56076f6f28fb9257a0ee3b8b1b0efe2c9b02aee51a1fed787bdbc76f52831107

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 05:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
Size 3.2MB
Sample261102-fwrdkseb48
SHA256 56076f6f28fb9257a0ee3b8b1b0efe2c9b02aee51a1fed787bdbc76f52831107
MD5 e597da691ce78af7c18eb59ea6c2aae7
SHA1 cbabcd8cc0fa070270e9c790cb9e8a4eb345cbd0
SHA512 977d7cb777ff0c70d1f76de55cc05598a8b3113a4c09172108e84b538ab699eb67946c2097c55aaffa61ace99012a0ef28df1f9d016df31b828b58fad92f2713
SSDEEP 49152:GGtlq2d/Y4yXkvcW5pkK4/YLTDy7+GHVBK7B9TSEoQqQTacZ+p1fDWjzQgilV99B:SXkJNBfTUw+pgjI
TLSH
T13DF58D0EA76840E8E5A7D17989468646F3F278555B729BCF02A0476E2F737F04E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1388	elevation_service.exe
4468	elevation_service.exe
3168	maintenanceservice.exe
5740	OSE.EXE
4376	PerceptionSimulationService.exe
1892	perfhost.exe
5980	ReFsDedupSvc.exe
5176	SensorDataService.exe
5728	ssh-agent.exe
6084	AgentService.exe
4988	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c2f7d595612dd39a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034d600fa886add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0c70a3a896add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010f44ffb886add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006760fcf8886add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000884ab7f9886add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e8c3e3a896add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
1388	elevation_service.exe
1388	elevation_service.exe
1388	elevation_service.exe
1388	elevation_service.exe
1388	elevation_service.exe
1388	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	6084	AgentService.exe
Token: SeBackupPrivilege	5980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5980	ReFsDedupSvc.exe
Token: 33	4988	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeDebugPrivilege	2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2668	2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	1388	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 5568	4988	SearchIndexer.exe	100
PID 4988 wrote to memory of 2836	4988	SearchIndexer.exe	101
PID 4988 wrote to memory of 792	4988	SearchIndexer.exe	102
PID 4988 wrote to memory of 3744	4988	SearchIndexer.exe	103
PID 4988 wrote to memory of 4900	4988	SearchIndexer.exe	107
PID 4988 wrote to memory of 2752	4988	SearchIndexer.exe	108
PID 4988 wrote to memory of 6072	4988	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4468

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3168

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5740

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4376

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1892

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5980

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5176

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5728

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6084

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5568
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2836
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3744
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4900
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2752
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 817bb0ef4060cca50f95f2cb676e25351bd0bbfa944bf1ee0fcc5f2cafe1a7c2
MD5 8a99fd2079532633d7493c9a48f28464
SHA1 34962cbaf02b22bb1e8911c9feacc9fa09a7b9d8
SHA512 03a1290e7918758d8d9ab41e26feb02931940b5186560e609ad955e5622d8a535c841a5627ee88d84657fe1d426a0fcfe9b636ac50860e40d5660e3b03559d14
SSDEEP 49152:Ob+632BuPkFKRrdE6ohmstBhuXjfS4LWxn5jzQgilV995S1V0:Q3q6HjBujI
TLSH
T1FAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 50d5d69c89b05e5da8d8b27f60655f01bce8ccc3aa8f7529529bd6ed4cdbda39
MD5 c31850a090004aa1743844f015db4dc9
SHA1 01f91a9a7ac995ae7282059e0179ad8680072624
SHA512 ceb070c776aa929899d124432b434cf71060a1bf40848b2b671aa5c3514312f0db32b36c8983b2e8efcb371eb6f5bf664a4e8dd7352cbc55c7723aa2651a39ea
SSDEEP 12288:b1XLsswWkxy2lRq2czAJ8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:hXYfDtczAqjzABgioiNV99L5S1fd0b
TLSH
T1EF65F129A3E448F9ED67817CC8A1C506E6737C914760FBDB03E489261F236D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 f9ac76dd908ad007b42bade9b33f1f0d887765e88cdcc8bbd80745fe707431a2
MD5 6ce4a036cd836c63f5f7cd3490ecfc30
SHA1 fb47dff8ca62f143107f0cd878d3e95bd9cc0075
SHA512 4646824cf8efafc15beed31cda0b969c18cdd821ec23c003e5869ebf44b38aca7188594f7b024e6c58a8fe2d7f9bdf50a7d12da8e64c374f2606cb412892d2f2
SSDEEP 24576:S0Le5ji0hmxirMxjzABgioiNV99L5S1fd0b:SPji0AcsjzQgilV995S1V0
TLSH
T120859E56F6748735D073C0B9C5D2A68EE972308257308ACB4286C77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1d27944322b28184d136e4cf1b35f143c4269e6a05e2d4290e26191f7614ee0d
MD5 467748fd95a8d3f421c75504bd6458ce
SHA1 176bdb9b25b129eabca4a7fd03777a3597cc4b80
SHA512 1040cc3927b9cba1f3cac99ddae7ad57ea8111d97c77032c5eb0fdf170523a1ff554e70238cf3aeb90a2897b97e0c025c5b6db0d03c43014a458756c5cdb56fb
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWE6q8wyuXjzABgioiNV99L5S1fd0b:U/ezSC6vUzPvxHjyojzQgilV995S1V0
TLSH
T172756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5fdd9a526be7e1af5fd6863bc1831aafc8182994bb9cc51c4a40edd7c5b30758
MD5 1f5e610a543b9d1ff7daeb62aa77cc58
SHA1 9e83df1972a726d6bf8e5464b8017d3e938eab00
SHA512 592015081480289b5c3122e8ba4bd1eb8a2a5a11c7d69abce6f0b321404baf148980b362848de26ada630002f013027dd7233541b74638c489b0d76ca106d25e
SSDEEP 24576:qVbqPb88hv/l+6ejzABgioiNV99L5S1fd0b:qVO88hXl+9jzQgilV995S1V0
TLSH
T1E5559E66F574C331D073C0BAC4D2AA9AEE3234425B318ACB4246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c0be9faa7287bb7ecf18f4b8ded72f18c1117a0b71f1bd46f1e3c86bee2eb7c2
MD5 d8af5dcb09a5668c8402a08aa521ba26
SHA1 92c210905d78f329bceb67cbadef2f5d8c7ea9bf
SHA512 c40ba5b6c2b01f2bc8480a25a261fe514c15a05f0a07b3532b518bf999d24ce07067dcd8a64fe667b29c67059ac1b4a7bcdfbcd63f38b7c9a1c76327bbee6e08
SSDEEP 12288:rR48jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:rRFjzABgioiNV99L5S1fd0b
TLSH
T1A74523C79268C8CEF3750879E4A4F80FB0B36DA086407E9BC3E1286A5DB9DA1C915657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e32e69fdf6ba6e44a90354b89cdf5f9dff493ebbdae21c805d768eec3b4833af
MD5 a761cf484760fcb2c6084eea0ad5edc0
SHA1 0e38643de3b70f575ebc25c9d30f3db00dfc0cd3
SHA512 e579b30f10b252353ac05600a59febcdf86c267d578e28ca24a8c29605c12f3448c3a8eb4efc2ba24740295d3042533e64d5db90a0ba0c382816a820ab10586a
SSDEEP 12288:veBNUbTVO86UF8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:vJIUWjzABgioiNV99L5S1fd0b
TLSH
T17E65C07BEE28ECD2C27A4DB85A91C600E7B278704F51A3CBD175820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 549dd6387239d454ec44a98deb9798075d8c0021c59d29fa79919d55831d6161
MD5 299158c89b0311b0d5063f1765d12ace
SHA1 b1a260f88f47f9e8273445f2362710c19beedfab
SHA512 f45a5779e3b5afecd738d0478a5dc62278a12e7b6bdf9faf6d893784a53198980b9d4cba1286a24c8cdaf77a2589eb93c77aab74c84afd564d4801a00df981a0
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THr:DQvGAdlCEL8c/yRNw5CHjI
TLSH
T1F4266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 d79eee64a2b4ef999ce295663bdcce26b88906226474e6bc13760eafdf9f5cfe
MD5 6794554888fec6c60b844a180d748e23
SHA1 d27763ea22bc58a6210e0556c1981b87892a04e4
SHA512 42cfb24ec218db524168509c7a4ed63ae9b4c0cdc6f7911b6f1cc2764c0c17d9991245de46d3c5a9efe820656c3a3fb041ae92c8ab39e3b4556346317e538ceb
SSDEEP 12288:fAwSfxL/2Dc34DLLmt0LDQewsAjH8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNf2:odewsAjcjzABgioiNV99L5S1fd0b
TLSH
T19A75F031FA74D436D3BB0CB61B35D70A247DB9204B612AC3E3E84E9E59706D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 853afedcec8233b9fa3d4a4450be91e79dd7e4f097382f32b5a199eb368a7030
MD5 5f125757b15f26dd4d6deed8c854cd82
SHA1 ade66bbc91f171feaae7b898305265d7ecb23fa4
SHA512 dc5a180985446448e6ecc005f27a7ee3b7f0d722325fe6150977d70db95f60c608653194d05d73e58c217aebdaf7c30612a96b2cdbf63b3d69000f37ba10e0f0
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHk:mUEtQevvqc2W1cpV2EI32
TLSH
T175474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 222939df0d3c17e6980190b197d0a63bfe71cdf8c536ab5198510e574fb11532
MD5 e76bc72552ec0a23d3bb06e02ec72b60
SHA1 4c1a8bc41fe6ccbeb3ed9db77b8422ee23aaf948
SHA512 ce99220acc303d467210d8ea5a57faf83052abcfaf521deb8b4bec577c95faab560de1d40f28b7fc5cf56307f2665e877843f3c5b8312fda476d005f6bf11ba6
SSDEEP 49152:xCbRquA/m2yL5zQfFiV+XenmE3/z8jzQgilV995S1V0:+oqtVjnmTjI
TLSH
T1EFD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2b2c55b9e7a67908a758c35cc1a35beb699bdc947686fd87363e3168e384c94b
MD5 3e39e8dd47f530111da880b22b62fe3f
SHA1 1f0546e464387902a4a450811d88dc0cc9f1a9b8
SHA512 ffdcd15d285a071237dc2b2db7e55faf2e65a83405d8b9dce04cfc95d415561f9d324c25cb820aefa5f04af29b38e942679efdbe2afaba7c8bdb233f5e111778
SSDEEP 24576:fAhGLJIFoiwtA5l7S53zjzABgioiNV99L5S1fd0b:fAMyFoiq5DjzQgilV995S1V0
TLSH
T1D4359D81E7F945D4F5B3AAB899B69171EA76BCA65E30D20F1260C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 1bc984536d6814406d4904665d5c1a63293ce63d2d7b121541d5009660e3b379
MD5 bbdbe3a2074441bea3f8931a4cafa791
SHA1 a31630e050d35568e26b3110579e65b180877e14
SHA512 64f2c1561217dc648a0979bd24e93dd3446a79c1cd4fddf3bc74804d586280045f5f4686658366345a85f8955a6d73651576a90cf61be94419e407be3d0f67d6
SSDEEP 12288:Zmw5HEjsChNVBFgl0WDm+CO8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAP:0wuoOWIjzABgioiNV99L5S1fd0b
TLSH
T10A65F14672A84CF9E6678138C597D536F7F3BC112A20EB1F43A0C65B5F37261AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5ce48aaec5c77db88022403ff6f768cf6cb788ffce819dc3fd3790d88334150d
MD5 b50988d207f5ac1bab96eba50e254489
SHA1 a1d0331265c53f4acfd0fe4291bb1dc664cf709b
SHA512 2f452de82c48b07b05808f237a515de818fd99098b4ff28e5532cf28e0c383f677d2b1e8691407f82e0193f9a1b40ed35f170e9dcf9268a1c0aede5d4b2cd850
SSDEEP 12288:jBZ1IyX8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:NZupjzABgioiNV99L5S1fd0b
TLSH
T11255128A23A890FAF263457CD8E4950AE3B37CA2573167CF42A1056A1F77ED14D39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 19d9dd2e13bad179ea2e0abff7d7d27da95d9e75fe2d984b1cfefc3b1324501d
MD5 28de32b5eee8a31f07f75f48178265c5
SHA1 1f831954bb212d0fdfc98931e803a3b1f4a393ac
SHA512 afb830112a00bfbec76c814cd28202948dffc93654577857fa4c5f78420f554d929904d4a0dfcb0539c7794f2c87408c21be34028c49996281e37689ba5ebe6e
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:uQRQyi36YOcPQLvw2gAf+PN3ijI
TLSH
T181667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0e915c1738888671d1a9cde4e03b8ddff5051555fd3f710df8590d593b33b6dc
MD5 ff8723b226e7fd1f0407f574838aa1a8
SHA1 b1f711d66d09c0118f87576dce448713f4c1db4d
SHA512 a884707987ae0a1c364db87ce2308a19e2d98abc612f82c1d44fdb77c7adcb9d35cf7951a8c85f7c827fbe47d30d39b799f2497a5c6db6590091fc9c9e2826af
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:GQRQyi36YOcPQLvw2gAf+PN3ijI
TLSH
T174667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 58aed350ee46b24a6ddecfa3356465f8242b321baba615788f0364fce7cb32da
MD5 9a1376d1e2080f91107c25ea66013eb2
SHA1 c263e02afc2dfa5cb912ed001f2a66114d0e8c8c
SHA512 578ea9c45704ac5890007577d6da3727be867732e51907f33b1eba651ab6f41c60090c95050b026983839ad45174c29722d2f93e7f8e8e2128f74d3dd364e9a8
SSDEEP 49152:D68Qg55nhheWu7PNU3/sjzQgilV995S1V0:9thWRc/sjI
TLSH
T1C7B55933B2F60099D44DE1769F4A972196E27C718FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1fca609edbbd476d61af343befb03a8f10c61087fa87679bbaafd1881a5e501f
MD5 253592f45910055c4209e3ffc04a164f
SHA1 f8f68a0fa61c2c8d39583d6b9719e5490f63deeb
SHA512 17ab94a98fa44c6825a801ace243884cb2a72f84906bad162c31b5d371b5a9e4c8244c4de295c3c32c1b6e45cbf9fe09d9bcff56afd0521de49ee12339df41b6
SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk991:5y5112gYy5azzVvL69nLKnhZFjI
TLSH
T122167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 40578585a13b1866208a69fd6e3071952bc7f48b914e97e20efc298b15ddaf12
MD5 6ad4631fb32f0c204731f38f66d6c993
SHA1 e636bc05f1e2bad50b77d5bbfbc3f73776f97e34
SHA512 2ddd46d06359f90f48ba374eb0f5171869d311ffec1ccbc142e1436dcd105e7c37fb04245426bbf5fb270d323ae278a573fe7812ee31a1c4fb541a7ffd873500
SSDEEP 49152:LB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl6jzQgilV995S1V0:du6JmVxd2d6jI
TLSH
T1CED59D13F1DA01E8D06ED478974A9233F962BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d5550eed6c3d373cc13c956ac2f5b0f9f420d81d76ec23570e0c55cd14f9074c
MD5 a55643d8a0bbc267ec032117189da2c3
SHA1 061884deaf16839bbc6d23d8de70b0b0c8917219
SHA512 133b7698d4282766be0a1a897c2fa783e271714734fdd9082f9852fe1decb4c6d68b02bfedade89547fcbce8b65c9e69a800531fc59a892eeb35cc463a85c2e3
SSDEEP 49152:71hpsNoJpF1A6UU44CwH7R4x2jzQgilV995S1V0:7mifPbRTjI
TLSH
T153B5AD13F29900E8D06ED17887569232EA72BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ceec40aa8f3acf9523b7e02849e5a2f77ac2010cd35cbac94a2e0a0511909f7e
MD5 1cab915619e8ac32aad1e9b57b721956
SHA1 04944cf09551cc9c18838a70911a88915746a5a4
SHA512 dc946f0136939df868c5726e7e37c564545f3577846977a20c46c87606e0b5987508a042c483051dc64620ef1232cfd12dcd01cae67f0ba3c548602a748fb148
SSDEEP 49152:pSuZQIY0Be2KRRVtOnks6NMHqpjzQgilV995S1V0:n5dKTi61pjI
TLSH
T1F6C5BE03F2E940E8E0BED67487659236EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 83cc69273ef1cc914fa1420d277a6ac6732a56bcd0fcd089a70175fc6698f336
MD5 77624026bb0224a2cbfeefa51d152a17
SHA1 1b4b7c252aac3394f64de6832b1aac51589697af
SHA512 979d276107cb86d685ea41e311cc7a59c5b416f779964d72e1afa6c0aad6da6cdd4690d5db2aa01c80224996afb61ed81ed46bf9d01410a90ce65ad1f196c4f1
SSDEEP 49152:ZhtSn8EApI0figngiDn0AP5wqjzQgilV995S1V0:oX2iyphvjI
TLSH
T13E95BE13F2D940E8D06ED178C7468632E972BC150B35BAEF0A90B6561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0346cb8f5ee8c67871ab8726fcd4b4fcbe59d94ce5f3b66554e3dec5312dfa90
MD5 2c2932a77560e8abce0fb0135d4accb6
SHA1 b78422743d5c23f16888b28c6b4b7ae82faccc69
SHA512 0e52d39b308e0d01b1672a1c44d62bfcd5f0ee3c524a4ef5fca7f4cc89cbf6330d4a8f984a574087bd321199490daeac4900473856b9e044ffef0c356e72a509
SSDEEP 12288:5A8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:59jzABgioiNV99L5S1fd0b
TLSH
T1044523CB9269C8CFF32048B9D494B54FF0F36CE596403A9FC3E604265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 dad828a86a40f39654e19152803cc76dce838a45ead0f37ae05042e04cbf92f7
MD5 f689c7cc75139da285696c7372846522
SHA1 77525962fc0eb97d809b32d6ec9ad2a2894b3ae9
SHA512 7debcf6e16b7c91fbc9121cf65e9774168ef00f0a134b05b93ab04171799737b3def3d36b03bdc67d9657962337e312b5aaab7c88829509b9ab2757270e5e6f0
SSDEEP 12288:5b8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:5QjzABgioiNV99L5S1fd0b
TLSH
T16E4523C79269C8CFF32048B9D454F54FF0B36DA696003A9FC3E604265EBADE08515A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 fc55cb7465dff98941c2ccde25a644406a22d8c99cadecc8a40d873c9ada8da9
MD5 ac322b7c075afee0f527571dbb7f0bfe
SHA1 a856f97916a9c584424c70caed58804fca664ca0
SHA512 7a709f80fabec102563c2eb8be3e754de8f354979555c0dd9d3bec09a96864b33b693fa0291d6f3ee46648811e7eb0bd65b252b841e31079257408c9c178582e
SSDEEP 12288:yt8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:yujzABgioiNV99L5S1fd0b
TLSH
T1134523C79269C8CFF32048B9D454B54FF0F36CE696403A9FC3E604265EBADE08515A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ebd9ac388ce6b038230e5cee441eb7d169115e02ee2027e7e02ad069ab036225
MD5 5e0a1dac68dbcfd0778232c2890bdc3f
SHA1 db11c49a027a3e7a26ff7e94785412bf65a1aba3
SHA512 4e39f284f02248e3e3f370f0471fa49ca16d6e305efbc6e086d15a0219334f8a5ec9dd157a2a6547da2d54cfcdc7a977abb925c9eaed0f25d8b3c9e65505b6b5
SSDEEP 12288:kVa8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:yjzABgioiNV99L5S1fd0b
TLSH
T19F45238763A9C4CAF2718579C460A50BF0F37CE597217BDFC791085A0EB6EE08924B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f0e354a95c05c8f7dc96988308c7eab9adf04c46bfbade885b3956c00be018b6
MD5 ca4fd3ebdc39daf58f3b809401061316
SHA1 461d44d7311f09b752aa4f5f957bf09b30c3cb30
SHA512 897387b04bbb1a0b459134adc4554971bd7abda3aed1d05e3fb41e468d22f8d59f12f06cf8579d4766eff96c0d4f59d6a52036915c0c314b72932e0422aac0b5
SSDEEP 12288:mS8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:m7jzABgioiNV99L5S1fd0b
TLSH
T1894523C79269C8CFF32048B9D454B54FF0F36CE696403A9FC3D604265EBADE08915A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 fba838d9e7b275b5f28de061943d6d37c975fcdf66385d34c0a7e8391a61beab
MD5 db87dbdecd92c6025bce691fceae88ca
SHA1 77af29b2390619b76b38cd9d31703bbab473191d
SHA512 6d5430c2c38f54984942555da61f3ab43ddca0ce93291fe575fd72d3c94ae01ba40d129156849a89c042c84ba93a644d63f8dea83e253ab9554b741add66d80c
SSDEEP 12288:Cv8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:CUjzABgioiNV99L5S1fd0b
TLSH
T1F24523C79268C8CFF3204879D454B54FF0B36DA696003A9FC3E604265EBADE08515A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0424d6ab2a3a6f6636a5e1872bd2c78a3b793675e483bd2af12311174b032f4f
MD5 25f1d868ef6c32134ecc22ae3e6e10b8
SHA1 187306438af816913473623d41330e5d7802a1e5
SHA512 8990ecd81af9ce9c4705c9da4b088ccf6f7175971d50c8503a6ea2d94c71b72217a9f423d99b1c4ade8af9bd9bc245734a45ccb518e2fb53757fab494c2e4ea2
SSDEEP 12288:2z8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:2YjzABgioiNV99L5S1fd0b
TLSH
T1F64523CB9269C88FF33044B9D454F84FF0B36DE596403B9FC3E604265EBADA08515A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 36312211a75056e1be633fbd5cc20be743ccf0a605b5f5b0a50a06bf50a94f71
MD5 21f5d67aae78b71de422a38062332c22
SHA1 bd8891ec1e04aef220f6980bfdcf5ab5790fdc67
SHA512 e4347cbdde16187add998b162bbe1be76170ccb6329ab0184d830dba9738c53693038c43dadb3a98e79c499b289949a3e471ce66ad1601a19ea8ceef71191e73
SSDEEP 12288:kiZwb6zzFEoS2cPvy78jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:HZMSzFVSOwjzABgioiNV99L5S1fd0b
TLSH
T19B650195B3904CF8ED63813EC855990AE1B27C6A0760DA5F43E436275F737A10C3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a9fda498cdc6a734506ad1b38dab2ef4fb41958505cb45dfe4d8c940d16c2e3a
MD5 15b30484e9fe6b29dc428b4ca682c773
SHA1 84cbab8e4445490b6fce8d4108619588e5e3946f
SHA512 8c9f7a7b674459b7aab5d53284322d47f8b7e60eb10706ace47bdb11a965982319ab99065dd346811bfb1d18ba0fb2e73cb2cd1f250bd9789ce707eeca4e44e3
SSDEEP 12288:Fs8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:FZjzABgioiNV99L5S1fd0b
TLSH
T1574523CB9269C8CFF32008B9D454B54FF0B36DE696403ADFC3D604265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 13734f6629b9c65d3a3af2ab53bd2f29ad2cd68d56cc1dffee9fa700b2cebd8e
MD5 c885f0554e04e9b367df134cdfc451ab
SHA1 927f3be9113971d2c4e47eff4c389461ee3b4467
SHA512 b6e306fb2a8ca9eb9477090cad9b59a26aa1910f74d834e72bc9a5ff477146c78f5b17745b03355778ad95b326639867469457168a3376871657db2d7b698554
SSDEEP 12288:aI8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:a1jzABgioiNV99L5S1fd0b
TLSH
T1924523CB9268C8CFF33044B9D454B54FF0B36DA696403BDFC3E604265EBADA0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 eb3e428c5811183476da935107a3ebf7a4461b8e95b90e670187563769af2ec5
MD5 a98ed165691afbc3ec09c8a0804e5a5e
SHA1 b942b79ec0c5a1cb38022b22cfdec9f1261a7b33
SHA512 e050614d045d2d3f6077d4c56cf7fdb74c8e21c6b75f0c5fa5d641f6ae5cebcfdf9d358fc683d36ffb4cda17bb3bef8bba107445575057a520ad11c34c8b05fb
SSDEEP 12288:ZyPz5L8X8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:YzyMjzABgioiNV99L5S1fd0b
TLSH
T1D955024773A560FDE1368139C8615906F3B27C724720AFAF43A406761F77AE09E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 7bff890f4cc6cbac4676739ecfbbe6fbea8f8e2c3d44b9b32c1c3dcbb651f07c
MD5 0d696ac0d30309030cd20df3fe6ec42d
SHA1 1619233abb615c1c3a5ced69e1fbb7fd65687d58
SHA512 b6efe7d8e9886ead6220973702a18e1d85787dd128f03ffd76a4c26a950c4f38ebc1e007adf899ab1fac71a3141e79384910e6f89f5d9bfc7a4ba72844bff96a
SSDEEP 12288:js8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:jZjzABgioiNV99L5S1fd0b
TLSH
T1FB4523CB9269C8CFF32008B9D454B94FF0B36DE696403ADFC3D604265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 81b91bed2a0ecd7c37d762b705b7a6876fb240391cf0f164ba6cc2312d2de380
MD5 7ced11a87f04281361c4d474eb666a56
SHA1 0fd8580456f247dc000d0754cc46f0f7fcaf2f4e
SHA512 6e47fc36f2bebaca09eefdff9fc1eefc0cf7934dd077c5a0ee4821935a3d65486303c9199d33a83e0ae480ea7ccf76bda0440257efbaee973d3ed5e12e5c843f
SSDEEP 12288:4s8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:4ZjzABgioiNV99L5S1fd0b
TLSH
T1C84523CB9269C8CFF3300879D454B94FF0B36DE696403A9FC3E604265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 30688c3cddb20911c1df2a8d84ad94def7064ae9d7a854fcb3ef626c622637b2
MD5 0957de05233d54b943918823928d3ec1
SHA1 56bc8c594c4123df3d951b9a4bfd7ab1107ae203
SHA512 e32eb736a67e80a203ea90b3dc43688046d064511d3a0a16e6bff1efb57bd7f97691c8b17177e189c631c405c6bbe4408a2f12cc9c4d06abfd710cf7a8fd126b
SSDEEP 12288:gyPz5L8X8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:RzyMjzABgioiNV99L5S1fd0b
TLSH
T18F55024773A560FDE1368139C8615906F3B27C724720AFAF43A406761F77AE09D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 31597554a88242ea1d7b0af9f4d298e43939b0c0cb24232b909ab0ebd79ec979
MD5 fc0f6cf91f4a5a4de3e42291373abbed
SHA1 153f7768403f9dfa9097f7d04c326f519f9ca43c
SHA512 faceb00a3605a080efd08747c0ccf460e0fa1a7344c6c35a20ce2a3d6669c8a2c4d73e901ee3d278800b091af9eb8790d2f71c7334d461141813ba90b927d947
SSDEEP 24576:ETHaLl3z0zD+jzABgioiNV99L5S1fd0b:ET6LljXjzQgilV995S1V0
TLSH
T1C3650195B3904CF8ED67813EC855990AE1F27C6A0760DA5F43E4362B5F337A04C2DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 72c7183d0920f6b9a1ad2ab7df8aea0d6fd207bb0f351d91b6e1aec5212c3a5b
MD5 92a3732621c76bb6bd4069ea47b45b10
SHA1 0f94ca49ab4b998c4a5ab29ec32a136b7e26bfe3
SHA512 4590d62ec45d5483701fb429465680cf632e08be6c3b5b7bc7aa7ec22109d071f13111f14ef11355e76e69d2adb968fc1379eb220686ff48d8ed8f25402846aa
SSDEEP 24576:P37d9CHKy7GZCjzABgioiNV99L5S1fd0b:f7d9CHKyaEjzQgilV995S1V0
TLSH
T1D875CF90F3E414E8F1B78A35C9759512DAB67C9A1B21DE8F03A4251A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6ae17faf99436edf27c267db418750aa0dffd4c97297a45d3b995ecd09089a80
MD5 d622975af2591c51905ef183a65b9721
SHA1 49b62610cc111c2ca28d92b213b4504930c32aab
SHA512 7053bc396fbf61a01f6a786a061186a200c8093fbfe9fcbf42a064cd32c18bd99515c3786e9a1efd6532804b741463e252b0bddf02474508bcdf034fba865a12
SSDEEP 12288:SN8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPAS:SOjzABgioiNV99L5S1fd0bq
TLSH
T1F04523C79269C8CFF32048B9D454B54FF0F36CE696403A9FC3D604265EBADE08515A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 7f14d5e17696340fee631e289fae86e6f90fcb2fe54d1c5cef979859732396de
MD5 2863c143578d5e961b303336b041bcb5
SHA1 7bf4c7c3cf3e4d49a5d90e1333ea2afdffddb0d4
SHA512 f1d4f07661dce4d6dfd8e470285e8dbbde3f00f6e645f4b5d13930590fc115aa5fd40de5af419534835b644c3d133ffe986cb5860ddd85402576668a84e61b0f
SSDEEP 12288:h38jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:hsjzABgioiNV99L5S1fd0b
TLSH
T1EA4523C79268C8CFF33044B9D494E90FF0B36DA596003B9FC3E608275EBADA1851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7d306bd601a647a964cdeec876519c13ae48bd894e820be1b591d26df040164a
MD5 9276323c2f5f4ff19eac34e13d659b36
SHA1 9c9884fd0bbf4dc93c3ea9de16d2297a76b24116
SHA512 278d165daf1539119074a33957547b9f1df498db32957c7578e4e7bdc3a98cd13a741031ada5792a00c27f862ba47cff40d908fcf9cbd0059ab34bd4c3e19087
SSDEEP 12288:Pm8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:PfjzABgioiNV99L5S1fd0b
TLSH
T1364523C79269C8CFF3304879D454B94FF0B36CE696403A9FC3E608265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 3e788d757fc51b66fd61e30440b4b280b81e589318f878f50d2f56bc1cc60b5f
MD5 4eb058551dc18e99fbf16aaa54ad5a01
SHA1 27fba59fac1c6f60280d0722af28c116de9aa574
SHA512 84f1b342eb9506117d5530e0a04a3bd3666c1b21bc123b4687e11c67fc370be5b1a3e6543304238fca4ac4ad222a77fcb2f88a2ffcd8042634ffdf1296425bb5
SSDEEP 12288:8s8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:8ZjzABgioiNV99L5S1fd0b
TLSH
T1104523CB9269C8CEF32008B9D454B94FF0B36DE696403ADFC3D604265EBADA0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 99032b3075ac58eb791dc741a90d16474a1015939f568c1899dd6668d349b8ff
MD5 6dc75f7554ec56466e57b27864ef521a
SHA1 77305b30942bdc209c93173b32d4842d69c0ebc4
SHA512 66396b64b7240dcfd9741ee7eaae36fb62f5cc5d1a8d31ef349af994cc086b95921d5a847feb32f22af12cf39acc6f814f72d23b267f6ba7c3885f25e02ebea8
SSDEEP 12288:TN8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:TOjzABgioiNV99L5S1fd0b
TLSH
T19D4523C79269C8CFF32048B9D454B54FF0F36CE696403A9FC3E604265EBADE0891569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 61f3b3fd024b6c5cca47d0b6751eb3353f011c0554caa27ff99ccd85178216a4
MD5 1794d6195da0b16282af45e9d1434630
SHA1 1686b1a04de88d0db1fcddc76d1a06aae17accac
SHA512 8fd81bae0c6fcb15400a55707dbedc00cba2a4588375620c7269980f11b82a13baf1d91059e2dcec69e0e0106a996824a623bff7a960e894e7e7915513bac1c4
SSDEEP 12288:7k8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:7BjzABgioiNV99L5S1fd0b
TLSH
T1D94523CB9269C8CFF32048B9D494B90FF0F36DE596403B9FC3D604265EBADA1850569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 39f16b77fdecd1e0218215ccb2159fab51b0106c876a13d67a3793aeb42382c6
MD5 c2fba58fa8af5e5c96b657e69c333814
SHA1 26d932f9e96ca861619181ad8d45ebe3e34c57c4
SHA512 80c430f41be743cc25cef62524cf6adcc078584d8550e3fe8fd1eccb7065d90245977ecbb9afd404a2ba8173b13bb06d85ce295cd5d3ec91f3ef45943c0099d2
SSDEEP 12288:XS8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:X7jzABgioiNV99L5S1fd0b
TLSH
T1334523C79269C8CFF32048B9D454B54FF0F36CE696403AAFC3E604265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 bb0cce2ea50e0c35074d64802b89e94afb0246766592227e71332fcd262c6dbd
MD5 75796f2264d3a73a06bcafe5b404bb06
SHA1 82568242a5eb70d2e6be3c82513cfe03130edd32
SHA512 e025b900443d5713e2f2fc362f09466a0897fe6d5a2281c6b1aa908beabc1ec5b9cb83b74571f7621f9495449d4c851a267beccc0b3d64d9474dad00dc3f4877
SSDEEP 24576:Wfwvok9RX6wkyAIljzABgioiNV99L5S1fd0b:aMnYIljzQgilV995S1V0
TLSH
T18985DF29EBDC44E5E177913C89B3460AF2B278691B31D6CF029A536E0E37ED09D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a87140421a97848ea244dfd41a8fa568b384b38cfd39f544a8270a183c71e9a8
MD5 34e34c070a7267f4abf788294fe9b209
SHA1 fb622eecc4334a0fa341ee7502c961999cc2a2d1
SHA512 c26289f6370d1055445b3d09aabdeeedb10e107b1ec1d19f6bfb37c401c878e34405d6f406b1f2f55b828af3327fad53d58b79ddb26fcde9f1f2441b59b4b804
SSDEEP 49152:8YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0KjzQgilV995S4:iySzPCjI
TLSH
T14D067C97A16841D5C1B9C1B98B0BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6fc020c0008941cf481655f563047d43abc910511b0bb62ab87674f16f928524
MD5 7048abdf5c25a027518c3db953e8efad
SHA1 8b6794ff8f0f482fa1588fa7619d26d078b2b6d9
SHA512 460bbd33272384e0248a7c05485dc44ff57b4a14c2764c698eb8b53b5e554431b9b96e053ac114275ad6402cdb71edb8e3884e0377b2e9a0516de35206014c11
SSDEEP 24576:i47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYgjzABgioiNV99L5S1fd0b:i47JUQj1irIhCnDHUPfF/6jzQgilV99B
TLSH
T1A065AE1EA3EC01D5E1BA927885158A1AEA71782D1F31DACF12B0437D6F63ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 d5cbac84c651a8da479b3ef6924cef025fe374c77f562a38f0efc4ecc92e99eb
MD5 55f6b66cfeb0487187f87d7a7bd7556a
SHA1 14f8151a0a25bbda2d0195a5f594c56a97718017
SHA512 0973ffb8bc34cd04db3f9b845226350e53df2cb094acdb6b428e955da5a77f75077e3df6b9c6d87ca55e823dff5e6261a41d966b607d922203a9067efff83a69
SSDEEP 12288:HNsfc8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:EpjzABgioiNV99L5S1fd0b
TLSH
T12455F14AD29841D9E16E5179C7559A06F3733C6583E1A3CB83D0F43E0F7AA908DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 988KB
SHA256 744a3fffbbea738f7645474daf0d41671fe4a85cccc21ab18301d51ef5433430
MD5 1a156ec12ff3b3edf6d56d743471aac2
SHA1 41f23b7bd759d862ba051ccac73ec21efa224891
SHA512 f89f130b701c8137a6cf90cfb029d4b2e3e6162e452ab552bc2140c0db78614d0d174a77a28b6f39d246a78bbc9bf0c614265f5be105266f2aafe0227734c818
SSDEEP 12288:nco05EU3fbfaXmG6CnhAxs0hP6eN/s/h08cFynYfeF:cd6UPmX4sdeNk/h08cMnYc
TLSH
T1BE251701766ACB4FC6A940321E77D6CCA7707D01EE45AB0372C9873FD576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 81ed66ee3b3c58dbd73b0359d6e12516c80858e0d9b7ecb7bda13886ac5e050c
MD5 a273d1fad5316ebdb3b4f42dec559360
SHA1 ac78cd796c718ec6d735a330e3f9a132dbaafe4f
SHA512 45c76dc1edf212d7d65c27263c261ad6ee538f96248383fa08016f7f4beff813770244d291e4ed798463dd7296697489673c99d2a905370d8bedcc7053def6b1
SSDEEP 12288:YJDexxGrG4sfsRRGukkAOBny2RRbzvdVCEpnQgHGqCl5VCBQS:Y6CBH
TLSH
T1B065D7405537E68FD1B76032072A9F4D7778EC17B745AF26B389053AD82AB12B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a402498d7cd30b5a3460434b46271a8e3134a9520fba7711fc959e1b69418fd3
MD5 2db82238016aad1aa88a3927d08decb9
SHA1 7de7c1a9b38b65629ea4dbf5284eb95bc26ec491
SHA512 2c794a324087a68c7fa4f2bd0060f211aecb4c583092e7ec326f2b4976ef9661100e61632f279ba19da411ab45c4420201335f1fb7b09cc76bd796423827a2ce
SSDEEP 12288:IM7U8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:JRjzABgioiNV99L5S1fd0b
TLSH
T15745238793ACCC8EF23548B8D498E51AB0B77DB48B007ADBC391046A5DB9DD08D35B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a083b376ecec19f7f24daddb4731680abeef588a5bc7f9e79cd7e1bcaa319d5a
MD5 da1b543f054b7b81e8161c103eb7bd5d
SHA1 fbd37aa12a675dc0f82fc771a8707fc27fddba65
SHA512 4b47ec682e2884bb476d3129733fbf3b8e1a92f27d07008e121ae0b732054334ed74872102b91fa76ceb9e85adc9906ab694c9b2498eb20790df788fa5ee6c55
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYXjzABgioiNV99L5S1fd0b:Qgb4mBIBhGFgjzQgilV995S1V0
TLSH
T1BE659E1E22EC02F5E1F9D2B8DDAA4417D6B278160731D6DF0251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 a944f489f08b65c90dd241c1029273be0ba57eddf59bdde4e372cedeac7f1106
MD5 a4b2044383e22730ee3ff80e0dd81d96
SHA1 69d7809fb8a07f3211468e18f5396888f3e880c0
SHA512 b2799bd8314a2c51f57fc4b2962b4316ae4937fcddb92439869d6b2a80c7d8b52bfee50041dc4b2fc9330dbf3be8aa6264c8d2b51a2ddd20618836bbdedb34ad
SSDEEP 24576:JG88u8FpJqH1bzria7/mwjzABgioiNV99L5S1fd0b:c7ZFPqVea7//jzQgilV995S1V0
TLSH
T16385F16567E001F5E477D138C9824667F6B2B8250360FFDF47A88A561F23AE14B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 1b6579697c48d94b3785c9053e14ddb47d4f97d775571543c5c0a87d1765ce6c
MD5 fd1a2a13b9719bcfd6986b38c8cb2527
SHA1 6a060a54e14e018468be96233e24d1a4dba37b8c
SHA512 f84d000e17fec1ac2ef863b1d62b9d59c224d39f268058d06e6aff2cb658995711c386f7fd995d93cf3f90fd865201efede047f05db7f1ed6c362ce8163ed4f1
SSDEEP 12288:ZHvUrBFrEjwaQ/8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:ZPUr+NQEjzABgioiNV99L5S1fd0b
TLSH
T18765E15F62AC1CE5F676A17DC581860DF67278620311A6CF02E0817E4F67EE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8f454dfcb4fc2a94bdfc367125296af7088bf06649a9432017144a79334f9667
MD5 0e3adbde58e42a6535ea67468e6ffc3c
SHA1 583f1cd25afbe343a731d05a5df2a349392e7020
SHA512 3237991f98a560112b116d6fb01ad5e9ccd37c03089f041515da1dec562469565798845ce849d5abca0cfe5fd5d92a0bda0d21085c3440a40f9008e908bd591a
SSDEEP 49152:XBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjUjzQgilV995S1V0:IG05lO43btjI
TLSH
T117D5CF6E62EC01F9D1BBC17CD9C6460BEBB23825032556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 220c189fa252077f00106a244add1b6f878b08913a10425dda68a232a2e84348
MD5 c73b493371b4b01875c53f6ae12e5e83
SHA1 95ca6ead39f4f0bfbfa3f7044ca97a1298cd1263
SHA512 9e33791f1b903d07c5c7c9a08ab038e744c8e5ea7c2f482156690b8e836b629faed40058c1ef5b302b48989e705a1e709c6730d36c7ee16d1e1aa2c191c4e5bd
SSDEEP 24576:bfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnKjzABgioiNV99L5S1fd0b:Da5POZ3+Jt2pasx2+msjzQgilV995S1i
TLSH
T1E065AE5EA6FC01D5E179D17DC583861AF5B2346153319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 821b3784d0f983d9fae0941e8382ef3004b18296d9a634f0fbc8d8d22d0dbb34
MD5 cee4a21f0a6685126764d74565f2f218
SHA1 6555d0af37e403d9803fc7a0742934c1b605f95f
SHA512 29978a5ab5780fa3c5d816f053da4672afa4fbe186cf3850f66b21024c73ac5fee9108b001c86560768a013c6954dc7365d23c76cfae880f57fabea7ee5964bc
SSDEEP 24576:2NcwHdjbyQ4nLC18lb/EOjowL7FkojzABgioiNV99L5S1fd0b:2Nc/zEOVHFfjzQgilV995S1V0
TLSH
T121858B1623E901E4F1BBE1BE89779546FAB1786513309ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 354a71e9bf70e227297ca87639a1e65269cfb9b361befdd1588fe71b4bc810c0
MD5 221e6a8c3025db22a535883f33000028
SHA1 623aadba1d0aecddd3d7e9c687edb8ecd8fa3091
SHA512 61eb43bd3afd33996d6c12575c660bd36f2209abbb64474f6399d81df2548bb46c965cf8df45ee0b1b56b9ea08e5c387a4628851946b7d206c59b8b13b3b30f6
SSDEEP 24576:w8kNvNnaFeYhJNtmZBmGjzABgioiNV99L5S1fd0b:w8MwBtOmGjzQgilV995S1V0
TLSH
T13855AF6EB6B845E4E1FAC6B5CD238516E6727861073293CB8390C13F0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 8e190ce3058402ce15e17dba0f2b8b4e3bce233a4c1e7b3f95db2e1ba0b1913e
MD5 34198382a28d224b199908602f5fc681
SHA1 e374a40e409b0f701789ac50776cb2e3c8f5bd12
SHA512 1840c72b17cca13c7d9271ec6c4b4c395aaec79e3fd0099dd71fac6ddd52835d504c0515ac41c16b8241ce220b4b4d687b938d96d2e775b72371cea4356da6b4
SSDEEP 24576:GD3FHshBIYQgAdjzABgioiNV99L5S1fd0b:GDVHeBIAAdjzQgilV995S1V0
TLSH
T15975E17EE75C04E4E57BC1BCD6638907E67238A9032166DB02D481BA1F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1388-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1388-23-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1388-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1388-15-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1892-310-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1892-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1892-85-0x00000000007F0000-0x0000000000857000-memory.dmp

Download

memory/1892-80-0x00000000007F0000-0x0000000000857000-memory.dmp

Download

memory/2668-7-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2668-8-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2668-3-0x0000000140000000-0x0000000140348000-memory.dmp

Download

memory/2668-0-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2668-75-0x0000000140000000-0x0000000140348000-memory.dmp

Download

memory/3168-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3168-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3168-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3168-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3168-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3168-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4376-309-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4376-67-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4376-76-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4376-73-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4468-127-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4468-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4468-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4468-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4468-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4988-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4988-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4988-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4988-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5176-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5176-109-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5176-313-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5176-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5176-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5176-103-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5728-316-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5728-114-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5728-116-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5728-122-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5740-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5740-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5740-298-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5740-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5980-90-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5980-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5980-328-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5980-96-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5980-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5980-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6084-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6084-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6084-135-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6084-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6084-129-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download