eed2670b7197d9f2921cd6faf706b928e103c72ec5d8b0420a701e92b3806d5b

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 3.0MB
Sample261107-mxgn4acv4j
SHA256 eed2670b7197d9f2921cd6faf706b928e103c72ec5d8b0420a701e92b3806d5b
MD5 b5b8697df92336bf8d7d26d9498af167
SHA1 699b44aaae0214abd137f8c10d6e17678898bd85
SHA512 c7403740191fff22631d633fa13a71328100860eb13f32cb7e5c72688fabaa37faf6050689eb0f797a743ed3537a69012e7954735787e3c401a8e6fcc25c08b7
SSDEEP 24576:0bfbqs4YskoVVtE4i0ZJp0Rsivg+6h55H863IXSHajsqjnhMgeiCl7G0nehbGZpv:0yHFVdDZDfivg+6h+SHanDmg27RnWGj
TLSH
T1BBE5080673F807D9F1F34B7849756A1598B6BCA9DA10C39F15A1710E0E32B988D72B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3332	elevation_service.exe
2204	elevation_service.exe
3556	maintenanceservice.exe
4232	OSE.EXE
792	PerceptionSimulationService.exe
5752	perfhost.exe
5888	ReFsDedupSvc.exe
5380	SensorDataService.exe
4916	ssh-agent.exe
3256	AgentService.exe
4448	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1bdcb3943a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000765c0d9a56edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd3cd41aa66edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d69a19daa56edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeBackupPrivilege	5888	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5888	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5888	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5888	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5888	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5888	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5888	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5888	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5888	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5888	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3256	AgentService.exe
Token: 33	4448	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeDebugPrivilege	4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	3332	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4324	2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 5928	4448	SearchIndexer.exe	100
PID 4448 wrote to memory of 4344	4448	SearchIndexer.exe	101
PID 4448 wrote to memory of 2892	4448	SearchIndexer.exe	102
PID 4448 wrote to memory of 1972	4448	SearchIndexer.exe	103
PID 4448 wrote to memory of 5060	4448	SearchIndexer.exe	105
PID 4448 wrote to memory of 2080	4448	SearchIndexer.exe	106
PID 4448 wrote to memory of 3936	4448	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_b5b8697df92336bf8d7d26d9498af167_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2204

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3556

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4232

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:792

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5752

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5888

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5380

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4916

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3256

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5928
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4344
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2892
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1972
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2523131cb780c3be3e3d1b8eea780ad3bec95f637227c721456b911bdf3b2efa
MD5 168dd4add731adb5d81a7425b40017cb
SHA1 bd4423c6d2ef57ddcc9273f9a037230680f34edd
SHA512 1ba6c194db69aeafc8969c7237cfc753c5d4ea734b77f6760c40c2dbac668fd8a7b9f875de6e5c0520f5c4fe74d31574aae62622eb792db0ee85010e9d16ac3d
SSDEEP 49152:nb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnaDmg27RnWGj:V3q6sjBRD527BWG
TLSH
T13AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 eb575f2a20f892c5916ec6b8438832203cc7339d165fb37459652a5a20042c4a
MD5 79b4fc3e986574cfc59a3702c6fd2843
SHA1 88bfa98e690554f7ff24411e33aee9b666bbc012
SHA512 981e30ddfc489be8059876f45954cac8f3bc113d4c156aad28c5a4d7a46418923df7f37a7ad09d57fa27537c503dbd51a519e3c2be9d7a35b06fb66f23307011
SSDEEP 24576:0XYfDtczA5sqjnhMgeiCl7G0nehbGZpbD:ztcMDmg27RnWGj
TLSH
T1C465F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 db1ed4964a18e735e77155e24fdc9f09d81adba76459da36c651cc93dd371043
MD5 66113bee0072424bdb3c0fb5a02461f3
SHA1 6a669b137f82d9a512afaff77c6042ae341f4eeb
SHA512 027e78af2f1b76abc6eb9d1b6c339d5f454cd652ce75256e3b7f9693becbb2cb7a3d44c4d06f94a96b74bd3b6760ee376f5dd51a084a355f79e3fe5a1075b079
SSDEEP 24576:t0Le5ji0hmxxrM+sqjnhMgeiCl7G0nehbGZpbD:tPji0AjTDmg27RnWGj
TLSH
T12E859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 55f617382ff180f0c3dbfbd22ab37fb42451d4d8048648d45f42bc6a0bb7484b
MD5 342f2fdaf2d109ef6cd638b9fe96f9e8
SHA1 a28e19cb1ea82e9b991b9bfeb92e6cd619ec808d
SHA512 cbddbc6693fbb80c970bfa117d14cd0d0e7c66ffe5c3e1f0f2a529f72260306beb6bf321524601e6707dfb3a1b6f2443bb032b4d3779d84d8138d307c5ce18b7
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWn6q8wyuAsqjnhMgeiCl7G0nehbGZpbD:g/ezSC6vUzPveHjyPDmg27RnWGj
TLSH
T1FE755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e1f1aed1765243a8248c0be906522b25f4172fabe1fcb1e9277ea34039afe43f
MD5 00d201a9e98ded84ff3c97301509da68
SHA1 6c0176d947e3d00c438e23db031b8c4a0d505b6b
SHA512 77049026123b32dc810e1660d17549d093de8983e748573722739caca485ca595b3b965a063515349dbfc96d3ca58c58c1358cf5ff611e16fa1d76e8d794fc1c
SSDEEP 24576:2VbqPb88hv/l+YdsqjnhMgeiCl7G0nehbGZpbD:2VO88hXl+kDmg27RnWGj
TLSH
T186559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b81c88883ee91269adb84a2838bafa1442d92b1843bd59b9c0997c61f8a68976
MD5 44f4cc1dbba6eed74ce772ad3f886428
SHA1 ee96311166a924557ca44ea937a52939a573b604
SHA512 54fa27e4e7ea43d9dd0b9065985f29f5930f1984cb71b712e9dbb39ed8896383cea54952509270599696ed786162a71b848e5b23c00b98ba496fed69faf21947
SSDEEP 12288:PLiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PLisqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A4523BF865C50DAEB7608B5C3E9F11EAC137E56982008536AA37CFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3a9c4053c841996e818a451741d909a7b6ed1716c0099fa74070bea977b4401b
MD5 89cbf5c9bb7a6cf4dcb1cdc1a066841d
SHA1 16ca4ca6bd55a4e44be1e16792fb746e10073225
SHA512 d6b3b11411a6a97fe2db818625e3907efa47c384df2f2636523129f192be4b9cf8353a464ecf6b96b16dacab92d6d6d66767cdf388ca4973355cf0cd891d5685
SSDEEP 12288:jeBNUbTVO86UFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:jJIUFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA65CF7BEE28FCD2C27A8DB85791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1b2bcb145edc2123126d2d7550429ce7533caf2ef0a0e41f80caea861cfa801c
MD5 c7055042495b7dc97cd29c3b962d2832
SHA1 ca8c20307ac05e1a0c0d7d03a6112c828924e575
SHA512 d9946f52e50cf1a6314394ff30cca57912013d203bed398b2ae6f4427f131cfe4314fb4121462a95a26c71ee67310cfb2deaf01210fac9ea3e3c394e5911f9b0
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THs:BQvGAdlCEL8c/DRNw5CsD527BWG
TLSH
T1C7266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 94520efb77abbb63f02b9cd285f28305cd3532d88ce6e68b86c9212b11dd8754
MD5 eed2bba54ffb48004e643045fc6e74df
SHA1 87ddaa5e72639b5064b888cd4cdba20107d9a92c
SHA512 2ba7de8640ddfb174dad2c0a2d274af8d27254c67c469226d488567d149e1e9647de6e222d9b21692293eb32fd2fa8dc2ecf752263a6ad702466619ad9e14bb8
SSDEEP 12288:9AwSfxL/2Dc3RDLLmt0LDQewsAjfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:u0ewsAjfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE75E031FA74E036C77B0DB60B36D71A582D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9692fb04f3c32523118e5b307db1fcb16895a7e090a246bb8613798b243a28d8
MD5 16d33266983616bd8fedf55255c667b5
SHA1 27191e3f0a334915b9d7cd3cb08abdf004190788
SHA512 46103d7f82318f9d6e7fcbdab95ad9694077d9c27389a67a5efc2643436f00501d11b9eda8750af66a560cf567146687d1abd463dcdfb1785e6f235ac1f40581
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHLVQBWG:7UEtQevvqc2W1cpV2tI32iB
TLSH
T1AF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 03c5b65801b569ec9ed35491de8fce55c333db76f007b528191d49f69e47da18
MD5 7c51e5fccafc9090b311ee54c408bd8b
SHA1 5cf8cad3051d0575b259c87a95357359ec8459b8
SHA512 9a29920576a96130ec960c4854bb2dd659d0ffd08a3c936cb64ee028c37fe753be049c16413446dee62571eb1a4cb75536d2e6a07f26cfd8faee2cfec5adade3
SSDEEP 49152:QCbRquA/m2yL5zTfFiV+XenmE3/zjDmg27RnWGj:5oquVjnm4D527BWG
TLSH
T171D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 59687a32c7d320e74cae6ed304f399eb5088832a380833069042c36ab9813d9c
MD5 9870d27c0f0f3ae9f106ae7dbd2712d9
SHA1 e6d78e9444d33831356df6327763304922951687
SHA512 47cfda52a0979246008b313572f4764b279ff3188531e827e87ba8f770f5534ea18f8e0acc672fd7d97cfc953e8277e4415b0a4acac9d0d87892d232d445d206
SSDEEP 24576:IAhGL3IFoiwtA5l7S53ssqjnhMgeiCl7G0nehbGZpbD:IAMUFoiq5oDmg27RnWGj
TLSH
T18A359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 a899362d92a1b20381b79c53c2ade85203d8fb5ebff4222ba12af92b597909ce
MD5 81f1d2b2eabc8afde5623d1323b49633
SHA1 4bd8e8f91790ea9f4c62c51222b160cdc72fee1d
SHA512 2187b710f421bcde93c3a3335dd26fe16fad8db06ddf64b12753da10326fb06621a7fe5d700e6dfb578bce4acbfd568e586535531099083e949597dd4720fd78
SSDEEP 12288:Imw5HEjsChNVBFgl0WDm+CgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:lwu4OW7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14865F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 cead1b403434ad1783c2651b56799170591b5234044a7f78720ba39c04556705
MD5 7d0eef30d4f1156948a0a37747bbf08f
SHA1 ff4470b8ee03157e1a7ab3983483f01349a9b2ea
SHA512 1338233f5db1698880f82e400a69516828229764566925334999eb0b9e06fde34d68465dfe958a9c878e1302e8b71dfcdc9a6f200f3e2365c698ac9fef72bce8
SSDEEP 12288:QeZ1IyPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xZuGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1225512AA239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9981d0b63d2ae20532b8c4a2b4df07668f66560da8a3461b7e692566a402e102
MD5 57e55b5fb0a0c8f42af65124cbad0876
SHA1 a3fd69667405cba9c81caaca48ddc6e79092699b
SHA512 f587d1923e26eae92350f875c1f2045d265e7c7a6b9d7adb8e6bc1520e8f74043f59db15958aa4cfb64ccc5fe297e5f298bbe0f429e0b6c98e84af7e9fea381e
SSDEEP 98304:GQRQyi36YOcPbLvw2gAf+PN3VD527BWG:tQyiKa/X+PNlVQBWG
TLSH
T14F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f5e6ca27cf0f6312e52abeddf7275930c7d02bf80a343d8d247c283a34cc8982
MD5 190c97528a4ef3f2586655adbd649856
SHA1 720cbcac8c39c2cada1114b8ee149bc7de0b4122
SHA512 7b8fa64ef1dd77e23c72a1469017d0256eb67788b6253530f2261e1a2d6639b5a326bf60a0841cb31f47c3bf88dbbef186877c9c97fc3d0ca693748bb8ed2985
SSDEEP 98304:SQRQyi36YOcPbLvw2gAf+PN3VD527BWG:JQyiKa/X+PNlVQBWG
TLSH
T106667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ff8791f68efa0bf62e405c7b8920fb630c8421604d81124760cc2c26a97f931b
MD5 9dea4f77556cab2f9e3945d4449e69f3
SHA1 6d92c6058f635038ec04f4224ba7d6c83a7f44b4
SHA512 4f2e6951e278ef856da66d1360578cfe75c86d62d921a88310ddb10bf36f9048e6d029add128880fe634237378f7668f057d3a93cab56c836254d7b030a98272
SSDEEP 24576:twvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0WsqjnhMgeiCl7Ge:J68Qg55nhceWu7PNU3/TDmg27RnWGj
TLSH
T1F2B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 865fcc6e192110892fd89ff64d3425b963c6e6ecfdc9359c72a5b4eecefe628e
MD5 97191b5057629f441d61a9b7e956960c
SHA1 f079452ede7d7cd79fc5abcfac8a5f99fda1823f
SHA512 2c54352b78812a4d11518b760f65ecf7584ecd5bce0a770998efe10286fb71ff5d853aac4c17dde76c278e642b98b8c72505e95acfbb3078b6dfaad73afe50c6
SSDEEP 98304:Ky5112gYy5azzVvt69nLKnhZmD527BWG:zLIHEWhgVQBWG
TLSH
T10B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bb1aa81bbd07d66dc5e1414a2b2f1b936946b69baf55603963569548bc0f88a6
MD5 4ba1fbd379021904e9a586d245cf468e
SHA1 096b58e28ba3fd8a80579b70906a0dac3d1f9d74
SHA512 0c2ddb3d5c06e1d7d282d771442c6f2b820a1cb7649faa4c3a002a56a7afdb304728d353a63f79e780cc389daebcaa33ddcca8e4b624bb90cc4b987f3dab3ed0
SSDEEP 49152:OB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glNDmg27RnWGj:cu6Jmdxd2dND527BWG
TLSH
T1B7D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 20c34eb9d68038850d1f40a6e6f17097120ac16b3be4c2cb517a9411f75cf4dc
MD5 1a1998511c41757b5958c5b2426951d4
SHA1 2a9727236be6ab742f2064511df25af7fabc5286
SHA512 b0951a7011791f088250096247c0dbece0842f6f24d7800fc94bfa94bbbad2edeb749f8fbc612b759a8bd4b874bd6b6b1dfe8e8ccd2041cba9bed636fa44151f
SSDEEP 49152:J1hpsNoJpF1A63U44CwH7R4xZDmg27RnWGj:JmifPWR4D527BWG
TLSH
T16DB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 32123e9242ce291845f5eff279b18c8f7b286b9fff032c4169530b9dd59ff81b
MD5 41d16282f186e6ab0e5ea38b174a69a1
SHA1 e881839869155c18ada60567d0a3a13cac04d3fc
SHA512 4a9253df566fffa243c00121716d3cf1a5b5402678918f950e9528f4bf43f06f1e27bd5fb02c6b65346a66fca84e3f39f3923bdf704d02565e25539d54ed04c9
SSDEEP 49152:mSuZQIY0Be2KcRVtOnks6NMHqKDmg27RnWGj:o5dKii61KD527BWG
TLSH
T14AC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 40c2404e2790b03d379059b34f038864bf2fd43935bbbf02da6a91f53b42b43d
MD5 69476b6f6a01eebe591f5f9d05df6c7e
SHA1 624d769992e530fc7a5e8d491654a0422ebfa987
SHA512 27abe9a48b04a385a2d8ad9e6fb6e7e37b2782c5548034e66c44c8e124dd1c46b96deb2f11ab34559f00bcc3582bfd2adefb0986b7dde5e3ca567156f9367c43
SSDEEP 49152:ThtSn8EApI0fig3giDn0AP5w9Dmg27RnWGj:SX2imphUD527BWG
TLSH
T1D295BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e4eb99f964246c0b8bab9b1cee5fe103e53215c61cbd08eca726fc622cf9986b
MD5 bfae4cf5c3bc18208e3f19943132464d
SHA1 55d8bbfce47006b0b1014b20618548b7f3e77472
SHA512 9eaa439f5cbcdce74424825e406bceb3c9d2d1768e7f7c30b196b34c7e8b36be0229b3bbe653d3e26a37743df9f7633d3d23d6f4051ef948478e381e307e1394
SSDEEP 12288:SqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C64523BF965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 eca5f1eedb8f0a1ae86031e62dde73efb8404446673f5c2883cb338ba8a08df3
MD5 c8d4a1defff6a855ce9789cce0cf4bb9
SHA1 896c30965ea67c556ab34e5663a3fddd286b6bf3
SHA512 e62518b06010277378a229ec08f2c11828dace7191805e3bc258eb0b2fcddc3296e39d42474e581b836f321a3edb50d19dce0463fcda9296ca90b013a07fa617
SSDEEP 12288:nzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1564523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937AA77CBAFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2a505550999dd521d918d046d55a1e97a7687d7737148ba4dc442f4b89cbb782
MD5 214262c51fab945a413a2e9d8519e43a
SHA1 b35c1cdd1f84393d49935b8d75af621f7923165c
SHA512 6fa8b7b7e039be15ced9f7cfcde859e9ca83da3ad10f00f922fe8f68434f0ef4ed3e6c708d3e0ffaf726cbb4163887baba31f48b4b2c1a91c9696125e5a63f74
SSDEEP 12288:YtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1054523BE965C41CBE52648B5C3E5F10DEC073E5BE9200493BA977CBDFAB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 fc18a8bc9c01820874c88e3da6e6b90b4061eb0839a1036350fb7394a3052fdb
MD5 3c6d92f44db8991e5094f6ac8535362a
SHA1 540c3ceac7489de2a51d156bae41b90b84f45777
SHA512 202de3a7cab586dce544620ab4e09d43367bdc92505a90f6a24e2473677be1d3b65fcb899e3a6c5ea4ec1aa1681e5197d3bca5c9b1b271930534cd778d691906
SSDEEP 12288:5VMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10C45236B635C01C6D83285B5C2F5E11DE8237D96EB3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 2c13550dfde58552ed51ba7d361642f03837e9404aa7a5a713d775f4ac6733d8
MD5 b1eae833bc8193610ac8df700c9a86ed
SHA1 c3ec62cdbe432c5fd6381bc39174ff5ea2ed9df8
SHA512 64c708e7a02c2b97efb1fc0df1471941db7df2665f451921185930ef70ce2da5669329c4e8d55e6157e738ac02ff3e67de6481b5eb3c687a244038ec3c1c7a44
SSDEEP 12288:bkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1354523BF965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CB9FBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f388ca1977ff2bcd3e3b2eec3455ce816c1ea942fc91883d51b9942f502101f9
MD5 be84b79e247bd4fbb2d0e81957b7edc8
SHA1 34c65c2156993b16fe2810d97bd60e1acc5e9ace
SHA512 b11f276cc3a45d0854ec88144988e8d677836ffb70485eecfc676a36836cd9789ba2c6d63428681104c13707669f09313197d2e7c98c17b134fe11ef0110e66f
SSDEEP 12288:AnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1894523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d36e4f2dd0b2f956cfce472401a0233a01de2fec3a481933368e0156db9e888c
MD5 77d8098f9aa766aae996254a6be60c8f
SHA1 ca54842a496b0684981a69fa65ca7c1449bf2866
SHA512 55b20b85240efee7b9929a27708444f9f21220b2ad3928876567016ffa60c047c358ecb90ed3fe7f13faed3ed26913e2e2501813a87a5f958470e9523fdbd61b
SSDEEP 12288:DLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A4523BF965C41CAE52644B5C3E5F11DAC073E5BE92004837A677CB9F7B14684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 2eae7532d970732906a6aa855be1f15553ec02215d5db1f2255a781d8b9cf8ed
MD5 73085c941b52b96fde32b187ff3d40fc
SHA1 1c48cf6d7efd9474640f98614aeb2678d9dc857f
SHA512 bc8e0334ed10d51f410d44fda4ce5c232bc2bcf411b2938c555b795176145653e42562b96a81d8768b435a149a625ae5b9958a5033a66944b27af4c45372e7a1
SSDEEP 24576:7ZMRzFVSOTsqjnhMgeiCl7G0nehbGZpbD:7ZMRzfrDmg27RnWGj
TLSH
T1CC6501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a583db2bec061ab2a023afc90cab5ba978f6d9518539a2946ed472f9216693cf
MD5 db430e786ab9d66e02cab283daf8688a
SHA1 0a41aa71cfee95535ad8a0282c787e2c7cb86f6b
SHA512 d8928439bee400e7bc1f10c2bf15f91df5440310c08349b2375c1751e7655836d6ffc311c47bc40c1883147ff2a91e4cb0194e99dfebf0259f59673edaa1ab87
SSDEEP 12288:W2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:W2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1044523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f64fcaae6cb32d626766439e2002516bbb892f055f1039a099b9fbde38389f68
MD5 7ba34b4169fb7fc00c2db92f4c5a299c
SHA1 e9e331f642313aa2d2ea823ece00225a58dd4a2b
SHA512 5b9c7389ba9f5d8823dfb703435983ee6c70ec471783ac85dee8efb5bcff98a5e4ab0e2f35baca5ce65efd587ffd6a11dc21237e79526a44763b711dc20772ad
SSDEEP 12288:uSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15E4523BF965C41CAE52644B5C3E5F10DAC073E5BE92004937AAB7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 02ef001998f23e15f15849a3fc0058caf7da06d203def7d98c4bd072f8afd0e5
MD5 d803ee0520fb5567acf39461f79e61fb
SHA1 fab75babcfdce53248d4a2ef6f7438f851352d17
SHA512 7f163eaad065c970e70da99fb6294e2506dac9861ac51370f9b3ed733ade2632fd95f9639bd9133110b82990c3ad77ae79a53091c0e8ada9c4907c39829a4366
SSDEEP 12288:4yPz5L8PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZzyPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14055125B73A530F9D1378178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4c332d283133758f7e8a12c1f6441ee47815344a9a2291e49a4a8a1526db9709
MD5 4d73bdbeeaff6600424ade928eedd018
SHA1 b6f6b6867e09f9ce0f62b8537f780b4d996f22e8
SHA512 5c78623e66176d7cc2a09da53b2e170b78bf9416561ded4902802beb9b4713c3b6980204f3be3e96ed252e56871dd6a62ef0bde5e565dc7dd85d1267e1c28bc8
SSDEEP 12288:t2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:t2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e66c7cbd2ad06666e19861d95d74ae6f8fdcd6fcec12c6c92061b4ed904c9b97
MD5 5904b6922c149c07ca67aae6af0d81d4
SHA1 8a01dc1a8400921324b78d1510499f7b41a6bc07
SHA512 900e788b9a2f351eac48bc9f17aa328a0a19ccbbbda89cfc50a6804a87a5895c136f12629b53de1db655264eddd67c231c4e3ea49939e11b89120bbd8264702b
SSDEEP 12288:u2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:u2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18E4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7a6d948bbc8a97aa78c023b6a3d6f71c65f3fdc75c1456847b31681210ca9706
MD5 5ce0ebd2f8b39de9c6da6a7c58a36cb8
SHA1 fbbdaab6da1415c7f54369540c813073097a7346
SHA512 30d10f427de711c6fb1460feb075a744113987fdd4382f2215e3bd011cbe1d1d6d798dfd619ffb90277742e01ec1d04f8d4254b8082a84fd7cb6373e09150250
SSDEEP 12288:fyPz5L8PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SzyPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF55125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 cb6539c295771ba278d60a03262dc2bec43c00f73002613ea8c0c2e91af18d08
MD5 a083f51f5d08b1f5fc383e65d65af9d8
SHA1 de76d6cc787ee896a3ec411a8f918bd2a536abc6
SHA512 f1b2fb1b4d3da338d9fbb5f40fc2c6003506eed711cb793a8110b2715cb6dfd3b0d710ea051d33ed50a699b55b4106af1b51109a7353abec0602505bb551afc0
SSDEEP 24576:3TDaLl3z0zD9sqjnhMgeiCl7G0nehbGZpbD:3TuLlj8Dmg27RnWGj
TLSH
T1FE6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 70d7218e31adaed324ac137c5e78d71f1f05ce9ba1bb0c993ed1ebb6a7b01ae1
MD5 592c39a03afac5cd5b20dc209449884f
SHA1 b78563d34481c970e07711d647e2fcfbb1f45db2
SHA512 54a5490f195ef2cdb7e28d017e64cf500443edc1ccae41ba867176e76bca914baeb6a57f5046e0681e91ff5abeeeded7dd2a6d80f618c5e9ceea0e76eb02cc3a
SSDEEP 24576:B3vd9CHKy7GZhsqjnhMgeiCl7G0nehbGZpbD:xvd9CHKyarDmg27RnWGj
TLSH
T1FD75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9f33920a66101915292c80ae189ae29c2b73b7d8f49b5b04b4f24b4681f851d5
MD5 27b20b84a737d970c61bd1ab633f4703
SHA1 5b99939fbc5959a8747bb9052527a86c16602440
SHA512 fb6526d3f35144d43f7585cea51e09305b82a31dc7e43b2958ca6735cd5a4c9108630e89caece1bca71b25113697df2cd6f23f1975efe4391415c27f58fd2eff
SSDEEP 12288:sNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD4523BE965C41CBE52608B5C3E5F14DAC073E5BE92004937A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 7631169274550e4bc5a0e80b694251393e8331d65971c39924020378b1771d93
MD5 d05dd0fd8a69633680e68b9dc2cd15e5
SHA1 718a09d023044cbd80646da29df588b5d132b754
SHA512 25d7c427912a6ddf1a8ccb0e97220cfb049a327a14f78a2767644d23fe937eee51e739243fd50ce2e25296bc6fc0dfeca8ca9121cf4da4b06db06757ef6d17d6
SSDEEP 12288:nvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1974523BE965C41DBE52644F5C3E9E10DAC073E5BE92004937BA77CBAEBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fbe9560a54ea5dd14206248cc46fb39e5b5aa1ccb32f1a3096442c4da964ac4b
MD5 12b111259053753bce6789e4975cc279
SHA1 5050a64563365b1257c7732210e38a9cd531889d
SHA512 d093b9cbced613f5cf3dd7930dc5c2fd354058ccbfd1b815847467639da3bc9f60969fa4bd1f7dcf7c20ec1e66792c3c4dbd4db6b422531ab8985b629e820286
SSDEEP 12288:MYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1164523BF955C41CAE52648B5C3E5F14DAC073E5BE9200483BA977CBDFAB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c56430d5edfd267c876021f371aece174182d9772d11a3a173587201dc3b194b
MD5 2313bc6ddbe3999ed23136010fface38
SHA1 cb8de4cf425ffb15635fee849a4f3258304be679
SHA512 b93729e0584b853843bd0a0c00a7a0f4be9f516aec6dc8969fd663cf066f73275dbfdc8aa39c421b5303fc88e0054df104f566a7d7d28ef813852c2bf7786900
SSDEEP 12288:W2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:W2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b95082ca4bf79a57103fabe1d38eb5db56096ad6426b2fbd6e1372f5e6973485
MD5 058fac1c2f86f6823d5e924aa89de28a
SHA1 f65873ea53896da0b178eb4e598fdfc5b9e60f34
SHA512 be446e580412fcde499fa3168e242f98d23204db4ca76fe60b2360ef44c115b3e5b8509ca8615251eac65538704b4e948a10e9349fa2bcd2686abdcb54bd34a1
SSDEEP 12288:fNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1134523BF965C41CAE52608B5C3E5F14DAC073E5BE92004937AAB7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0f2e396954b1b25d562116e88a060c05ed23cc415b59dc630eb2dea3115df27a
MD5 087de0a602c7870e30857e954a4ca22f
SHA1 865e9d3d0406ea0c2b14f8190db639756f20c957
SHA512 b747040b23b53f385e6fcbc36f16295d6845aca40f76871178eaf332884f736cff2c0a45cb2af8dbd1686f4545752291ecf30ba41bbca21b6d03b99bc805b9c6
SSDEEP 12288:YOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1664523BE965C41CAE52648F5C3E5E10DAC073E5BE9200493BAA77CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 34c364b91277439ccf42564e2d10c4fa30b0b96ad621bfac29b118cc7f498fcd
MD5 332f570fb8f90ecb5f09e6d366c5d2a8
SHA1 44e54b79e5230847525588738fe68fa00d8ab956
SHA512 5f093827615bd486a9056d40f9d97a6ec56a98be411b50a3fa4773269d0ec45be27ea4895425d5c75bfef2a74f005f9c6854cb5cee73b00cf7e168d5dc28471b
SSDEEP 12288:FkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB4523BF965C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 3b114adc4e6f01f27215de44c1ef7ce651a7398c9387732d5603b47e74f9e220
MD5 68514fb02fb0d24ab7966cb26b9ed20f
SHA1 7633dd47cfe1229c5e55f43e48cf64763a4bbb10
SHA512 3608f3559184910246579554818a80a8ebc486043be9b28bfa9fb6b45b8d23e0e8ef8d4481c0d8b140713cfd131088a46f27c81ae3285a22117e5c12a6fc9e58
SSDEEP 24576:ffwvUk9RX6wkyAICsqjnhMgeiCl7G0nehbGZpbD:NMnYIGDmg27RnWGj
TLSH
T18985D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 46ee71f7f6ea1f08d807ffcccab3b0da3efe14999d4af35df2b90a51cfe9aeea
MD5 a1df69e0eb4943fba76453dccaaa0efa
SHA1 176866dff6cb36cceec94710dddc9ee2d8e2c6d3
SHA512 b0d6be43af43f88f3dbe6b48126d366dfd3421ce0093bf2986e870a41d0c4a4d1382160155c2cb8c684162cf837f1fc9f856567a822ccc6aaaed16b2d2d9cf66
SSDEEP 49152:6YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0dDmg27RnWGj:BySzP1D527BWG
TLSH
T1B9066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6da6440b7e477dfc35a4a615c9f136b5e0498721b6bca9b288830ad3b9dc7b09
MD5 70ed8631f8bf018c2f569d7b96494100
SHA1 0467deadcef257b171abbf767f0a10247c01d014
SHA512 dd2bd342a56fd0c3f5ca95f5cf4c52b04f265fac68897ec864ae54cb754a8905cf4d94465b54f8e06dd6a1f31c75427199c8795a7b3d0cd575f8b5ffa2860adf
SSDEEP 24576:a47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYDsqjnhMgeiCl7G0nehbGZpbD:a47JUQjTirIhCnDHUPfF/NDmg27RnWGj
TLSH
T10965AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 b55588814bac2eb20ce989c5d944216372b0ce5e549fb9b27877705cd716f9d9
MD5 d30b488ef1482e879e9fa66168e20fac
SHA1 74c4acdb7698820149c0b81a95635cea740ebc07
SHA512 b0079b41c82abad612fc5600e3a9055b5e827dafcecef4b1529d1d57d69f26f9bbd21ae067b98369cb2b8f7cdebbb9dc8547917660b9740e5fdb0e2432d4f14d
SSDEEP 12288:gbsfGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16E55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 a4e0fe9609af2d8d59ce4b521a8e17f73fd23af177a76df2ebaa3f8ca299fa9e
MD5 5794ff19e2e4ee2b81be39d767406612
SHA1 83c1b89b0733304220bd21712a70b1e87b1c6c7f
SHA512 4996cc6fc2a2321432ae8c2ba68fa55b6ca399923c6d7bfed99ee39677a0c3199563ba010845fb8cbedeadeaa436182bfaa25b24d87842aecda1bf8fa7968b77
SSDEEP 12288:WcX8GBqsRvBSXpN8Hbao3V6sk4GMA0fdXjM+/+/G:WXGrR5SXpN8Hbao3Vp/VjZ/
TLSH
T1344517107626CB4FC66980325E32D6CCAB707C51EE056F0773C99B3FD576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 d32d7c88f8e11ba102f9a45a441bacab99bdd147def2dbaf66fab798c114b9bd
MD5 235ec537ca8aa3cbaf9c4a9c635fd533
SHA1 4d62d3d55cbbbfe76e65eaab2380d4975a0502fe
SHA512 909e9edab10986014addeff5d573dff59f87683f7fd321d00b1167cfd1fd665ec2281aa75225c53c10b4d74ed199118471850dd2f655c3822db0891da9f585d5
SSDEEP 3:OlH/lKfXl35nwMK3mCllltq3mCllltGlslslslslslsl6mOerbX:KYf135nMmCtSmCtEEEEEEExxr
TLSH
T1488192B89B010A60CAC620B1003553AA17B3E1CEB40083DB0918B1168C302540F16EBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 42826585100dfb9f1bd6930dc732d35d0fbe9e3745420716dbd8e4259927588d
MD5 407a5d59ec35c396dc63895a7684fcc5
SHA1 bb249cc6e7c308a7e1d31532e9489018964f7b43
SHA512 3f0acf93920fcbefe7fb5999c9c43f84957ed29a18309338c0b1f42b5379bc2216bf49c58c436b6be8f90f1e97e86e00b709b12d7ae9f159b90fd7e4585f90c2
SSDEEP 6144:qCIKaNi7p540IShKDeoHWbh8PR8hKDeoHqJCf+XugjBNzsGwoNX1PNSKkNc:q1K54UlhZHJJjBIohxDki
TLSH
T10265E941A137E78FD0B75031072A5E8CA7A4EC06BB096F26B3C9053AD86A745F0F97D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 314a22b20750790e5d63df1df7215cf02e1a5732cc266f8ae360bb53a7dbb673
MD5 939e3c592f9b54b85071fc7134337e14
SHA1 1834eae3acdb016e4aabb9d5472c30fd994c84dc
SHA512 684eb994524eeff9be9f0f42519e28c874f731c4f58f79e8f13060572a574cecfc0d9d4020786a4221f3d2a780f00278a06ea210f74f3f55422d4e5c023bc723
SSDEEP 12288:+07eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HesqjnhMgeiCl7G0nehbGZpbD
TLSH
T15745237B934C518AF93605B482EAE12D680B7E669F1044C3BA5778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ce4ff0d9de3d77909cc87d6d3a6a2887f5d6eaf046ec221000bedbf644ca3555
MD5 1257efa8f0f239934e0a45a7cd655f8d
SHA1 2d7ba821aa777d20d93d123c7c2722ce85d60832
SHA512 36bd52f896b35b55d7d2584c89899204eb26a10b6d776af605fea84ff8a2e6913a50feb467068ad94708a5b403b8245155a282601f08d61a44ac46d5811cd314
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYAsqjnhMgeiCl7G0nehbGZpbD:Zgb4mBIBhGFHDmg27RnWGj
TLSH
T1CE659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 f823f3b49c6950da38b61eca50a9e6337abbd3db177758f26a3d94ac7e5165cf
MD5 303c547320c80fdb39a91bb1cdf5279b
SHA1 167be417472049f52586c0f11e4c6ee0afeecbb9
SHA512 b0643f08d768e1b000bef1839f489474bca43a30a2fa7416a97263af448cc5ce3cdf2e7ef25e92436f84298fa0df559acbf17d74c4fe2d987d133eb8713b0862
SSDEEP 24576:HG88u8FpJqH1bzria7/mTsqjnhMgeiCl7G0nehbGZpbD:m7ZFPqVea7/kDmg27RnWGj
TLSH
T1EF85016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e7baea340da41eb7577014b92c789b940375dcf77e2e6af5970566b44f006e01
MD5 a0d3352a140e95801fd706caf1d7bc65
SHA1 3282ad49c01a98b8d09c6f93e8c5b90285c45644
SHA512 436d12684e0b4cd25f77cf0facbb90ab6d7d4a8e7f77e30c77960b313f0dbc72732f4f1cecf709a9c46d877519e5914c1669fc43848bf0797735d7c7ad9e7067
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7Dmg27RnWGj:kG05lO43buD527BWG
TLSH
T135D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 af61064b6f09687f360bd581c26c0a15b43fe03ed524a521b7497335e74bba27
MD5 a391909a0f7c7ca83ace8eaeb1fd1ed4
SHA1 fa326063a8e93f3ab6112f8f6d76570759bebaf0
SHA512 acac8e2a63edc8b03497442b9aae8f1e84a5a9bd9dbe90969d4f41213d6c512a22fd639ce65a86aab93ace5182a64afd6494081b70f47f44fdb9ea1b5c2fc8a6
SSDEEP 24576:cfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnZsqjnhMgeiCl7G0nehbGZpbD:Ea5POZ3BJt2pasx2+mTDmg27RnWGj
TLSH
T16C65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3b9633c003eed150c862e97a4297ad89f5063fbe0d8bc163a486fcfc8ecf1c5f
MD5 772c7e7552149d573bc6d7216827cacb
SHA1 dd280635408c34572b175653793774217aeae793
SHA512 1c42327814b18d5057f0b1e88a022e16629fc5b4452c9b746c4ef5707198091af8b0a8ee936a2e8262a824d9b5789787051635791fe65452a13730bbc08b9cd7
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7FkbsqjnhMgeiCl7G0nehbGZpbD:fNc/zEOVHFEDmg27RnWGj
TLSH
T1EE857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 003427b6c10af4ef7ce2ac1da071daf7da701996184a7fc9ee76a17689e67fdd
MD5 54188a7db73f636a4904e214122d0777
SHA1 d8e4ca34ab241f0ae10b1384580c35916c2c5e27
SHA512 39b617d16e19ea05b148972502e441718e00dbf9b8529ec2681327b5dd8a3ef366300bf4751d19434f28059a491e938873690238847a46ea7733dea82dce7a91
SSDEEP 24576:eTkNvNnaFeYhJNtmZBm1sqjnhMgeiCl7G0nehbGZpbD:eTMwBtOmpDmg27RnWGj
TLSH
T12B55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 861023d4558d5f5c3246e2c9eb303a63d949fa2b317d4ffda162b819de9d8aa0
MD5 78f861414f5062e2a3cad03b67773378
SHA1 de52a27bc2495da8da51ed9ba3f600b63d6fd8b7
SHA512 ce186fb77284592aa2d4bc0ccdf22b2dfe6f83304ac5345d9f3ae33881e6a2dfd2195e6af2f38bde3b280fb6ae38aaa09e1188a48f82ff9dde8f046c6458f83e
SSDEEP 12288:EHvUrBFrEjwaQXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:EPUr+NQXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AB65F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 36b1471e6408ab96b5583ecc81ab39f0bcad4989308eeb79838861119b77d964
MD5 73635d087c99d3325e95f39a554d2fb3
SHA1 e28f6c0fb00c7955bee0cab531405c64dd7ec2d5
SHA512 0e44d79695bd5cd9473e11d287b0647d93a683780294b32503c2782a5a190833851dafb5a1afd17b70d2c95d862a99a38875453d93eaae86d5ab5da62b30af90
SSDEEP 24576:1D3FHshBIYQgAKsqjnhMgeiCl7G0nehbGZpbD:1DVHeBIAAeDmg27RnWGj
TLSH
T11975E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/792-288-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/792-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/792-73-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/792-67-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2204-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2204-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2204-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2204-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2204-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3256-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3256-131-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3256-126-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3256-120-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3256-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3332-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3332-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3332-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3332-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3332-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3556-50-0x0000000001660000-0x00000000016C0000-memory.dmp

Download

memory/3556-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3556-40-0x0000000001660000-0x00000000016C0000-memory.dmp

Download

memory/3556-46-0x0000000001660000-0x00000000016C0000-memory.dmp

Download

memory/3556-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4232-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4232-264-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4232-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4232-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4324-1-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/4324-8-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/4324-7-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/4324-80-0x0000000140000000-0x000000014030D000-memory.dmp

Download

memory/4324-0-0x0000000140000000-0x000000014030D000-memory.dmp

Download

memory/4448-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4448-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4448-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4448-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4916-106-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4916-114-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4916-306-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4916-108-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5380-95-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5380-307-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5380-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5380-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5380-101-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5380-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5752-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5752-303-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5888-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5888-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5888-321-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5888-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5888-88-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5888-82-0x00000000007A0000-0x0000000000800000-memory.dmp

Download