz
TLSH
T19E15E031FE75E036D3BF0DB61B65C716542CAE204B911AC3E3E89E9E59341D22336A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5cc9ff9e1dbaeb0b32f389d91a33159363b11b09a8273c364bc253c51df0ea5f
MD5 1991cf64ee5f48707cffaedd3ded1d40
SHA1 a327a65ca2b0456412b0a8ff455435822aedc00e
SHA512 3e5870674aa43c09bd77514c0dc843ca106f0c09af60a06b3170972b02f874459a0daba81e9ecf02145feafb41acd8cfdc25930860556c8d8a923cd485931720
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHHp:sUEtQevvqc2W1cpV2EI32J
TLSH
T1E5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a8e9d7655cb5c182ef6b568e2ae03b4adc75eabb021bc004f38e9f0882b5c421
MD5 ae73889fc582cfe4e916f24eaeda2ab0
SHA1 10530e8d6bb090aca77951453de5464137e13d55
SHA512 899d96001c03d20cfb32d78892302ae7d9c73010ddb96c88f3a69b575c29f5b65046b46a712d4bb375d452553864f5994222c72873bb820753c280a5debb8cc6
SSDEEP 49152:ZCbRquA/m2yL5zLfFiV+XenmE3/zsWh4sCdegmZz:2oq2VjnmFWIURZz
TLSH
T130D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d27d3646ff6213cc62c788212754a1af6145d8b746e9215332667b0ccfcbaf52
MD5 034d534a94d41ebf79a89b8f0ec2be90
SHA1 482853f02de1478632324d50a59f4e035a6a371f
SHA512 5303d4426f12482da0259db67587ac66e067250106a36049c502e8ba86c79904e3a47bdcf064d9242068fe1c0c8dfaecac1434741312b7107b6cd674afa83a89
SSDEEP 24576:+AhGLJIFoiwtA5l7S53vVXXC8Ac2YV3swxhZPegenZPwC7:+AMyFoiq5VWh4sCdegmZz
TLSH
T1D235AD81EBF955D4F5B3AAB899B69170EA76BCA55E30C20F2150D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 ee46c922008294ac6df3e9e4eeb033c164d61563f445571fef0c312afd432bf7
MD5 b588c17d78af0555f526e9328f8e9c7c
SHA1 43128a33cdefbcef0f0be051b9914d04b233b26a
SHA512 81610833034074f02f89dd4456f1bfef84e6f2cb42b00fa083426c6be248b6762c65e6c111a28108c9c6db4f2dfd3023fffbd47009b8652dafefd316d5becf47
SSDEEP 24576:QwuoOWjVXXC8Ac2YV3swxhZPegenZPwC7:QwDOMWh4sCdegmZz
TLSH
T1C705F14666A50CF9E9774238C997C136F7B2BC012A24DB1F5360C75B6F37261BD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 b359b163440d5b2457afe5505246cd1e064f0a395445d7e70e19ddcf6f85c797
MD5 8c4ceb35a2e502b9e1e8324f02e461a7
SHA1 db037350adefd60bcb3d8fa0335748f98d6e3648
SHA512 20d7b28522a5bb613d4cd6ebd8e28c8834a5eedd4ec1b2103ab7d114115c8e89eb09407970a4cf5de15d200a2366da1212eeda11109398d539c64958beaae4dd
SSDEEP 12288:EBZ1IyaVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:iZuBVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T154E41296279460FAF2BB4278CDE09789E371BC51637487CF12515B6A2E3A8C52C36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 84dca92d47111accffef9feaad321fbad86086de14c87ee5ab7b114f2eb27e52
MD5 415010da880d1713b824a45c1cf27a18
SHA1 98c3843faad6a478accfb0957617ff4c5c202440
SHA512 c954a4ae9e1c878b78b0bc41714e2e0b8f08a2dc8b6a5d193e4e488d95da8a4a74dafef8119721061b68fa3564337347af7eab4be7dc9acda650aabd421a9282
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U3:SQRQyi36YOcPQLvw2gAf+PN3SWIURZz
TLSH
T17F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 20ac5265558fa872d480c4ed62452c42de6880f805bf2fa7a3659387b602c264
MD5 5373db0ed97a06794f76188dd88bea42
SHA1 67447c218399b126248581b2625a6ea0eb7d69a6
SHA512 a480b3c52a899a9c7cafeaecde67fe6ed5c441c0f20f9ae4d30d468eb3a076848c2f07cef1a460e92e987f468c7d63744222050de044db576605c894850beae3
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U3:AQRQyi36YOcPQLvw2gAf+PN3SWIURZz
TLSH
T11F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8e507a1adacd0840c533bf293d681642fcb4d4bc356f05809011f92da248dcd4
MD5 e2d201ca14c7cfd2588e7e9879d50137
SHA1 1bf18cd665f69f23af41077093423b2235fc0d8a
SHA512 2533ca3d91af7bece52b6a03e4d2de89db85c2a751e50c3fdd2066941b11b78d754d46f6aefcb57fb94c4f743470b26ea8b8c97ae16a299d945cc1cafbbda052
SSDEEP 24576:wwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0RVXXC8Ac2YV3swM:268Qg55nhheWu7PNU3/8Wh4sCdegmZz
TLSH
T125B54933B2F600A9C45DE1769F4A872196D17C758FE0E7DB8501720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 444c000370f031789ee6db7760daab4df9116d5bfb0c94e8387f2f593d3c4a20
MD5 2f6b0548b6472f7043be480fcec317bc
SHA1 c39419f4261d33122ea1c17314d17cd282abe482
SHA512 681b0f8ce68db735ba5d7b74771efb03d87d67e962eb1b389ec4026a87f221ccdfa5c965da6b5011f2c5cbebe13f8c283a46d1f091bbdc4156a62707048b57b3
SSDEEP 49152:I3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99V:ly5112gYy5azzVvL69nLKnhZfWIURZz
TLSH
T14D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bfd376870c6c250746430fe2a7f10d2c179cdce60e7016da3ebbeb398ec5a4da
MD5 a80cad475252ad9ef956c3ba9a225cb3
SHA1 e627d178761f87fa528a20c65d989dfe71b14786
SHA512 441b5ef27f0664fb3b39e15a00a5bc934cc36ab2e27adfc38d254b026ce042928db0fe1015c6ae1b8b59b58664b6ef14835bedfc69326db7389c3c46bcf51979
SSDEEP 49152:EB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glHWh4sCdegmZz:eu6JmVxd2dHWIURZz
TLSH
T1B9D59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f24ed991dcfc6fc726621ed9425f71f43c7913fd15201e721caad5022d19da57
MD5 cf526c7364e47a6790cad38b6af608c9
SHA1 e2aaf8cd57efec30bdf0bb9f1b5b6e6970984436
SHA512 f72bde20b89da5da59cd187c7d113f90228b925a0acecb38ebb435006073cad59b9f2e7a5ce3593eb066cd94bced8e45e7563f5f13357b475d8cb3e9091d3390
SSDEEP 49152:N1hpsNoJpF1A6UU44CwH7R4x+Wh4sCdegmZz:NmifPbRFWIURZz
TLSH
T105B5BE13F2D900E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 28b46d9914a5e38f8ece3759d77f663d9330b64decf21ed89a9b4997674bf265
MD5 c1806b9a5b6c1abc6e15606d4adeb5c2
SHA1 db2a73090b1d82323696373b15ad22bee643f75b
SHA512 67af2035294001ee2886d134f9bac7bcbe6f30c317c8f50d0c6b8c8d299ccf4d1ee5cb49d5d38c0116ed9a0cfd36480325c39584fb6811540d6a28339f09aac0
SSDEEP 49152:xSuZQIY0Be2KRRVtOnks6NMHqbWh4sCdegmZz:f5dKTi61bWIURZz
TLSH
T12AC5BE13F2E940E8E0BED674CB659232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2c20a1ba879669817d645143cb298b8018b4f438cf7c1eff256769730c6969e6
MD5 bb456a11f41824b3c5776f382b518eb9
SHA1 16fecf1431b1c2ba32a20523b421917facfec0dd
SHA512 98df36ea9048154c7dfc3d1b6ba41318dfbab541fbb1ad0b1937dda1bbbc1eeef34766af4f0e1f359f0558bb8469e3773020ab0114c2cff6e9db737e05e76313
SSDEEP 49152:HhtSn8EApI0figngiDn0AP5w6Wh4sCdegmZz:WX2iyph5WIURZz
TLSH
T18595BF13F2D900E8D06ED174C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 ed4ce95d3d1baaa202d3f017c9d986462da9219f09d169d6b0a347e29ad1876f
MD5 bf85836b0fc47d91763699f2f9922338
SHA1 ef32411c18b694e19028d153bd36077f8d3d8025
SHA512 467e1c04d3231bf8b42227267bdf764a7c298c17f7a46ac0e8a1791a1b6cf454dd8637ed1aaefbbdadfaf8aefa382c53d4672ca572bddd82161fe1ee3cfed5af
SSDEEP 12288:utVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:utVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T18BC423A5CD0B846BF37F46B4CDE093DCE2289F54A0948D6AA2817B1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 b63ebfa68384430e77af0ab0460545559e989a7c2f8923a7e410ed3aa8e185c9
MD5 f91da84874d6388a106249f2396d381f
SHA1 5863c939c2c22c26c24d72efa9147e928e889c84
SHA512 cf1097ef63f7d62db797e900b693c20a6c630412d9a8bf45e3a55a6c6a7b41bd14fd882fcb06f03f2bfd30e9617f6904cf6727e150732fa315b17ff21193af79
SSDEEP 12288:hGVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:hGVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T126C423A5CD0B8467F37F46B4CEE093DCE2289F54A094CD6AA2817A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 866c52ae200309c35029de52b9624485d622a84ac195a66876b26a3df2971f44
MD5 64171db58acc5340d47ee3e216b6f80e
SHA1 ab15ed01acd4c3ced623ebe3fa92b7eba7b6645a
SHA512 5a0851ac9c6cf67169ee58bf7426fb81eeff9684a82ca3879a2eb6d41a41aeb522ee2d2a0f7385c988fe7d6a5948c1b1d717827b5c8b017865b852f9f636f449
SSDEEP 12288:mYVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:mYVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1D7C423A5CD0B8467F27F46B4CEE093DCE6289F54A084CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 98009672f9493029475342b7c88b6e8be7567292f542acb177bcc445eb6c0378
MD5 4d9a82460efa15f6dbdec2f2dab7f27f
SHA1 27d96569fd93b7b5b2c714d54d965017f197eda9
SHA512 dd74eb23ebd8dd1d4988780bd355b01f62752f8b0001cd849844ce9aea6208c6a6942bebf4f01c243d8bff772f93c5f7a4d7dfda1bfe6cd469ec008a9411e866
SSDEEP 12288:YVPVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:oVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T190D423519E1A40E7F57B8774CDE093D8E378BF94A264CA6F93412E1A2C784987831B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 a854f6efeb939b0b26a2429a7843cbf449508180b0ea3eaa9f351bd3a82770b4
MD5 9627eccdc1072ce3aa87ab07e0707358
SHA1 457e71afe93d6736bd966d7978a25f290a9fd9d3
SHA512 cb8503b37fef522934dafc126c558c2b03c12683978eded3bb933361b88124e934a2aab1b1255fb1033a3e20f326a2ed0ef30bd5fc368e89a585498a81ec08bf
SSDEEP 12288:tHVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:tHVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T107C423A5CD0B8467F37F06B4CDE093DCE6289F54A094CD6AA2817A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 e55cb27d47191a1dcd29a0ebe39115c3baf69af9fc865f59a7c9fa6aade576a4
MD5 3ffd47226412aa2bf69c0ee2276d914f
SHA1 8f198489d499c93a71775038e63b03e31eccbb89
SHA512 41185b242f87a9f63e9c8ea1c87ad3672cd59163a897a09e474b2e8dc22b354b8805ab4bb62f9ef486f6084d8489b50c9eb0757d6a68a2e26a7e8ddd373cf319
SSDEEP 12288:gyVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:gyVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T167C423A5CD0B846BF37F46B4CDE093DCE2289F54A094CD6AA2817A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 e7803b09dcf2abc28d68c3152387391c5d17bdadfab450c83972204581ea7638
MD5 8e8a7b60f24199f7623cfc88f7ccd02f
SHA1 85c32d1b4d6ec0ee05ae4a2694b080421a622919
SHA512 e03d41ee5bd8063a396742a2db0f35361bbc55f501a585cd34ea7f011c6e7c1321ee950bd5ce9b26c81d603ba3103642c8429b39965f23d19fb98318bdde7b61
SSDEEP 12288:z+VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:z+VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T159C423A5CD07846BF37F06B4CEE093DCE6289F94A094CD6AE2816A1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 7807d2adb2abe6599fa595de3c092f9e75545385e69d028b9ca45ee622b5a59b
MD5 d665a335b83d2f2f51a29607fbffe8d6
SHA1 94c57a76b6cad3a9cddb12ee65566d83a23e004a
SHA512 f7a317fe3c1a9f53322c6a84f338d0fe8878de47c69bf261531e845695bb5d457a6d228d131c6ed12736894c97718f4cfc5024be52f7147072b968e2a23e8e7d
SSDEEP 24576:BZMSzFVSOmVXXC8Ac2YV3swxhZPegenZPwC7:BZMSzf0Wh4sCdegmZz
TLSH
T1A10501A5B35018F9ED77823DCD658A45D2B2BC590760CA1F03E4362B5F372A11C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 a82add557b3839edb211b9cee1d23ba6509bd52da3575210ee3f947cff429b3b
MD5 b9f7f37cc154579dd1b8f304a4ede3ae
SHA1 1b12d1b6690634c047919e2fc3af65b6bcab7923
SHA512 c7df02cd2ae33c84b92f6a3dcfc2358f123e04459f665a1ac6a8b637f38b2a17c27c68af4916c9aebf8530877daed0c5c8da8aaca0a821790794a82258dbf57d
SSDEEP 12288:WxVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:WxVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T18EC423A5CD06846BF37F06B4CEE093DCD6289F94A084CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 fdb5870eb06692ff3786704fdc5121f5cbb54e4865fd1173f783e50209655e0d
MD5 02d761c44f61869ad48466e5185c71fb
SHA1 5d9f2bcb208852c0853c66862675173ce3d521a3
SHA512 f2db37f10e65f83cda79f4020ad2f586b996f3ba3d36bff0192cc5f57da3001d496cdd196d0deec1cd2d814705133e12132414af90b857eb86f74d171bca8df0
SSDEEP 12288:sVVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:sVVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T199C423A5CD07846BF37F06B4CEE093DCD6289F54A094C96AA2826F1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 db28b4db532c834178f56a4b3b4ff58c0fbfad495316260d24269e36df13d907
MD5 60f1a5260d467b92332c3d7b38f3c985
SHA1 72c74816d686c88005b253181b714936b95bdfc9
SHA512 d42ba1939988924d9aceb34fc28e37cd622dab28e5db57ba4dae7930e3ed2ba90913482c69f150ca1dd2127f91eca254ee25513923ed1c783fa6eec89a98a0dd
SSDEEP 12288:6yPz5L8aVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:nzyaVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T123F40257A76620F9E17B8238CCA15A45F375BC3147608EAF53A0073A2E3B5D46D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 1258b55d1f68933d571088ba72803c59100ec417031acd16a3419979d2f493d4
MD5 3d0eae9a795dffc99ab082139a7f7614
SHA1 86c5f91b2a9b2486f2090e5df92e5306da36bb8b
SHA512 53b8ed8f8e3edd3db61662c070424b6af580895d670a0cca445515297ff375912f331e727f3f5efcdde064a22a0fd9b05130c7a649b584c4696b0908b523de2b
SSDEEP 12288:fxVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:fxVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1C7C423A5CD06846BF37F06B4CEE093DCD6289F94A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 edfdb67ed4d94f37d1480108eef4f339e6cb874e81dc2f22ecc17882b7c4f1bd
MD5 2bd6c872cd8a09d7fa724b5a4281702d
SHA1 2197b6179c6dcb05f8708228c7993d39272068fe
SHA512 690cb8352b7da0ac4b1821fe9de6ecd629617575d8588955673792e4f66674d17350003fb00d242abfcf731c189bf7cb2ecb1af719479afde6667d09444e2f7c
SSDEEP 12288:sxVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:sxVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T199C423A5CD07846BF37F06B4CEE093DCD6289F94A084CD6AD2826A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 6d5e6e96de8f1965a01e6be95ff0099f236281c97d26aea81d459791e9cb8b22
MD5 2473defaddef4160076cb98e3d40031f
SHA1 0af803a577697ed082573d92050cff2c6cf8f918
SHA512 b60a80025b56ba56ff419e21d06a5d539f5d2299a18997f23d8db562603819f1f1681c90814c4f1b9a2774491b378cba17ade04a2db652dfc24b98d963d168f7
SSDEEP 12288:ZyPz5L8aVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:YzyaVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T172F40257A76620F9E17B8238CCA15A45F375BC3147608EAF53A0073A2E3B5D46D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 cb7fbcc239df18ed7aa433ef6d2e86079c7cd0ca685f47636216450d38ed94c2
MD5 0a3d0d3e6c178ba489756fb57330bcd6
SHA1 99ffefc9708a961d8efa087b607d660a14040bd4
SHA512 6e0d33814dc597dcc80c318c8bffe59fff5288df9f123faac4aa695a4adb52da84255cbf587915a1ee67a2fb743cb5ae04c2abcaaf8c7e6e024c7aed27acdf98
SSDEEP 24576:LTHaLl3z0zDoVXXC8Ac2YV3swxhZPegenZPwC7:LT6LljBWh4sCdegmZz
TLSH
T1320502A5B35018F9ED77823ECD658A46D2B27C590760CA1F03E4362B5F372A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 71d7d449856f162a152a0f0881ac1a6a7608726e395ac844046d56c8ec1b98c9
MD5 c908383960617bb9382be3e6a80b145b
SHA1 f076e3d5f9b5fae586349602905f34c1502f516b
SHA512 fd429d8ad674c3509c4e1516f5c6646c3114e957478ab54d4de53dd9def2140a54e5c02bd158f7d953c9c55131cec4318070e5ada1b81382eded291c89aac4e1
SSDEEP 24576:437d9CHKy7GZEVXXC8Ac2YV3swxhZPegenZPwC7:C7d9CHKya0Wh4sCdegmZz
TLSH
T16425CE90F3E414E9F1B78A35CD769611DA767C991B60CE8F03A4261A1E33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 a62d808d5e6ca3fa87bcbee6c3e6b52cac629fafaef6641aaa6b75553ac1efc0
MD5 61b4e23cd30941883e142b3ed55ff1ba
SHA1 8cd87d2d28862be4bf6d455132093682bd678e95
SHA512 06dc4db692a23e17c70318ad88cc627e8123c46ec2101672124f9e95be3c799460c4f2c08bfea33ae0061c96efb7f42997d8c6aec5f62fd291e6414430791328
SSDEEP 12288:J4VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:J4VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T177C423A5CD0B846BF37F06B4CDE093DCE6289F54A084CD6A92827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 87a2ab03e5c7388c940c54ea01a42d343394d7da788ff9c28445551a020cfad5
MD5 85bc3d2d574382f5c99bdd19b15699b9
SHA1 02ab21d95be0016e6888aef08c01242624dcb635
SHA512 c5c8b63e4edc8bc5262d196f19c18a00b075d538f3831ca0df4acb0b8b5e72c0f8ab74092b0f112268c548cd83c72ad8621f87ff4c3d4432effc5c1b84f234ff
SSDEEP 12288:+6VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:+6VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T122C423A5CD16847BF37F06B4CDE093D8E2289F44A094CD6AA2827E1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 32a4741e5bca7a3e3ecc0e9df27ac2455477bd3560d876f1e19ea59df596ad13
MD5 f976194960ffdd5a4d5eec3dcb0ac581
SHA1 c89df529448a628bec4fe99b0b26bc111cb433d5
SHA512 1fe479e14296953aa31c6f767d28c2c51109c0ce9394cba309340aae6f5954d5f2c31615b16e8f35c5f6422806dd70dde201c94a202355008b6adc9b7161f418
SSDEEP 12288:7zVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:7zVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T188C423A5CD178467F27F06B4CEE093DCE6289F94A084CD6AD2826A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 6d9c27589400de3272e4d9bd28f1e04076221dadd4c6b25f846325825ee2b74f
MD5 06161a518d71624a3ecf096226dc963b
SHA1 d21ac2945b091f62bc1205971184ddb7024fb40c
SHA512 a47f42ea29ea7d24c234f78f00c603ffd27c58a034da0d36b104b8a95fbd134e258fa8df084e366c464c1a7d655280f748f9dda03ecc6e15ee6d1136d4b57eb3
SSDEEP 12288:DxVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:DxVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1D7C423A5CD07846BF37F06B4CEE093DCD6289F94A094CD6AD2826A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 92acf72d2e576c9cba458e38e3338e6a2b21a72e4a45830409dfe7d848f4b70d
MD5 8c8521a32c3d3b632b206cd8d2c61462
SHA1 80943d9116eb44f6eceb21fe5f762bc8fff6df8f
SHA512 219a19322a67fef11052471ddb68660fe9a38c9bfbd2aab5835162454d04ee1d50afc437f1fa4e9284fdd4ba13e82c36cf24efc69491dbfb508f82cf7f7d639e
SSDEEP 12288:u4VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:u4VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1FBC423A5CD0B8467F27F06B4CDE093DCE6289F94A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 b2c708cc7bc82112c9431ac262bf07a831f5373b8846648fd222f76e08bc48c0
MD5 e701ef798beb4f9b7058d08f6af018f3
SHA1 14036730f42132a03a386c97fb4e21576b52339f
SHA512 037a80ddaa665d354106c58702a07a0b617ba6612a2126d136fede0181cfabcf4133791bc6bd275f65ac0d9d507e448586640ba5df66a8afbd4a851cd645fe48
SSDEEP 12288:BJVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:BJVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T116C423A5CD07846BF27F46B4CEE093D8D62C9F94A084CD6A92827B1A7C7C89D2432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 445a8edfbe2c971862f54a55a2b153ea111399ab51365c2accb4d05c6ee26e34
MD5 aab2c864ef602e98df958e3e871fc54d
SHA1 83ca7d25cd710bb9515fb7f852e0da2fe445ce84
SHA512 94bb44bcf5fa721d08d10961018c732e4d4267150bbacee84edb4b549dabc8a2e16fcad76d2c2c3c6803824a20d338dd8dd984c3887b96f1c21118c57d088287
SSDEEP 12288:YHVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:YHVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1C9C423A5CD0B8467F27F06B4CDE093DCE6289F54A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 bc1dea14e857aa567f54777c8c684e2f4502c64f6daa600300a7164dbc685eef
MD5 aea330199431c16e8fde644a63c7d69b
SHA1 753f73bc8d5ae4336dfb4600bb4c404bf3222d39
SHA512 17f52238a35ce0a54f596fb6ca6953281975db6430072120714907026131cd928baa9e656e515059c4b9061f37fdc839cdd3ad96b61df4a1ae92db5122e038d4
SSDEEP 24576:nfwvok9RX6wkyAIFVXXC8Ac2YV3swxhZPegenZPwC7:hMnYI/Wh4sCdegmZz
TLSH
T11B35CF29EBDC44E5E1B7923C89B3464AF2B178581B31C6CF029A536D0E37ED46D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 52237a008a5e59641cc17e41180b1239f13799e3b882d279d96db2b8ed88562b
MD5 c0873d31dd0e983f3d2614e3f6d4f9ad
SHA1 8f3bde556b8d128d4ef6af3312e3848bdb4b4d41
SHA512 7e1d770aa4aaee550d2c70ca88d072352aedcfe5abf22a01de0ce8e540e3b4e6f72114e9c6980ca137485aba81433c9813f901e2d034f2c86fb622e08a3cecb0
SSDEEP 49152:VYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0aWh4sCdegmZz:VySzPyWIURZz
TLSH
T13F066C96A16801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7ca9bb68cf95c038f5fc997b8653e47ccea198ba9115bf053febcf45a4a608c1
MD5 a286b7d188040c66858fed7ac2ca0a4c
SHA1 7fe1e0beb3ff102d7efe13d2ffc4f8ee04da96bd
SHA512 5453dee511e2cd063abb754707b5b471fd84c47129a009746d93c573d6097f70b820ed8078e16af540707f548964d7c329a8e30574c076483f84177f2f0ac198
SSDEEP 24576:G47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYWVXXC8Ac2YV3swxhZPegenZPwC7:G47JUQj1irIhCnDHUPfF/qWh4sCdegmB
TLSH
T10165AE1EA3EC01E5E1BA827885558A5AEA71782D1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 631265a6bccee990baaa1e879bb309ee641ad558676a035eda50b24f247cc907
MD5 aca2fc7ce242ea936392093b9ea65bce
SHA1 b99c55748578dd52856db90128fad903c56383e3
SHA512 ca9cd2ba589c8aa5d1602405d89a323ec95974e00466b442118481656d4672e92da7868a2e0ec8c3551b15ae92b3027fcfc52380bcf034b0c7c515492180f3ca
SSDEEP 12288:YNsfBVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:5BVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1B8E4F05AC25801E9D16E5278CB918684F3377D6493E0D7CB52C0FA3E1F3A5946CEAB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1012KB
SHA256 29126e49e01acd002528bf5313ee54b9d59950359137e6f998f1f5f5aad935b7
MD5 85d7eb01d470963642997e36aea4fb86
SHA1 a2a4419e27857c9350d7aa8dfc39d48a4cafc955
SHA512 8f80e30b9d9c1575c7761fb30176a221bbf7ef2df4a16129d5d215b7e87038891f6098ee5cd049bde7e27fba9925bd368969c61887493eb6a6550986fd30bec7
SSDEEP 6144:H1vsBC2naIReJoYfjnDotMxAiguZpG1nULNqtONX2y97pTxJ1Iq43mxbbRlVmRIi:qfYbpGZULkbGq3mh74OT2Fs+iK
TLSH
T1B42517107666DB8FCA6944321E33D5CCAB707D11EE05AB0772C9873FC576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 446KB
SHA256 ca31b8bb841e094ebb4c3e1fcbc960332359674d444cf3d6c0e312929bd90c05
MD5 3f3deecb58d620e4a66783a4d629878f
SHA1 0f3b5b1171f8506fe41e52971632b5139a23d716
SHA512 74152933c26ad84a87753fb7de4b052d6f4034305c5c3237b5bc53a38bb2b10b9cc8ce5be42c16112deb398fc22d40d15cc5e27dcadd184b16913f9eb0ae2061
SSDEEP 1536:wEzmAQe8J5p0LLH7mXVg7mXVlsEB+IStx9UnEizh2s4qzZFvWfoHzKWcrWpCmLtV:3mHLJHXB+IStYphZ9LiEKdYRtTyy
TLSH
T109A41800B7A5E74FC96D8037853195CEDB787D12EF116B063B8889A498B320FB5F6B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\activity-stream.contile.json
Size 4KB
SHA256 36d9e779195f16251478af6ecb8ee49635d3536055c66bab82f53e08e6db0758
MD5 f42245b3c85f99e97b1954a95a8703db
SHA1 fcb4e2e880431ef2a8c4fc908fa1764cfdcbc3d3
SHA512 76cd774c43cb2843b2f7a038befa6f5592f68779b965bf10006dad095d3b63c3ecacd78fe486568d99c6ca5b7fc43e83997382f3cdf363b5ab83d146896d601c
SSDEEP 96:TbkMMBJIomy37A8/T+mRMzon4KYiBex6DpZlz:PMXPzADmRMUTGwpZF
TLSH
T16791966F997484121B71B6F16C8B379CF117B006E9F1CE68B5AA9C6085AC7BEC0C95C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 885d08911040f087584ffe07287b9df0c855a8250129700da38b963c5b9310e6
MD5 23acbac8001f1e75e40b82466ebe28a0
SHA1 663d95794c6baf6be062c47a933ffdf7f90e1d03
SHA512 4f6b065b3bdd99396bf109d21f5d5ab1efc244112a123afe47077284060040a80c526b8a97acd0b1597a15407e6919db2ab2bad77130953b8edafbc3b4eb842d
SSDEEP 768:FykBOPQsDBaBD/qgUi+tmSfYN5MziIZksKjvT51e0OOrqA+GFdz7Wy/sEkR:kwO8E5wN+znksa9gThGTnWNv
TLSH
T1D073FBA3B6ACB2FB0BA077C72C0F796BA6F10195E34506C9ECE9C51C81DD754123A5AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18987

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\cache2\doomed\18987
Size 257KB
SHA256 c5e58ad136bd3c20b17231f9cb16e92ae6b7d9d7f1889bf7eb7ceb6c829cf4f5
MD5 7014460146100f3ca76a27e4f06fe8d5
SHA1 a2c90766a48e1eeffb5bd86157cf11025ed7090f
SHA512 bd4ff9d75e79d56c75d1c60928d5b6b1d0f6190f527861083f2103fb48ce28c9d7a9b8a9cb62ba5b90becc83d93b16781079904ccfdb9dcde6325e14ee75dde6
SSDEEP 1536:fYCYPs0bvyyp+SPr705vkcI6YFn17Z6SfiapuVDXLN7suK22zRMcnwK8Ct92ZFZc:4J/06csn176dLN7k22zRlF2Zj3s
TLSH
T11544F8F7D69C70FB07529ADC2C0D72CF62AF4139DB5208DAF868C158C3C9AA51076B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4669

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\cache2\doomed\4669
Size 52B
SHA256 71526eb21af73b117b6185f43f76e7749346abd3be7101941d071dc48c0e7ded
MD5 56a9ae92fec302940dc118828388f727
SHA1 6ad77d86a8ad969302e249333355a90e895f089b
SHA512 f796defab3aa08e2e2f4b6691cf1e64412caad4ab87f50bc172f3cb32299221bfda46f4ecc92878645f2456915eff5c8a62c5e15ff718076faa40e762a4699dc
TLSH
T1E490040447DFCD40DC1CC4731C10D4FC04103D14C4C4471375D51F5304515F33011140
MD5 SHA1 SHA512 TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 5f7d40239c0e11e47217a1bbf6f86916bcdb7a723e5cb1c66a86800fec618495
MD5 5eaa5a63489202ea522eb697d8380133
SHA1 61a0b6f40fe26138d4a27d3ec770ea0959b7631a
SHA512 7a6ebfdd9d26693f52729865bfaf0cdf5dcdfe1121b06a412b51b0a23be60775c11372a466ac8b3a926d0fa0ff8749dd60751cb7fb1c93aa8585cc7327e4f076
SSDEEP 384:HGNQiO024YSWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAY:mDZYSWTToXJWTTogB7S/AmVAf+hRMF
TLSH
T115729E7D8F013CBC2B5780E8C8B583558D18B7ABDFB5C06D21883D09C988A2AB1F944E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\startupCache\webext.sc.lz4
Size 106KB
SHA256 84857d12dd031794bac805d20adc1e530781d06eca2fa9ec88cbc3ec1f2bfbe0
MD5 1772c3123d731e1cf9d20b1d2655e2e8
SHA1 c31acd40776b3834acbe70280ecf8aa459b6b6e6
SHA512 5d84c4216346a5af79be57c869ae99634377f99a74111b9138fbfa271f64910974454bc6c8ca7fe5298025f240edce9fdf402b7258be33313dfa1b6de851bae2
SSDEEP 1536:XTrliJk45DcReA6Tqif9bOAV5i9T5+lDlkEQqraEAKYjz1TJ4qnzPbGxNwq7Vvpz:X3lTT6TqaVVemkE1YXvZzzE1S7y+9zUx
TLSH
T18DB39EF6DF92C92D59FFD42D6A82893EFD162450B3A7300AC913271062C7FB876B5648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 c8f1fdd7b6511c606ce93528764e6cbeff61ca646051f550bf15899f8dee4202
MD5 98992225e90601ae53982934c5d6b437
SHA1 fc12b6fa661645c9c140f1418785e2a8bac0d477
SHA512 b6a4ac86c5262f0c2c82ceaa6af4c03a5cfe01139c5116fa7802f9e35242dca0ad9c4e3b40e8ba01293b2989cc332fa447f5a785ce91f0860b144d4807fca8e7
SSDEEP 1536:jTrliJk45DcReA6TquOXzc4vChDXcXZTBcQqraEAKYjz1TJ4qnzPbGxNwq7VvpAK:j3lTT6TqXV+KBc1YXvZzzE1S7y+9zU3
TLSH
T165B39DF6DBA2C97D58FFD42D6A82883FFD262450B3A33009C953271061C6BB876B5649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PUK81691J6LL7V6ZU3JB.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PUK81691J6LL7V6ZU3JB.temp
Size 5KB
SHA256 66622aa498d17e825e3e9d271e9ae8c395b950f92551d93103a0de5760e5b654
MD5 9abc5510e2038adf3b99e218c2f1833b
SHA1 40d24dc16af82ee3a8e6f93b0a83c1f28d903192
SHA512 1e69daadac5eec44a54f1e95da7856fd78c553c3d40353431c2c5a3bad502c668876586d527d283800992fc625daa955c53f2cfbf31ca498fcd9416841341743
SSDEEP 48:MGgbdXJ5Ugdw6dzArgbdXJ/6Bdw6bA9gbdXJ/adw6Jo:0/j/Sz/Ci
TLSH
T1DAB19B010BF71D96F4F3863276326B076677FE01265B079EC18662954A3236089AEF93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\addonStartup.json.lz4
Size 4KB
SHA256 33875568de4c0432fc914657ca9af47564570e0c190213550f142718c3982f18
MD5 baec4fa7170ece950f0dae5e12eae06b
SHA1 3b436640d581c8f279b0d855fb19ed16a2fac2cc
SHA512 b77cc64ed2f54337624acd6672e6f9d971e46a59b2ed50410e707b3180a4c234b0f35b7f0b6694f1b871a512e9dd94befcc6b739921b4d6425f877657d750301
SSDEEP 96:NEt4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:ND52xxhD8rGvm6ApwnHUuhN
TLSH
T155A16D6AD541EFA5FE32C04388D57FB2E6AAEB7414B9C4D0F16A71294D74E735704340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ed49f007d548eeadc2ceda5731abf3b8d9d551aa776519dd53c893aab1f48b2f
MD5 a6e023960378a59c28e0b18ca250aa4c
SHA1 f2e3f03f8ea46cdeda8f5b7e96e2a01adb279e4d
SHA512 f14214759ccd1745ff4807b6a1ce729ae57c405df18370595e2844f9b1fec98bda620059837740ac099605aac7cd12927af7560a7585b9abc0d880484810662d
SSDEEP 192:uOv5zbo7bbtyjrM0+kW1d66JoztdzgCl6mc0d:lbofbtyjR+d66Joz/zgC1j
TLSH
T162E12D64E628863FC408437BCCA21B400F35389AD84E3F2935AD611D2D5B2DE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a897356c6e96ee60fbff1aabf4f09bfbbb68141a743e44c79152a46eb8708f4e
MD5 dc4076ba5f6819a71ad6d817a2c89925
SHA1 9b5aee1a421b6d970f4b4fa4756868ffaa333624
SHA512 5c3d866a756b2bb7909d51eb26f7c09a9cb5d8a3518b76832a990913c9aaf859bc33c3989e8428a5f186a65492c87d14477490a743b81bc7f9aebbc32eacbde1
SSDEEP 192:Z+kW1d66JoztdzgCl6mc0d7Ov5zbo70ZbtyjrMN:Z+d66Joz/zgC1jObo4Zbtyja
TLSH
T100E11D64E628863FD408437BCCA21B400F35389AD84E7F2935AD651D2D5B2DE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 01114d70528cfc7dce4d88f4740b3c10a60bc1a486fe4b0abbd4799321e870dc
MD5 391d8929053e0091dbd13403416c8ca8
SHA1 a3f7761beb88599409d412c1df4eab0134dd8ada
SHA512 a6550343f285c9ab9289900a5dc8bedc032868b2d35b9cb666f30fd003e2142037e3a50b65a99943d0786b4e59bbb92d5bffcb60975cbb33af55997f375425cf
SSDEEP 192:Z+kW1d66JoztdzgCl6mc0diOv5zbo8MbtyjrM:Z+d66Joz/zgC1jTbo8Mbtyj
TLSH
T1B8D11D64E628863FC408533BCCA21B400F35395BD84E7F2935AD611D2D5B2AE778D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 597c4a49a0cd9c39616cf8fad56d62995ce943492bf3ffb3fdf9d3f07f80cfd6
MD5 f449118cfbfaf5ba027e4b268339566a
SHA1 6257cbdc348f8e56c572f60363a8227fe3b838ea
SHA512 0d608d4d4c787b976df6d7a9a6621c32a969f8ff4b3d0290f7a27285404dee40969418d10bb50fcc4e7099c3dd8a99ba2ca22f76c824029ac241bbc673d36197
SSDEEP 192:Z+kW1d66JoztdzgCl6mc0dbOv5zbo7bbtyjrM:Z+d66Joz/zgC1jybofbtyj
TLSH
T148E11D64E628863FD418537BCCA21B400F35389AD84E3F2935AD611D2D5B2DE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 4cd14995fd96ca2eb7ddcbfda49f48d6f633cd389e3a707b2b0111ab5bb0c3e2
MD5 8f006d589e5f1383ebdfc4679942f0e0
SHA1 11b4e60c8a724ed6c5dd78be72166e9901a621dc
SHA512 b4e53c2e2c046a33804d2efd5824f04aa533d373aca740cc7139723a22f85226173c320bb739e757b78d2d9c3a40c2b697496d8e24dbae9d0e3d1a3157c178ed
TLSH
T109210D5C7EB84D2AD8C6F69C7480168E53914D4B454B1D434E52DECDCE816E932AA428
MD5 SHA1 SHA512 TLSH

Submit Download

0e4be195-e99a-4c61-aef5-2f646b68fe5d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\pending_pings\0e4be195-e99a-4c61-aef5-2f646b68fe5d
Size 235B
SHA256 2d256e843cb4198d6e470aec0ab27174dcb24c4c8894944dbb20f877841b3f4a
MD5 88cb51d725d083c40ad45902fe71805c
SHA1 06c0a6f830dbaab31cc3d6fb24b45c5efcdb9708
SHA512 e03edd159f430973300fb29e2a3df054cfd8d9fed5da4aa2b12b3708ae190cee8c4d63e2df2ab9f3c266f3d7cce157f410f1307ec4f638bd2fb0e184a3d83392
TLSH
T1B4D0978038A863AE081C0F0AB0E529C230444C3724B4E820C9A04638ADF8AC881A1D1B
MD5 SHA1 SHA512 TLSH

Submit Download

11b444bb-53d3-4f95-86fd-2ef924fab70b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\pending_pings\11b444bb-53d3-4f95-86fd-2ef924fab70b
Size 235B
SHA256 ca0fcd01c8ac86b8c26154dc94b10e56d329fbe5bf7551b59e7350a0d0056d71
MD5 62526c0f51bb197113f9916ed9c7cdc3
SHA1 1607e963475654631bd37b4b81a25821f6a85711
SHA512 7476cf26269b747e4a743f1d68719ead1cb662baf86bc820e56ed87c052aa09bb26c478189ce1ce9c2644813b036728b2f662ff1c7416d5b5d6f4e1fa18099c4
TLSH
T13CD0978018A8272C08140F3BB0E2AAC630A58C3710BCA810CAA140B8EAFE9C8511292B
MD5 SHA1 SHA512 TLSH

Submit Download

12cb3753-4880-4b3b-afd8-be6e4f5b8ffe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\pending_pings\12cb3753-4880-4b3b-afd8-be6e4f5b8ffe
Size 2KB
SHA256 1be6c51b728e8ba1f16c7d0f3f47b53cbf4ac31d91865a2eb87bcec26ba1690f
MD5 cbb0ef372eb0592a34a9ad41c83f7050
SHA1 03cb0eb0c1cc88d678d10a81e40bae2877f009d7
SHA512 c233c15323bddc4661819d4c5232e1384287edeb4c1b1f1c1b65c5b88fdd448b2aad9b7677d878282cbc567f56d86c70359b9ebe5dbc112a0b312b31cdba77a5
TLSH
T1D341611C75B89C379C9AF25D8082338E93B08E1340C61C436E51EF4CCDA279D236A41F
MD5 SHA1 SHA512 TLSH

Submit Download

6e744cea-b25c-4dd7-bd80-64962dad3217

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\pending_pings\6e744cea-b25c-4dd7-bd80-64962dad3217
Size 886B
SHA256 e72df71e384e7798c1bda21336303f5027567e9bdfb02e2939793cce6e2617b4
MD5 baf1daf006cb1833f2c0169fde7e7524
SHA1 2600ee1bbc62e63e3f28749bf3202d2d85d5f87a
SHA512 6dbf92076ffa75bc8ebb4a2287d7d893ebfde732636097c5379804dac32efc4c766543614d5de69196308682650285cd92f29f48e90a8eef3b8efc27aa96e350
TLSH
T1C311C4519934B9B2DD78D35B8591B7414BF07023C0CA49147EA19B284DBF61E536770B
MD5 SHA1 SHA512 TLSH

Submit Download

74fbf7b9-7e0f-46e6-9368-ff57aa69e0ec

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\pending_pings\74fbf7b9-7e0f-46e6-9368-ff57aa69e0ec
Size 16KB
SHA256 05f02455a22d47472e4b38232928af2e79e62e814cac9cd4e740a7f6038c83fd
MD5 67275c4902ce53ae839b4bb6d3e439a5
SHA1 36d20f95a4a6fd27924613a5554bae4f63ac9814
SHA512 f5899625e86d24db9337e8bc034fb523992b5402ca72a45a686bd90b03c129166b2ab1495ff583f2c05adc7c7d74ef27f09ebafb304ff2bc4e7d593a8779eafd
SSDEEP 192:GFlO3uN5u1elAP4YDwBvsJWU9GkSNfS+uzxHjR/htJNhJ/WowBHNOLbMV1fqywke:GFw3uhlNIwVsJ6kIfSJlHjR/htJqHfM5
TLSH
T10072B75668605A7AC551E368D4FCBFC3E6F528CB4C018FCE9BE0BD081DDE06E112794A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94d10bd6-e6c8-4668-bf4b-316b7d939631

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\pending_pings\94d10bd6-e6c8-4668-bf4b-316b7d939631
Size 883B
SHA256 76efbbc6d8b95cfc488d6304f8f0d47c5068b8276c36c4c8096e9906eaa7815c
MD5 6ac2c6947197dc7ec6e1cc8b67311f90
SHA1 01f3d43f00eae7c6cde4aa38aab6d12c2cdb0889
SHA512 a943486f700f472c12d88624ea99f6c640cdfcad8b4431061f933acfb92f7352d9cd4b9c389dbff5628e55643e58f9971a7591dac73f4fe3050059edec786807
TLSH
T1571100909534BA71ECBCE29BC4A23B414BE4752384C689183EF09B180DBE61E936770B
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\extensions.json
Size 14KB
SHA256 608115f77250171254420630f5a3ec02f1de543cf90ae13be8712a4cc9198cbd
MD5 b5bfe46bc1191aca8c35cf995c6eee33
SHA1 d6af0cfd485137209519c55f95fcd2bd21bbe27a
SHA512 70fae2c855278ef074fbfcfc317266013061e693415dc87fcc119340f1d137cb5ab95d6c1c721c2114839e776e959b7a58565abd125f2c7bd7d8863111f3d40b
SSDEEP 384:mkI4vBUmldvj8dhWv94zt96okL4HXL4PjL4HYL4HUL4HC:pI4ZRfQX+4v6J47434a4u4i
TLSH
T1BF62431545148EB8298F979BAA367E01C37D473B70445C78F4DD8FC842FA5B902BB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\prefs.js
Size 6KB
SHA256 46d88c9de262c0e838829a316f993641f5c15b6e88e810368f249ad37883a711
MD5 81ed0e24283ee3d2d5ac9a5946ef528a
SHA1 7918347f452984f7da903f4e1585cd2e710ddfde
SHA512 d9dda7111eb564b88e2a166f67582ad491f4046243db825b1511b14d44f0bddd31e9a16b241b4c5970fd853348798b06c609fab48736a9bb8996fdf573d79b5d
SSDEEP 96:xHV6UTUWxqGqa0fmQH1zSxSSl4dv9jBnS6HVxNUoBw88u8L4cn3VSpp:r6vRLfmQHsSSh0HrBw881q
TLSH
T180E1107890088B7F74B6776CAC6888316AB2013B77BF68D750B65484055CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\prefs.js
Size 6KB
SHA256 b6ee682585b01945b18374f900a17b4a5281dc19116ea5e3f2aad2a533fad172
MD5 672dfc4a15aebed250376e8de9d92292
SHA1 0328d535c4681fa967cc1c75050e572c6c483e5f
SHA512 367e2ec99a6fad9b452ff963fba666296696dacf62029630ecbc9fe924cbc1ad1f34df8f4a9ae603e75b5a037fb84f01224bbecc07bf84a83008521b323f61fe
SSDEEP 96:xHV6UTUWxqGqa0fmDW1zScaSSl4dv9jTbmFXnS6HVxNUoBw88u8L4cn3VSpp:r6vRLfmDWZaSS26U0HrBw881q
TLSH
T109E1207894088B7F74B6776CAC6888316AB2413BB7BF68D750B654C4050CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\prefs.js
Size 6KB
SHA256 eb915a3cdc1675089d1c0784ac812e6f231a0708f4a3e889595b9c5a31eb7dd7
MD5 92bc68a7f70d91310f02c636ffe2aed4
SHA1 ba6897aca7d35b0754ac4f0fbc3da567209b24c8
SHA512 3bce0df784498b6d08cd2f6c9cf15f392b5356ef51b7dbafbde38e2b841d1d210c6df6580b10e1aa37adf9fd4f7a8c5463529408fbc254e991dd75ee0d0e1aec
SSDEEP 96:xHV6UTUWxqGqa0fmDWObzScaSSl4dv9jTbmFXnS6HVxNUoBw88u8L4cn3VSpp:r6vRLfmDWGaSS26U0HrBw881q
TLSH
T18BE1307894088B7F64B6776CAC6888316AB2413BB7BF68D750B654C4050CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\prefs.js
Size 8KB
SHA256 15bc8d827d7fc9a3892caa6aff8b78c316e7dd344ca5567ff02b4ed76d79b1bd
MD5 7f1074d9dee706faad697f8464a49b04
SHA1 7c2dc092343c83c262d1626263b3d2f3245a20c6
SHA512 a271d94d61fab810b26930399155d000a1b37aef98d3e32c07b763952f5c0d80c94f84570d936842cb68b96d36047a0fdcf65a8a55d4774a4361aaab4fa43979
SSDEEP 96:xHV6dTUWxqGqa0frDWObzScaSSl4dv9jTbmFXnS6WRv5xNU8Bw88cI98L4cn3VSn:r6KRLfrDWGaSS26URRTvBw880q
TLSH
T1DA0200789404CF7F64B676BCAC688D706A62013BB6BF68D750B944C5460CF3441FAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 99f6ed12609b24e19005e6afa2ccb877ec50689d3cc8f11b1d31697d9badb7f6
MD5 b388419d52af0192557d0b4534572e3a
SHA1 b05e55bc36bde619346104782fcc00c25701923e
SHA512 c22e7f89ec3ea8aa9232cce7559e766c5ca602d50a46f9008c1be967147be3b79560fd9776c7510741bbe44ad47c95ea2ae91232b815d3379d1f49138d6cf623
TLSH
T11A21B786EE2F2CF21788820BD0C46FD0E75460554678E0F0AC2F520559D884A31D9A49
MD5 SHA1 SHA512 TLSH

Submit Download