e9c5edc90e2c3084f3f24246f94e2912e14162cd6ce63be895bb075a3be37cb3

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 3.0MB
Sample261102-a6evmsgt2q
SHA256 e9c5edc90e2c3084f3f24246f94e2912e14162cd6ce63be895bb075a3be37cb3
MD5 c9feca26f8e7cc0090e18c9d3382cb2c
SHA1 045e302b9d26ea04ec88f6effadacc7b601bce21
SHA512 42e917f7a54f2502cd8944074eba0a04ba6cd23980e6639186bc1fc3fd6a381025a50299bc7d32498b781c1af5a7ab20f6d0d8372a37e111122ce12f2e05dc84
SSDEEP 24576:9bfbqs4YskoVVtE4i0ZJp0Rsivg+6h55H863IXSHaqsqjnhMgeiCl7G0nehbGZpv:9yHFVdDZDfivg+6h+SHa+Dmg27RnWGj
TLSH
T13EE5080673F807D9F1F34B7849756A1598B6BCA9DA10C39F15A1710E0E32B988D72B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3480	elevation_service.exe
1092	elevation_service.exe
6112	maintenanceservice.exe
1988	OSE.EXE
5928	PerceptionSimulationService.exe
244	perfhost.exe
3420	ReFsDedupSvc.exe
5324	SensorDataService.exe
2736	ssh-agent.exe
3080	AgentService.exe
5536	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5d17c7b231e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaws.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac5b5707646add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009aae607646add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c5e5908646add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8719d49646add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092019649646add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
3480	elevation_service.exe
3480	elevation_service.exe
3480	elevation_service.exe
3480	elevation_service.exe
3480	elevation_service.exe
3480	elevation_service.exe
3480	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeBackupPrivilege	3420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3420	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3080	AgentService.exe
Token: 33	5536	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5536	SearchIndexer.exe
Token: SeDebugPrivilege	2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	3480	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2576	2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5536 wrote to memory of 4572	5536	SearchIndexer.exe	101
PID 5536 wrote to memory of 3376	5536	SearchIndexer.exe	102
PID 5536 wrote to memory of 3444	5536	SearchIndexer.exe	103
PID 5536 wrote to memory of 5952	5536	SearchIndexer.exe	104
PID 5536 wrote to memory of 3808	5536	SearchIndexer.exe	108
PID 5536 wrote to memory of 2368	5536	SearchIndexer.exe	109
PID 5536 wrote to memory of 5128	5536	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_c9feca26f8e7cc0090e18c9d3382cb2c_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1092

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6112

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1988

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5928

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:244

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3420

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5324

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2736

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4572
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2368
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8549f85b0650c032dde8ee687b1585e130ee2454cad0924a6d3b559fd321dbbf
MD5 1ff3098f7c98838a753e3315ac3cde08
SHA1 01f528420b6d2be0e650ce4127ba58ef8b6342d4
SHA512 82747388a3339e83da4b81f8e599427e97037cd7fad4c98ac401bdd35f413b733d657e313516fbaf83b875e84b4374ba968f6f6fea62c147832b9f7c428de78d
SSDEEP 49152:vb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnyDmg27RnWGj:t3q6sjBVD527BWG
TLSH
T13BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 7a3845f20227c7709246be9228c45dce9c5535e5efd401b8be3d5c6e721bee7f
MD5 ad3e1b6c3008942c3def4f94be3c2229
SHA1 30266eaa533733b36b93677a99f779c39b6b2ce0
SHA512 3e1a2c3d3698548f02f6d6ba4f6403cd770d2028d8e54965a4bf81b64a65ac2d10c833998668ff238a97009b42f4afb95d779f9f135805b10dd8bb10f5ceed44
SSDEEP 24576:QXYfDtczAlsqjnhMgeiCl7G0nehbGZpbD:ntcsDmg27RnWGj
TLSH
T151650129A3E408F9EC67817CC9A2C515EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d3f1cdf833ec50318b04288124fcc8dd9e995c21e3a0990b4588d43dc00a4c48
MD5 cf00d1ec1974eee1a7ba02851a55e0e1
SHA1 caecd61e32fc9547169854944d23f3f2cec9dd99
SHA512 3e30faa88acd21181f74037ec9b89e5588ef1081f1051287d0b15d91359c20d8aa97321c64f65619e0f1c6bd175aa946621d53107da52631f91deb585144ca39
SSDEEP 24576:i0Le5ji0hmxxrMWsqjnhMgeiCl7G0nehbGZpbD:iPji0AjnDmg27RnWGj
TLSH
T1FE859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 20f602f31f881eb1b4a64cd2f3890da2b507baf512b8869b223dffbac98bd599
MD5 9e64cab232b7729affcf7a996b22ef1e
SHA1 a0aaa50a0598265f6632b76457a8cee9664d1d33
SHA512 a62d0d53be931d70aa675bd1b34e27edc1d7962fb1649ef5c8f3b18c079ab2ac0edbe78b5546226da489e09ddee43157ccf3f4c06cbcb3d4cd0c2c5c8f716206
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWn6q8wyuAsqjnhMgeiCl7G0nehbGZpbD:w/ezSC6vUzPveHjy7Dmg27RnWGj
TLSH
T1D3755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6b6d034a0c389b9455fc8f2f09f939adfc5e050c8feb555d12407765a8101917
MD5 0e1da616c1455369e656c3cc0f5c8676
SHA1 cb3c6d902a668255381f90b00519d08ae85aa0fa
SHA512 db3dd846b0d8485d2940366f67419dcc818071975750da667d3c1007fd8050157c68b19f8e0eeb3931cbe8e2c0bcabfecfdf702b0220f7f8ff21a3baa674ae10
SSDEEP 24576:1VbqPb88hv/l+YRsqjnhMgeiCl7G0nehbGZpbD:1VO88hXl+UDmg27RnWGj
TLSH
T1E3559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b7445bd607db0972ccedffee9e35c588c981f490de869cd0539cbbbd4b323833
MD5 b488e0f4d5d9f8af7e63682e27e8d759
SHA1 627fcfa84f0430cbb375245a66f8c832c9c7847d
SHA512 a9860dcc364f726084ea1a67e67cbacbe44b59fb246b5a7b395ae4c67e404db0c11e7e50a14f4f1d9da763ee6c0baf533cd9b03c942fbbc54c2b24e903daea1a
SSDEEP 12288:cLCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cLCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC4523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 0f62597a6006ffdd677809bd73b103f31618540c8313e527b40a4bf74d3ca586
MD5 e20a8fd1e3260694833447979ce15b01
SHA1 9ed952a4f0776791c2cfd3638e32022f3e0fc042
SHA512 1c3ad54087239fb2951e49b353f42d690b4877893d9ffe30021fd8f9dee52670095481ec1b37c4b8a54d78cc8404c2616feba531450df6ff8ca3afb4d38f0309
SSDEEP 12288:BeBNUbTVO86UJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:BJIUJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E665CF7BEE28FCD2C27A8DB85791C600E76278314B61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1058d4858537cf22fca6f185e4117e2f22f076ae526083735bca94699c35d6d7
MD5 5c4d90f30ffd058bcadc84d8c0b669a4
SHA1 885ed78d5854c1a03a312a58d33f15c5ec01f496
SHA512 5df477c1492493a72a85f05faba0c72115c27bc60816aab51d87b38550b4026fb4f0b483481a988e365e333f10b92e1da51191d4db16350e833d4243c41fc3b5
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH4:+QvGAdlCEL8c/DRNw5CMD527BWG
TLSH
T129266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 2207b1f16ccb46f4d407f394ee439d649e1c1ec0d27eaf311a8c93bc16afd3fb
MD5 1a72c042e357508ad11e8679b0fa0fe2
SHA1 b2c98f1a1841e39da70b054d5276dd535ef3e8a5
SHA512 b659ba3c5ca9a8c156fd4cf9b326052d8080119c94027c7ebb0f6e6962b6b4e3842fddb89bda8751957b8069316ad10e233d7ed0bab00d2a8f95237cb585d989
SSDEEP 12288:+AwSfxL/2Dc3RDLLmt0LDQewsAjzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:j0ewsAjzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C75E031FA74E036C77B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 409608b28cd16c89c20009e234cb1c896ad3cb5081cbaf5251690ced6d2aca4f
MD5 227006bc3f1b9cb8da3f6f466cef9e1d
SHA1 9ae8e492cfc22bbc531d2867ceb07200e720ffb5
SHA512 72b03a0f8436de5a37ed67df489052550b1c20de5eff79df305e3459e87185be42e28dc56dcc9f8e751ec80fa1ab9fad0e60f7a323afd05c20ff7de512ae8ce3
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHvVQBWG:2UEtQevvqc2W1cpV2tI32mB
TLSH
T1E6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d42fcdbece3de0b93803a3baeff59267f6f7164ce13634c725c5c50e42a55307
MD5 69416ccf3a4e332e152689d1464c8373
SHA1 c546b89d88b9bedb82278a3eb0fd83b2ae4bdbe3
SHA512 949286750845db5224cb391ccb77743943339d811e9f80986f1ffdc70bd81ac7ae9d5470ab4964c4449617871b44d26be2d7c42cb48f5d7bb7cea6ef8c6fb855
SSDEEP 49152:DCbRquA/m2yL5zTfFiV+XenmE3/zXDmg27RnWGj:8oquVjnmQD527BWG
TLSH
T1FED58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1d1a94d9a12152f527cb84e82e44d36a99be36fed3fa93f8f113e05163775697
MD5 412f2f4cb3cdf8f4669a7e1acabe703d
SHA1 6d8c28f6cea1de80ffe9fca092862ed9aaf772e1
SHA512 35263bb2092bd6ad22177ce08893fda6da0b1872363eeee7c45af3cf0791d6fda7a8589bc07140bc81be739cb9dc36a5685a8533d9ca8aebf1e5bc479f4be46c
SSDEEP 24576:zAhGL3IFoiwtA5l7S53UsqjnhMgeiCl7G0nehbGZpbD:zAMUFoiq5gDmg27RnWGj
TLSH
T163359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 f816335ec530034534739dffb83e9d4b3b1ae5182cdda0efe96bc61925c2ba5e
MD5 a8ee1d072371274974c36bdb3ded4504
SHA1 2df8005940062b98b6d094a9e209ba30b79e6048
SHA512 bf7b6e40ea5dc25d0ec97b58221b4f88a626b0bb71186565ba54e631d17a7e847ace4fd6553575e83ec89699ef2f5f10f6d1d97fdf85aa01dc533de9d1a51929
SSDEEP 12288:ymw5HEjsChNVBFgl0WDm+CgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:rwu4OWHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19665F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5445344b520bb6224e94c5ade5bb8f6c61eea046ebb84c0ed6edf0475f8923fc
MD5 2ba2ff565f73abb006bd2534b9ec2465
SHA1 d53ac68d19b7e0c030d4e0f3c241833ee136b0f7
SHA512 f3715d6e51e43b71fef78ba63df9d1bb7ad865462ba0a3b0dfd8a64abb927b1057ecc0df390ac3c3a6a1ae8a92d3c6b94587d9330aa548d9ca7580a4e2460814
SSDEEP 12288:WeZ1IyDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LZuusqjnhMgeiCl7G0nehbGZpbD
TLSH
T12E5512AE239820FAE163417CC5E5D609E7337C62673043CF16625AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fcd1252ddce84b1e68c71df696c447bfd2b0a7364c48015edf4de373dde24b44
MD5 cee90d0063d1859cb6d008edadefa4be
SHA1 33350146b0b6469169d5ad9301440a738053cb16
SHA512 b745d1e92fd5fc38edf624763da545ca5d9cc7c57f5bab69706abff564e97ae71757124de10130a98c699c76536ad734daeb024c1f560a9776a7b78a2e0dac67
SSDEEP 98304:0QRQyi36YOcPbLvw2gAf+PN3BD527BWG:bQyiKa/X+PNxVQBWG
TLSH
T10B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 701f82482637eb29a78f1c4fff0a763fc5dafeb1ce658fd2edb5e2ef73115d8e
MD5 0e5466d817e184a50492e715d86cfc1f
SHA1 451b4f135495696fd0d675f23b02fdde5f0893eb
SHA512 1a639126a80603feb828a0841921ac49d6e302e7acf32f6c5970d1e99db2e6538d9db72ebe1c0eda26203614b1cb76b488261056426c2b8478a20b551640ed66
SSDEEP 98304:dQRQyi36YOcPbLvw2gAf+PN3BD527BWG:UQyiKa/X+PNxVQBWG
TLSH
T154667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 25a990d6a38012b0910c76d45e119bdab735396ed1f81d27f8efc57f0597c8ab
MD5 7922560b7e4b42da041a8cd3f198c16d
SHA1 d0fe42d689b5aff417aae09ae361535aa61af99b
SHA512 f2c2081b947e4a9e713689cacf14894d6970f27f2619ca0199e6c6ff65f24279e04642dfcaadec3f400cccff98d8034c12f32e67c5fcf31dc3bd83f3c045078b
SSDEEP 24576:OwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0esqjnhMgeiCl7Ge:468Qg55nhceWu7PNU3/nDmg27RnWGj
TLSH
T173B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1671a6dcba6138716e7f1040eb3dd2f920c35459ab7450fcfc31110278ea3661
MD5 6bbe7c535862880d64fb0b1a30edcdaa
SHA1 21e1b8dbffb721a149d0bda4c4c7bdd71d6cc560
SHA512 a1c66332cd8b85ffb0bf2847aa0e74f08a96e0758d5365797c68a1ef68bbe143317cb4bd1210da1f36d93935653f8f3cb973b7f4a37654e94e38da62de6499f7
SSDEEP 98304:My5112gYy5azzVvt69nLKnhZGD527BWG:NLIHEWhoVQBWG
TLSH
T1A2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 919d9b61a5307a38427b456f7419fe4261ed399cba0f4303b717336ae1af8ca5
MD5 baf2d9dfdf84e5318c1d9fe8027019de
SHA1 7ebbd4c3b24282fd26caa82fcbe5835aab168843
SHA512 5dc3de96e553b9b97f784a52c7d82a897e67629832b818fce27b28eb9082ba81cbb02c083755f8dbd7391de299faf3d6d66d91c0afd614d693d74972694f635e
SSDEEP 49152:YB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glJDmg27RnWGj:yu6Jmdxd2dJD527BWG
TLSH
T1B1D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fc0e1e83937201521f287d1aca439c1eba4281788b72e89f040925c7db6fc660
MD5 11cc102c10046808503316e69ba2cf36
SHA1 f72b1a7cb678cce4d0daaed2bfe63c86c3f73cdd
SHA512 390eb4566b86c4b5546833920d835e1e3802e10061de7d8512e88675475f780ad007b0099cbe3b0b12f6a25dd38138a7ebf72c7c9a5c5e169886b7a25dd2c71f
SSDEEP 49152:91hpsNoJpF1A63U44CwH7R4xtDmg27RnWGj:9mifPWRQD527BWG
TLSH
T108B5BE13F2D800E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 991eb19f1f5d8caa05e02307a20a7445c886ec0425947b5f244cb4c2d68fdc52
MD5 66d0144f16f332bac8044f2ddc3b6bb8
SHA1 0bd8b42c203431c520eb541d4971ffaa6430bc41
SHA512 2b83437a6910e6123d2b6e033e43328da9ddce8d6dffc77a2cd715e83f2f215ccaec968ab7ccc109a101fbc509673ae8216b4ebc017983496de6c0779a3c768e
SSDEEP 49152:LSuZQIY0Be2KcRVtOnks6NMHqCDmg27RnWGj:Z5dKii61CD527BWG
TLSH
T180C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 468b033fa013fc6a68213b21fb4e6e9b98a7a004871c710b3b7aa0ca9c3da852
MD5 82ccf6d28306ea7b56fddad3b535146d
SHA1 11439c1f367304ee66d8a76ab27f0a64baac1775
SHA512 dc6ff35b163595d368c96a53e5faaa51e739f0bb5841a6fa26f51e323b4735bc78585cfa4ba34aab2258883566be0a8ff685a4617f1c193036bdcd86980ea96d
SSDEEP 49152:OhtSn8EApI0fig3giDn0AP5wZDmg27RnWGj:PX2imphkD527BWG
TLSH
T1F295BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 76b595ad29f78547d53b2a6014f0cb4625890ee3e8aa08cd72881439192fd41b
MD5 8e7970aa796ce4d03eb9ebf36d0b306e
SHA1 47ccbb30438adf9d22407aebe87ce7ff23239384
SHA512 e13727b9d6a1fd9783853ac1623907342f2b0d951ec59ff60af20cf90349843d4ba1b2d952f6c4b115c1a0f5e5dab492805432967a97cc6d193d24252522f059
SSDEEP 12288:96Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:96sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FF4523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A677CBEFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 07a1a5c7d4076907a260a4d7806dfa69bb1cb7eea0be446036f34aac8bb734a1
MD5 62c462769f73b535f4e82a2674ad7cf3
SHA1 9d4f36715e462b564bcdd2851314bcbaf2fc995c
SHA512 bc9f710c1d3c3842427354543aea87a0b84a1a02445f46883a47de913b30cc94ca5bcefff4db32af0efa225d67390da45b30ffff766ef86125fad48b6a251620
SSDEEP 12288:NvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B44523BF965C41CBE52648B5C3E5F10DAC073E5BE92004937AA77CBAFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6aa33f3d32bb77d35395c31169bbedb54aac11c837f6a2d44d2ef0c6ada047a2
MD5 254a09f4ecf7d4b33c4f37ef66f549ab
SHA1 30d9fe11cbe3a4f75b7081eab63563348c9ea553
SHA512 d311d41c7c8226074fd579cef02d07c9da4a20923523b7dcffe23f65cd469896149e698decde80706bcf6731d57f4fdc0fa0e954f7764e2618b32540a133f155
SSDEEP 12288:4BXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4BsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1564523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BAA77CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 168ea03411909bab33a57a93ec1471886a84a31c41c513b1f358f9b690cc8520
MD5 ff0ce0e9c44d941b1d3a1f567f57491d
SHA1 3f11124b57dee9d75622842af94af7c9865fb50d
SHA512 1044e73c5d2cadd601ea31f72021a3d10c422c113f1b6e4163d19cd279c933e88dafbc97cf7918634f3b49ba00b8029562e4ae5ba4bdc44730547c89f06fb824
SSDEEP 12288:sV0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18645237B675C00CAD83685B4C2F5E11DE8237D96EB3005DB6B532CAE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1ec41cd9c93afaae9efe79264f9766dcb8f0f1fc94f5531fc99c589e043bff8f
MD5 f0c810672385e68412b39cdffff28106
SHA1 730719a3c62846f687b34467524bc5c4592da309
SHA512 03fab13a0a46291e560498d39014c82084f699ee7aaae77e1a62171fda8bc8db053dfa6158fefd0a9b857f977b31c1e9eddc6e126b8fa5daa7e4a0bc1ad34f18
SSDEEP 12288:6cXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6csqjnhMgeiCl7G0nehbGZpbD
TLSH
T1624523BF965C41CBE52608B5C3E5F15DAC073E5BE92004837A9B7CBDFAB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0d790e25809e6d6f8bcf36f5c937946f4695ad789cd171892d0534ceb4b8fb95
MD5 2e748e17fd98c0fc537a9609313cdef1
SHA1 07301568cb25b2f3d3c9dc138772ea0aad7ad3d3
SHA512 485e8fdbaf551da6727ece44ce3b4c3eff2e336ae10f6d77bcd7d361602c1ee46897ae0a278f658abe8f0ce276d8869cb8360d1629ed5c9622d2aeb1604cca41
SSDEEP 12288:WLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18B4523BE965C41CBE52648B5C3E5F10DAC073E5BE92004837A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 94a70a5b66d08577c82acca15811182eaffd799962ce8077bfd7d05db29bf8df
MD5 eff179c16f9052dd7562310f33dc474a
SHA1 abb05c0f63a9e70e640cd1079c9694d6afcbd0b6
SHA512 71baaf67acc252ac21691a0c6a176fcb7bf5eb56bb0b152539f65e6e0741c4eb0a9c9667b022521137c37970dae2040ba9cb78271fc362ec520dea30bf98a3b5
SSDEEP 12288:+3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1694523BF965C41CAE52604B5C3E5F11DAC073E6BE92004837A67BCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 dbb1d16e76a832e008545542f4357ad2d563ee4f1d729f56d9d5b9e7c618de30
MD5 3c280fca2b2753eb7e2a40d3a8c2a8aa
SHA1 fd403ec0240ca83f2dd77f860231ed9f00cacd78
SHA512 4dde32384e243f5a91cf6a2654aca5f36ed6573d6919459e803042297211575ba32f52e94117dc44d895ced42c8191658c5da57ed87807b9a4475c26096443b9
SSDEEP 24576:OZMRzFVSOPsqjnhMgeiCl7G0nehbGZpbD:OZMRzfPDmg27RnWGj
TLSH
T19D6501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7ea55349f344e11eb0a248aaa919f0b77c3cee1a1e1ee8c7bbcf416d33c6c388
MD5 b429ab8145ca49ba2395ad03ee5468c0
SHA1 4ae7fd5be86d95d18749672d54dbcf82c7228e21
SHA512 8d2776716dc790173400ea941bbf51cf910f3fa94956f381b4586fe75b6d08bbfff24f1e841e1a7c615df993dedc2e82b4edb8189ebbf408974e6e0c4ae48eee
SSDEEP 12288:e+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:e+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CF4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 00502a00457a21b0a42907158940c401848f05c31ac83c286ef42e9a8bbde4c0
MD5 81331dbe8a3698737cb280e60c080211
SHA1 e46b11f6bca6a6729b960765ff3a61a6cdd192ae
SHA512 77361814c2088dc86b50236ee5ed968242ad8ec3824242c899e2ac99866901a1e6b4939280ed9f200c5582dcc5761d17c067a45af177f8296e695d16641922ca
SSDEEP 12288:gSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B4523BF965C41CAE52604B5C3E5F15DAC073E5BE92004837A6B7CBEFAB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 825efbbb8efcdc9abfd21ddc45cfd80c12b77b3570ed93f00fe5001ac12bfded
MD5 d818144007fc638e0e45de321be5804a
SHA1 3eda95710218bdefa52053bc3c98cbd9f66b409e
SHA512 9eaec6f6f9a64519cc9548603c7fb3219584f2774e3ddc886b5b95d794a737922f6e6520562ad46d381f792a9cb277503e43400b989da1f19cfaeec590bae33b
SSDEEP 12288:uyPz5L8DXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zzyDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14F55125B73A530F9D1378178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ad5cbdf6a6e61b388239625281f335439f19c6be1b80703d70ccbdb23c1e9dc2
MD5 148c7ca0a40f0ddf94586553332362fa
SHA1 6696ad51bf9b191b0719c4f72e465b25b741a4fa
SHA512 6539366bf9df61713027aebab46d58c3c37b6fcf4e126d24320aa1492188e182f32bc6b10b89501860330c4e65fd516e76a8d6214e84b792e5028864a8e3c8f3
SSDEEP 12288:I+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:I+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E94523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 acdac8ede9690ba6b5ff9754a83905b2e048f54c080681a497ad96ab93695fc7
MD5 8135c5f6c990a605916c35c29be3ce22
SHA1 4ee187dc40469b1a45f22a08fbf87b84f7ed09a6
SHA512 de5dc87417ffce5de281bbb0ab889835548d8b9a5976693c0322c91c0e6a04cbbfaa5f4221706ea1207cd4dce2248c92a903734e544dcff51d747eaf4eb8beb0
SSDEEP 12288:Z+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Z+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1784523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 2e37f4ef2d2efc2cd24193a77908c0e843e0cdedee807419d0bf300b36fa250e
MD5 043eeed007485ac7a33c52318fb73396
SHA1 465b285924dfa99fcbc1314432241e56922e33c9
SHA512 a3be3635fd582df0eaac7b2058abd8ef6813c09186d773fb463ad66fd57be71be6467ab1ce4a2e1698d8f4dcb630d1cf5c54039e338291e40a60957fd0d6842f
SSDEEP 12288:+yPz5L8DXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jzyDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18055125B73A530F9D1378178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 dcc001ed73b6c2f2bb19d117b81874dafd5741a5b7abbc79b9225dc1001e8717
MD5 998612939422efe0347240b09aca0e25
SHA1 c7f37cc9d2815e7232a296441652efed0ef32bd2
SHA512 69a85af4815bbc05fe1712b40ad00d3628e2caaf02d375816e65e11f18d330b963917c8a82286dd18e8270bc28954b5cfd9829758931c45f8b1c4b863f563847
SSDEEP 24576:xTDaLl3z0zDxsqjnhMgeiCl7G0nehbGZpbD:xTuLlj8Dmg27RnWGj
TLSH
T1BA6501A9B35018F8EC67813EC965D90AD5B37C5A0B70CA1F13A5366A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 ffc107446406c7f7b0e2d56b4d97500f845238e23e3df625c8e049cce6b2eb7c
MD5 474d01cc72a79df47e9bf97a0cbeaf50
SHA1 b147368357c47045564d54bc11f1edaf1b5c8923
SHA512 96a8741f5240f397d5e50d246c777d7f148cc1babb886e59be4422a2cefcb801f0256ca9fc23f2224ddb9a8d7203fca646f42081ab87a4de0daf6f37f88fbbcf
SSDEEP 24576:13vd9CHKy7GZ9sqjnhMgeiCl7G0nehbGZpbD:Vvd9CHKyaPDmg27RnWGj
TLSH
T13C75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3e995b1892521c9e353932d8adbf85c97452c96a9e869cd909e7bf3ef9c1a23c
MD5 bb549eba1491c221c68928190b06d901
SHA1 6fa56641d31c1c22060e0bb4b8fc2ed436b66d71
SHA512 27e8f566af31bf9ac64fcbbeb53f7b7256d33c18cf028b2a4b51294ddd27d3b328e3779ff7dd742cac41bc897b6d512f34b5109735306d78711f9353a8cc0f1b
SSDEEP 12288:VhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1304523BE965C41CAE52608B5C3E5F14DAC073E5BE92004937AA77CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2a0dbead8bd5f7b944f606131cdb9120aed378cd54a58e14b680a0793d1fa55a
MD5 951451539056acca363b9386b0661417
SHA1 46bc5d528c8b7f6e892c460d77432ee1beaec838
SHA512 88a5d1ae8695cccf50e1780378853623233cefe0af807d65fd62b1ef9c3342c4be467f5253be2b600d61bd08c2d308b49ffe529901f4db73ac50b7058c292d4f
SSDEEP 12288:ijXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ijsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1854523BE965C41DBE52644F5C3E5E10DAC073E5BE92008837AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 6327ee7333835eba2d176ac5f25d68609519a0ae96e0d33247ae7dcf371c33b9
MD5 e6be2144b5a640f6aca317055bc5fda5
SHA1 8b116982837d8c9bcd902f163861080cdb6359a3
SHA512 f018da0c95101cdb8db73dda1b3bad22c6fe02ba5c68dcbed96d07ec5209d88db69ffda4aaa1089885758b970bad1f16a87eb728e130388af7c084c2c26b4646
SSDEEP 12288:MIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1914523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BAA77CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 4c59be19f6af9c0f2258b3ef1cf9e1998400aded1afe81182a8377fa5c2865aa
MD5 e3c486860ddd96bde120f45575f7b850
SHA1 d8440c6af572bc8418139a26580b48014a5112cf
SHA512 240fa68a5c99a62f96123035970434371f546dbe4cc29aa74bb6a3cbf67f6918f22c3d4db61c2f3f5dbcd8119f66959e5598d74fe8b75f37be22fc4197cd24e5
SSDEEP 12288:p+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:p+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F64523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b5b9df62a4c30962743ee986c8a119c685c9d71b6ada13a45e5e4da7f2db9b0d
MD5 c4df15e541f3361aa494ea71587decb3
SHA1 a359f629f800dcf0cc67dc4b4bd3d592584faab7
SHA512 557c04f9e99551b3878228b1e4f4c9569f3f3a66ae3be90f5426f321aa9c86efa0dabb75b89c4a0efa16750ed211a07a566740b031890f782b97889e9ba693a9
SSDEEP 12288:whXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:whsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F84523BF965C41CBE52608B5C3E5F15DAC073E5BE92004837A9B7CBDFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d027280e6e030b11be1687415a1aacc56285dc5d68a6987c653bfad1bd745f6f
MD5 b613661e9d51a68904144af8d2218984
SHA1 4eea8816e2c256b0837cc7837e4ec4e022cccadf
SHA512 c1cc8a92eb5ba66972cb6fcb96dcef044d639230d250fe97ede0b12121f65db50d5d60f224ccd8c60daa202053431e6f66f3ed94517e1c04330eff81192a634d
SSDEEP 12288:AGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1984523BE965C41CAE52648F5C3E5E11DAC073E6BE92004837A677CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 cce2787c826dd29083cf34ef6d67300c44bce7c5eabbd9eb08df0fb6b88d2cc8
MD5 aa2d06a5a67e67d2835746df4a43514f
SHA1 fefdfa474eb633ac61be768597e9defc2e42f084
SHA512 16976a19be16d5b5133e5d3eab4ecf8ef87d88874461467d95a307ead9b65cc8b391c45ce52dd13abdcb970774f02b71d7380b5c5006a91b6500c1d6c61158b9
SSDEEP 12288:mcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1254523BF965C41CAE52608B5C3E5F15DAC073E5BE92004837A977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 6660deaed3010d86de8b8b027f3289fba1e42b9e92829d461e653f14f61aabe2
MD5 7a10948b2d69575a0d769e26ce39150c
SHA1 13a7b4089102c44e4caefaea82c129a4c45bb163
SHA512 0ed02ff199ecd239c23bca09432d5eaf811c429e9ffe3ccd60d5cade39c02971b9ab4e4a5288a85335475316ddb4a3beaf67259c0023dfe814ecf482e189fceb
SSDEEP 24576:yfwvUk9RX6wkyAIisqjnhMgeiCl7G0nehbGZpbD:iMnYImDmg27RnWGj
TLSH
T11285D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fdaf294b3b2f4caad297191caac497e8647eee2260c868b630a612fe427eb54b
MD5 2e83f2670d82aa096bde0db1b8cd9fd5
SHA1 a4041bf64d32c08d1eb2f3f4783cd2bf71d10b54
SHA512 38574f43fa3da4c5362d13f44addd355af1fcd13e5be13a4fd932d36614b5ec9b73f7b8cbad0804e952a45ad1e8142c4151aec87276220b6aa3605a8adb52b70
SSDEEP 49152:5YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05Dmg27RnWGj:UySzPhD527BWG
TLSH
T177066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3836ff0707253b465289599e30d94cd287ad4849d5e88484d0b88bcc0abc778d
MD5 e0fadfe2d77d37c03e0b3413318add83
SHA1 5e8edc31eb2e1bc416747481aef5468250921122
SHA512 36e95b4302d91e7c3ba9ab45038d5c14b333cd32d7e1df145503163a5a76a9007cc5ad230939f5bfd8b2028a4d130f1321ca87f2099d338d634f9661ac3dbec8
SSDEEP 24576:447Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYfsqjnhMgeiCl7G0nehbGZpbD:447JUQjTirIhCnDHUPfF/JDmg27RnWGj
TLSH
T12965AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 8193db526c08e7e95391343c7230d7feb2b9aacee13ed4e5a747820b853444ac
MD5 d647875465630eab5f32829cfd466693
SHA1 9412fb597bf0976287b220a830e49357444e44dd
SHA512 9a4b526f75ea1bc61c09dbc5ba295d9598fc681690b665d5dcedc18c38bc865b2788a4de8b45ff475ea379453fb2117801919d45461aa8de650af12bf3239c4a
SSDEEP 12288:8bsfuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F955015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 743cad03d004ac832adb464ce391c3508dd3751b0dd06dc666ca3564ad088b6f
MD5 61c5f49f96b70c7d8269152eff119438
SHA1 bc260426f3fc70996c17b02cc0633e766d8f4d5c
SHA512 dda3a047b4b2398d52353ed790a4355a81d892fc5e89af48dbbb7b6ba0f17d638fc27b1c8d6a8ba117d148ca2990bcec6a706ab7420aaf238fef61553577a317
SSDEEP 12288:hQ2foU3f2qLXczUwKtIuNnhGm3+oyQo+rDc8CgKCVQv:hQ2AUP20czUwKCuFRuV5WDc8mv
TLSH
T1B2352810762ADB5FC6A940321E77D1CCAB707D01EE44AF0372C9873F9576658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 0425d9995f766e5d108c146b78462df32f6beeeda867cfadc37908f109375ef3
MD5 b8271c8cad9d6ac3f1e1b0bf732325a0
SHA1 194fe495fbd1816a694d3b5ca0239bf7c0e8b74e
SHA512 533e1b06063891b9881cf7c3a6428a4a03a03280ba096b6be5502dbdcaeb3e97fbb34957e315d066068fd393080a91807325e7b0f71f66430853584041abb810
SSDEEP 6144:RJTggu4hZ0YZhm2+zdzYRz5I1QcI1nwEzGKjvtMxtjvtMx8KpZTYva3h:RJTg8UzdzYRzbwEzGCfh
TLSH
T14145B6409537E78FC1BB2032072A5B8C6BA4EC0B77496F2673C5453AD86AB11B4B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b644654f97fb0459baf649e272a8b6e1bdb6a3b89c14096400314647f11f7d99
MD5 8c4d85a66fe6753a868900ac008a7b12
SHA1 292597ddfec4b58d3e215001861ef71e39896ba4
SHA512 baa91c2766888bde8eb077822592631f41adc0cc0ad33a1c69ab20f471be92bfc017f6ea410b8eaced6b092598827d6c7773addde4fdefcdf9857c7cb6363c82
SSDEEP 12288:V072Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A145237BD34C518AE93605B482EAE12D681B7E669F1004C3B91778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 bf12249f64925704fa874d7da1b5c95f4e9c946856bea685619227e20bbf779b
MD5 110db6230b45fba089d4772b93dbc135
SHA1 56014eb1ff89e53263f6bcbe289bd243c3014b48
SHA512 ad78ad2bef2cf6156d659d97a29b318634e60f14e092fcea734f3aad9c0efb6d22de414c34b33e614172a4b9b75c8c0ee49377be0f674bb598419e80afe7e7c2
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYAsqjnhMgeiCl7G0nehbGZpbD:Ngb4mBIBhGFDDmg27RnWGj
TLSH
T174659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 c61718a0cc1db050afdc80a0f9322cd3a219ff1b9a6b34637f4264e2d0daf243
MD5 2e399df65fc2fccd31e0496201c434c0
SHA1 e6f1dd352b0362355f870f16e182eeef0d11389f
SHA512 fd91c67343652d1b42f6138ef00b1987dd47b0b2fc415b5c495e1b30be1373f41e0069604fb22453c0a9a19841c5f996084a7b50c84b9417d38ac7ad6b7cad5a
SSDEEP 24576:rG88u8FpJqH1bzria7/mPsqjnhMgeiCl7G0nehbGZpbD:q7ZFPqVea7/UDmg27RnWGj
TLSH
T13A85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e2bb043275ab5d32783d939380dbb371d66d4f6dfc0f1b4d8ae87cc0711a2bee
MD5 f882adc5b72eee933fd07832be787892
SHA1 112b8faf8ecc3400ef1593d0c455f17a05adafcd
SHA512 0f4c33071687ab1d360a3b05299a46e11744718ad0ee7bc3a657cd2febe8b90cccc1e04b0ce39b988406aa385a477fdf24a5a40d6519696ba272daef0ce51f97
SSDEEP 12288:wHvUrBFrEjwaQbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:wPUr+NQbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15165F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6391fa56f4e8444fa292eaefa07473adbd9a5627a7bb0734c883af08d6377ee0
MD5 5814d7d7c0e2cc1c1cb37bbb53a1d572
SHA1 a565ad7d372961a7cce9902ec5fd24114ca2cb0b
SHA512 52114f412f2cb0c90187edab94adcc3032eced20b7db92d3af36b392dd9a95db851ad0aa4f57febfdfba30ad9b0d1cb6d8ff9086ff4fa27b2cd9f52bf8435e44
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/Dmg27RnWGj:OG05lO43beD527BWG
TLSH
T1ECD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4a05893c44ad0d94bf97c0cd9d328cd4e07877d2cde2593c1f1a73a726286f76
MD5 b0a27952353349d9bc045bee31d8d38b
SHA1 3009dfbe27236d221f90689b2a0fe53caf285a37
SHA512 4fd1ade525ddbf78d5e9951dccfac30cbed4ec4f573b78bfe876378fe99f3ebaf6730075bae06fa5e784d7014921666262749aeb5f2b8e5dec3a1e4b49b1afb3
SSDEEP 24576:zfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnFsqjnhMgeiCl7G0nehbGZpbD:La5POZ3BJt2pasx2+mnDmg27RnWGj
TLSH
T15B65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2f9351108330d928f1b90cfa696ec1cd4477e2c2959f052f4ff5933ecbfe304d
MD5 cd3dfee96257072f93c86ef28b4a8606
SHA1 b631549219fa367bcac26267624c94eca258a369
SHA512 f49f72e97a80343b2dbfd39614f425e5f4c1c2a0fe307760cbea5dda6a7af9e9ce60a99a34c0e88a851308d2c44f7e8b16691d1442a40f238ef9c81db5170422
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7FknsqjnhMgeiCl7G0nehbGZpbD:LNc/zEOVHF0Dmg27RnWGj
TLSH
T15E857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a7fa5d368a8fc54ceb0455178ca611a40f479a01623d5b4b2fad17951d90127e
MD5 89159a0e5364375198c308378ba35109
SHA1 4deab1ee2b62ba1dbc50a08b30808421c51d2a89
SHA512 dab08c8ad3d6879cfcf7151b316f6ee7a883abd0e102c6712eac55fafc1e2ca28a8870d965473f3f4461e5ba4cdbbe6d9465de66af04634d71935dfed5866e49
SSDEEP 24576:tTkNvNnaFeYhJNtmZBmZsqjnhMgeiCl7G0nehbGZpbD:tTMwBtOmdDmg27RnWGj
TLSH
T1A155AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2ae234e3044c21b17696176f9c217cdfe4dd8c7ef2d26854ae182ae5bc8abcc8
MD5 ed6566853b4b6c27e65c0733c4ff705d
SHA1 5ff8030ebcee5ab61dff2e3c6f4680c6af44b14d
SHA512 ddc2e2ca9228b11a6d5c2e6a5c75bdddd1170ec820f17d15769606c504728bf785e19eb75c3d9970a7f020b180c36558ac82da347b3e24439ca93dd53c060771
SSDEEP 24576:LD3FHshBIYQgAasqjnhMgeiCl7G0nehbGZpbD:LDVHeBIAAuDmg27RnWGj
TLSH
T1E775E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/244-302-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1092-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1092-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1092-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1092-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1092-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1988-272-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1988-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1988-55-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1988-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2576-0-0x0000000140000000-0x000000014030D000-memory.dmp

Download

memory/2576-1-0x0000000001E90000-0x0000000001EF0000-memory.dmp

Download

memory/2576-77-0x0000000140000000-0x000000014030D000-memory.dmp

Download

memory/2576-8-0x0000000001E90000-0x0000000001EF0000-memory.dmp

Download

memory/2576-7-0x0000000001E90000-0x0000000001EF0000-memory.dmp

Download

memory/2736-114-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2736-305-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2736-106-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2736-108-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3080-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3080-120-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3080-126-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3080-132-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3080-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3420-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3420-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3420-89-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3420-83-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3420-320-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3420-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3480-23-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3480-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3480-14-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3480-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5324-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5324-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5324-95-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5324-306-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5324-101-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5324-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5536-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5536-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5536-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5536-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5928-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5928-67-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5928-73-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5928-287-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6112-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/6112-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6112-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/6112-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/6112-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download