2526a871ee6482fdabae08db826dfd086eba4005229706b8bbb1ffb45ecc5ba5

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Size 6.0MB
Sample260702-2egnpscv9r
SHA256 2526a871ee6482fdabae08db826dfd086eba4005229706b8bbb1ffb45ecc5ba5
MD5 cfc660dc56b1cb73c4898fee44cee38d
SHA1 e7242cdf656da7b6940a90d0ed992356d0dec9b8
SHA512 39990c9928c02b45647334a44655a58ff2d789958dd0d1d716c395cbd3fabf7a1b0f7beba60d4fbd601b505d35eaf219ebc51179670a2651acb5b909ee9d5b38
SSDEEP 98304:Em+ZqQDrTU61xNWPDKIvCFNyE3oYGbiCtLm:XAq4U6JWPDKI6FNB4YGeUL
TLSH
T1B656AE66A6A450ECD57BC17CC6568617E7F2BC0503719BCF06A0A66A1F33AE12F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6780	elevation_service.exe
6800	elevation_service.exe
6944	maintenanceservice.exe
3916	OSE.EXE
1736	PerceptionSimulationService.exe
2932	perfhost.exe
3248	ReFsDedupSvc.exe
6744	SensorDataService.exe
1480	ssh-agent.exe
5116	AgentService.exe
3680	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\46676df4c8b6c6e4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3416c4c720add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009735f28e720add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031fba64b720add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000cc3bab4b720add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091354a4d720add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006016d28e720add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
6780	elevation_service.exe
6780	elevation_service.exe
6780	elevation_service.exe
6780	elevation_service.exe
6780	elevation_service.exe
6780	elevation_service.exe
6780	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
836	Process not Found
836	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeBackupPrivilege	3248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3248	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5116	AgentService.exe
Token: 33	3680	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3680	SearchIndexer.exe
Token: SeDebugPrivilege	4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	4012	2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	6780	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 4888	3680	SearchIndexer.exe	100
PID 3680 wrote to memory of 2508	3680	SearchIndexer.exe	101
PID 3680 wrote to memory of 720	3680	SearchIndexer.exe	102
PID 3680 wrote to memory of 6352	3680	SearchIndexer.exe	103
PID 3680 wrote to memory of 6812	3680	SearchIndexer.exe	105
PID 3680 wrote to memory of 6156	3680	SearchIndexer.exe	106
PID 3680 wrote to memory of 6944	3680	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_cfc660dc56b1cb73c4898fee44cee38d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4012

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6800

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6944

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3916

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1736

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2932

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3248

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6744

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1480

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2581000985-3042091657-4068028891-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2581000985-3042091657-4068028891-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4888
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2712 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6352
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6812
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2712 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6156
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7e4cff96424c14c0a2efafdac26a069c778c7ed3bb9d278fcd2ab2bcb64aea9a
MD5 fa64fe848d7fe6e18da83156772a83d6
SHA1 2ad2146b9b3ac9b28d1717ae5c47d3b7e4d39e27
SHA512 85b218cb6d4c8ca6a59ee2da9559ecb57a97c01035ab0fc8970daa82f7e00670f08a31481502379e45ecf43abad96f800d76e394f70d3ec2a85adf1b3ace58d6
SSDEEP 49152:wb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn+Q/lFTjN4:a3q6HjBOLm
TLSH
T1B4D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 77b676699ac374b1609cdfe2d9616f2f74a2d1213421a4f03efcac6f1516139c
MD5 326654a6b63ff67751f2316165bbd2a2
SHA1 16e391fa174fe46a69d3e175cb01437d597c6c24
SHA512 93836c542832ac2da979755957f745f28a41a3755aea02678283400d2ce008a33b93895546d1c8c3b2eb7b965badae0cdc4241d9615d8baafae2cee020617cef
SSDEEP 12288:h1XLsswWkxy2lRq2czAdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:PXYfDtczA9nQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1CF65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 6068f224e6971a2819aad2ef498557f1882de602831c165d2e513539dd9051d7
MD5 b880c87931cf14c158e250fa8b991ab7
SHA1 e028fcdf1b788c5abb6a35ab2ab7dd472244a96e
SHA512 cd7e8444d93dc355f6cbcd9b7ae60b6b600d1dd1f4305efbd6da4ad7417a88b0d5c2e6f6fe02eaa1ec296a459f80d570d37976c6aae68e41122fbc162c232735
SSDEEP 24576:d0Le5ji0hmxLrMGnQ/tbw/2Mkjy6Fr7g0oy:dPji0AlDQ/lFTjN4
TLSH
T14E859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 683d4fb72a2a1c2d3c087c85b51e6abbcedfffdb9067bc1c47c26d318bb491c0
MD5 d2356cdde8a46c9921b8e6a6d4275b66
SHA1 0f38d049c50a245eea1c0c041609929f21e502e8
SHA512 36d29368080e9c713eeea55641148f2a0153371af2f45d802aa646fd80203120fcacb21e1e9f9a37580de9d89c126b10ede3dafe1446d973dfd3144114956d21
SSDEEP 24576:qa7/ezSC6vUyD/aqgrvWE6q8wyuQnQ/tbw/2Mkjy6Fr7g0oM:d/ezSC6vUzPvxHjy3Q/lFTjN4
TLSH
T126755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 404c27911740e076e18f3afc571656ca64c59699e3e96291edf57cc2281ae151
MD5 dfcef426bb4d267908312a204de8fcc0
SHA1 de05e663e204a8986ac8e30cd30cc9f1560b5231
SHA512 71079fdf8b293606efdd2f64f0c62bccbedb9d9a18bce637c5457830e6dab824320af2e5a7492d77331af6b6aeaa68fa5f84ddca90c3504ee326a25cb62c2b24
SSDEEP 24576:cVbqPb88hv/l+6JnQ/tbw/2Mkjy6Fr7g0oz:cVO88hXl+qQ/lFTjN4
TLSH
T176559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a434065fc204e53e2220e71f6fedf847dd108c473f41d45e638af4eba320c6f8
MD5 19b0056b769e44a162003c91ec0218a2
SHA1 87ad2c9f07a4edfe21e664ec4cdf5f2a8c0a1904
SHA512 af2c06f09870185e5d768bba4cbfdb44cb34608fc9882ac5dd6e31b41316c8a00c280e30bac804303e6dbf6a4323ed8f5ac32b7e685456bfb86e8da867031f67
SSDEEP 12288:+ziGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:+zinQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1B95523796A24F897FF2B06B15CC284826B7B0EC1BFD4AB4E6744362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 adcbacf506944b8fe53b27d6e86214fb6d6e3fbfc2c3ee3311a301baa1cdf8e2
MD5 c649d050d11fa0316e05885e355175da
SHA1 26a4026a1a238a3ba67a6fb23b6b5f81202a6a9e
SHA512 af98400379798ec081189dd887f9121fbbcab5caa9be74a276d51a122f4cce9d1a1eb8f7a4f2e272f33a11ce4a73dd666b8186cb99661e3932edee654419cb6a
SSDEEP 12288:XeBNUbTVO86UBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:XJIURnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T15975CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 42b6abea5379e47d31af2fbc6068d31ea9090a7af7d21eefaa7020b1564ab511
MD5 8c0e38e22ddbaea5a02a2e16c5b824c1
SHA1 8550c02e2a322e559bcf72b16118dc7da6cf29fc
SHA512 ef41c8a33b01bb5ce077a11cb3ec63d597258dac2e0d2b5507799e857c1206d114f6652fb0bf8b852102902ed19f18b100b45234b28e0715a86e1d7480dc17e5
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THp:JQvGAdlCEL8c/yRNw5CTLm
TLSH
T1B3267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 d96a3e5cba8811abb0829f1e9d8c2c556f565f0585f7707fd7d8d7d8a8062f2d
MD5 e474258cd94ece79afa73ddf3ee87ee3
SHA1 c99662ce0d59d56a6bf3b107526e49377280f12f
SHA512 182c4524be138d223a871aed58170cb38dd52431160b4431ecdf931fae0861527fa334e837e0f4f5c6a86780ef83bcbf3fc4b20bb939d1f674cafe5824b01260
SSDEEP 12288:iAwSfxL/2Dc39DLLmt0LDQewsAjDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgs:nQewsAjznQ/tbw/2Mkjy6Fr7g0oe
TLSH
T15675E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 77933cb691e368291f706a66830edecb73fce43078c9ccd1c7b77b77b5c35afe
MD5 bf83e2f30fd9d70d9c6b78dd3afa0620
SHA1 cd68f9cbf1611d8c99bc5ccc2b44e8bd40f10766
SHA512 5093a382e555aecd38ac998a8225df33c337fdf4ac68487f7906042d068ef1c5ac52ccc51891c9fec01c251eae78483d6b6201f8d36e10f100ae4e59e55090ec
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHAL:rUEtQevvqc2W1cpV2EI32
TLSH
T14E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8cd9620a139eb1458f2848f733f9c1abb958f4023ad773e91cf4d6f3a46d2925
MD5 dfff2670daa9190f2aa5a54ff781c90f
SHA1 5eabbf44a829829da1207ad8d8a409bc14defefe
SHA512 2d9a8043d737c0da581f868815182032f54e9b065113b9f434c59ff771d780239e04cfcb9b2a0fa1025f8438292d9dca17b488299150d085b1ee6161f3eaecab
SSDEEP 49152:2CbRquA/m2yL5zQfFiV+XenmE3/zTQ/lFTjN4:7oqtVjnmnLm
TLSH
T130D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d49aea37888c0c9b3e22a63d0c18b417806ceaf2678509a33ea06ec3855cdc85
MD5 378d24e9bf2a08d7e143c004dca465d0
SHA1 5b402e00c45de79fb96023eccd7afa57a33d47ea
SHA512 2bf8559eabf5a452b524ef2f13fa94c7b5ccfc0cee96db7542e2a608e4ad876a426df1b89a207175b5dc18c8d4ffa870da3d2a911476d8766d0233e9eb76a969
SSDEEP 24576:gAhGLJIFoiwtA5l7S53UnQ/tbw/2Mkjy6Fr7g0on:gAMyFoiq5kQ/lFTjN4
TLSH
T13335AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 f0e475a5ace07a55244f7622afbcffd1fbffa4013adff40c79ff5a81c6327be7
MD5 32c7b5b96e6d6c3b06630bfc30766ab9
SHA1 638d291c9f92c5ebe2daef9cb9e814dc77d4ff3e
SHA512 16f54393e8e6ff58c96d7c2184166328aedbcca42afff5705601be73c0d8d9eee6d7d1e1eeabcef9f8b8648e057df1b97038a000279dd6691320e2928ea34e45
SSDEEP 12288:6mw5HEjsChN2BFgl0WDm+CQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMO:TwuHOWXnQ/tbw/2Mkjy6Fr7g0of
TLSH
T10665F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 21923b3907236c6b6a4c076d4dac5c16c00cc2ff0b4c0c0739626595a90951f6
MD5 3f615d3f63476de130a79c4983a614fe
SHA1 547f02aa58ff08f51624a85a55c14b0744c698e8
SHA512 332e0f5f0c2c63af7dc4a3c9542edb44646ef69d45e9127135f5876d63adac895850cf65c5d38620ba0f9a6cbb07d76c4fc6203b28b02d1fe1083af60f18e049
SSDEEP 12288:zXZ1IyzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:LZuunQ/tbw/2Mkjy6Fr7g0oG
TLSH
T12455126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1f47cfec9f7c2489ebc342595f91dd352ba23023bbdce6fd13c99af9f277196c
MD5 cec3ec597b707850763543f113824e6b
SHA1 5552070677a2ccc1c0ebb90cfbbcbbd46ad28c0e
SHA512 89a691ad4eebbad39a6a9d6422d15de6036a438d514827cecab30787a97b7c7b13f6021ce1b4d4e1aaaa318790aadf78dac4f453216cee69c339b6bfdfe67b1a
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:QQRQyi36YOcPQLvw2gAf+PN3KLm
TLSH
T13D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cff895d06530aa11ce46e980c99706b636657aa88a1fbb5c40902ae87bfbf6f9
MD5 6f034c6e4c38702b68b64405d77b4785
SHA1 0c1eae8ab632a4b2e6a587534fd701a0101f6ad3
SHA512 a462072ce904d667c4d9212e6f4fb6c5cfc9eac0e5cc5613c3ed5bcd23567615277dad1b61b5f79bf75d5433fba71488a7fc283df99d3edd46602a36a4ebfeb1
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:DQRQyi36YOcPQLvw2gAf+PN3KLm
TLSH
T175667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0c595182363acb4908de7a29048b2c161c961bc88fddc0246c620ffe3b1449c6
MD5 9f7c8233e295500ffd0628ae65bff11f
SHA1 bdce099635d26ac0dde4db4ae8d54e9d8c151fcb
SHA512 1775919960d78180d2bcf9cfc75c0c6b65c80c486721f171fd6e533c9cf7dfb8b7081a9ff31468227f621230f456d0f309c1c2e0bf15c0938c96a9f8b76c7e27
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0+nQ/tbw/2Mkjy6E:P68Qg55nhheWu7PNU3/DQ/lFTjN4
TLSH
T1ACB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cbd3ad6ce71c68821d0204fb0d4d72057a6022d0a1eec40315462c24d1d8bdbb
MD5 010f8306bcdf0ae00473c55306884d86
SHA1 4f72951e45d2786dfd87f527531ff141ff9b19c4
SHA512 226e644c115a50c622fee394d708535412ac4e3330a2dd7532591d595879b4b894f88f26373a67338ac526eba099a8b7b68ff2d846dc6c2354b229f85bd5b7a1
SSDEEP 49152:B3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99r:Ay5112gYy5azzVvL69nLKnhZtLm
TLSH
T1A8167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2489d77ba7e288eb779a0a5b569fa8e39daf67d4163cb9125cf9b3c4da2d7fca
MD5 e646633c801ec208a747412594c73864
SHA1 d8c76a1be4c271b43bae3e8b9ab9fcd65db1ef06
SHA512 9a0ba984bf25d675aa6408a7eeac5710d26fccf60c50e259632a45572547179780b31e8d9b8cc868eee52413468ad8c1a88248ac1ff2c46fa7f384f21365651e
SSDEEP 49152:YB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glNQ/lFTjN4:yu6JmVxd2dCLm
TLSH
T1B1D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 240bc5ec79318565dc57cfa50752c1a785f0a84723eaf5254b8f7789b3eb883d
MD5 976cbe068d6980e8c7ed89ab0d5ea5e6
SHA1 7a9202ae5f2d3dfd5a61564bf1f7e24b00ce1bae
SHA512 b71c8cfb45118e380838ab64ef331a9854e77869151fba6f55ef916c0874ed57420332758d20f958453864b412add4124aa5f285762231eb6398c20284fcab78
SSDEEP 49152:M1hpsNoJpF1A6UU44CwH7R4xxQ/lFTjN4:MmifPbRnLm
TLSH
T171B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5776516e454c0f027ee3eff6059c94383cf4ff64a4d4b66559305156f54f0de9
MD5 0d6df28db6998d7444aacb3f2c6d5b97
SHA1 727de8d14520d7cf57a031b5b19f870567e23b47
SHA512 adc964354bb6f0119639372d098c93c0e9588c444bfa230011cc453614b4f2db733f0aa04c9116409531abfa4621020dfb3a290f9862533f102b2daae50f3fd3
SSDEEP 49152:YSuZQIY0Be2KRRVtOnks6NMHquQ/lFTjN4:C5dKTi61JLm
TLSH
T11BC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 67102610faa6c70d46f6410732f9cc3a17a1f1709f0716df5b03affaa19a5ecc
MD5 1d9787acc64150b98d09d1243f793927
SHA1 92d19e20788b63ab7d439d19bc62a4e5d176cee8
SHA512 8b8bc1fdb60cf0a28ad869b224e595152742d37390c22a341d773ae000a3e253d1a872b3af4d5dd52d2a02cf9603175fe0b2f98fc2f07dd61aaf2f4858da6956
SSDEEP 49152:ohtSn8EApI0figngiDn0AP5w9Q/lFTjN4:5X2iyphbLm
TLSH
T13595BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 edcb4c6e0e08474cdbea85927d004358fc5e80264367ead92befa862ab2fd661
MD5 88bd1b697af25d66d8823a090b3a6a98
SHA1 f383f0d021ad4eb66626178f6b08b54c4e026b42
SHA512 d65f1931a1794e2cf6072efb39b83ea47d2795008041cfeb9e129aa3de6864629137432b41dfa9936b76c7d7ca3f8847eefa1e2c631ecffe73874c94db66afaa
SSDEEP 12288:3qGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:3qnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1065523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3b80f179a1814f452ddaa7be5074d72da08105486e242c403a078c630e6047fc
MD5 2e75945616749ed18ca71a62168adbe9
SHA1 777bf5ba8b5c56843ffd69063e0101a0bec56b53
SHA512 2c2508855bf57e1a32f1262c1f5298b3a30eafb896ce5a4b34be7ea22fa2e667c1325dcc5d4d3edb6ab91730214c5f4ed745b1040bd153e39084d9a1fa126695
SSDEEP 12288:BvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:BPnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1765523797965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 13c1674ede5993aad92c8bba58f355123f195c4636c1665ec9d34dac322f7cd4
MD5 a53471ea2046abdc17d8b51097130199
SHA1 e3f16851229930fdca5e79f70f636a24dcce99cc
SHA512 5a2d5ea6712b8e89b2ec402bfdbc19462ac57075515fbc99a2f4b23199c90c61c30fab038cbf01a03a0ce5f90df0018ea5473669bf3838d7e2977e913573798c
SSDEEP 12288:KJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:KZnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T15B5523697925F98BFB1706F14C8281829B7B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d7f8ec583ec1d1561fd1b639845e4776005ba5e4487a2931e93cab8391657aa2
MD5 05049c85f065e3bd9a9d756b17ba2d95
SHA1 5e86cf8a9718697f10b9a51cef6ff8f088685abf
SHA512 e170bde748e3d6027c73c3526e17d04ba92b0ac81796cd3016436b7acadcc6308a3a131333867275e472490e7504a4c5750b94e5bf66c77d34614a9b7dd8d8d5
SSDEEP 12288:lVUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:UnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1995523693A69F4C7FD2742B4CC928142E77B3DC6BBA1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9dd6a3e6c1d87857e7641c7bc60be06ca120da0fc7a4e6981eea3a72722b6f03
MD5 691a9a1c6ea0df4a627e81ce1b994874
SHA1 0e6c863aa02a7f94b6cc23ad9ffe698eab87ac31
SHA512 2db775d031a013b4cf08f4e7acb1bb09f08f5310be5bfcbd8db3134602ab7dc9bc6e52a833d6c14f9acf2dcbc2139c6f31b941fa94c245de788df77304c4bc2f
SSDEEP 12288:hsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:hsnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1C05523697925F98BFB1706F14C8281829B7B0EC6BFD1938F774C2128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5e12e03ae1378194e4c1b817c647cd31977e598d6009c5015dd5eeb19abcc0a6
MD5 17111413fcf9bf8e515425e10a707388
SHA1 7b4520aaa0aaf25b69ab7151ab27f2f648398733
SHA512 37b6e24c56e23ac1bf2ccf196f95d39fc5dc608d585888b4acc1e929f30b8292beaf804a73e6d580887886f41dac82e9c632050e97ac0457e232adc8ee58d7ed
SSDEEP 12288:ALGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:A7nQ/tbw/2Mkjy6Fr7g0os
TLSH
T1765523697965F98BFB1706F14C828182973F0EC6BFD1A38F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7a59bb88d5d40f805b3bce18cc15969b8dad637b8fcb49646a7b9ebe01591d58
MD5 233a8cfb3204e38a98982fd51d56bb2f
SHA1 260aaaf0b698890fd755e15a340eec31d86dcf78
SHA512 fd8db2690b150023631d4e95f52ff1e14367a88ccd76f0f24a7b5e21e0279c267fc54a32355f5322828ee1551ae1c9b23ca69e19ede5ebf11e221ec6b6a8bd45
SSDEEP 12288:wHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:wnnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1915523797925F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 c22fe04c20d3cf41498370ad9cd87fd2efd8e5b96397b66c72db14053c3238be
MD5 0374e266746d09f8da36dc22019cdb97
SHA1 1fcc8beb79dd51e7bd3f361263a8b66f3d282711
SHA512 be7ca00dd3c860aeaf64b80324d5fe6eab2a8ffd49001d94e5b2ffc31bec572251b686ec06c3e66da11e1bbf7f1775ff13ed33ed8324f551d3722cdd109d664b
SSDEEP 12288:WiZwbDzzFEoS2cPvyPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:ZZM3zFVSOvnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1037501A9B35058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 83fab02ae4e8d9869bf0cb904678d7e9004e082ab972be5c2683550948ec0d02
MD5 320b831c95ef0daae3ade67a27e41285
SHA1 32ec1502e69556802a1e3c56bf9cabc1eee8c915
SHA512 3f8cf16208ec3f1cfbee53aeb5de6beb01931694d1ce279bb38c53c6f8ea8eeb13305a78d71d93f7c832e7e8470a6102cf134752183afd8f3bfe1d01db4ce62c
SSDEEP 12288:veGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:venQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1A85523697925F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c7c4bda4eb69ca2bba235140480f2f704f78f6f10a0acc4be29245b85fbf7e0c
MD5 9a85bd0a8e14c11e0e5d66553322e0a3
SHA1 04c824c5ca0d8d6614d509a39bdccc75a49b6fcf
SHA512 976cbfb26e151ea271e82182ffd3fe65d6945ca362f4feebfd23453ea68bb67301ba9bb8b395a471451cc72179600f550262fe0bee8291c1d6130afac458563a
SSDEEP 12288:ESGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:ESnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1835523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 0909ea48939e77f0a91368fd8688a484c0e9fc107c23d6922fbaa35777566544
MD5 597e7db384f1e9f8fbeaa431924592fc
SHA1 d198c9d2a76a753d7e02c903afa39e5e4bd09b8b
SHA512 0f9762a68e1869ce57798e7765d350d22ebc2c03333cf9efb1e78a3db1ac67cd0c38c35436b4f529fe0671a2838f7b3aff5e5aa0a049e3902a28dde77f4134b7
SSDEEP 12288:CyPz5L8zGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:fzyjnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T14865021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e2f19473cedb8f799783d382ad03ffe12d1a1239535064a29a32e6e3988fb63d
MD5 713158c77c0d3dca2ca006190e723da0
SHA1 8fffd1ca488b419a77fe6f3fa4acdca4b77f0b88
SHA512 1b79d5ef279a7bb677be1cf7d5787244353c597d515fe66745bdb15899fc481efc69d87fb3c475864313dae1ca802597a04084de47ded3b9c6922bdcbe917542
SSDEEP 12288:HeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:HenQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1445523697925F88BFA1706F54C8281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4aaa1130f639141847e0068b9a3ca675262b3c7d94f6461213a78128e67b56e3
MD5 24e628c0931b45fef53567a1eef56bdf
SHA1 7f86e47272f03d038f62f045cf13dd8c35e6cc23
SHA512 a86e10777ce2ae8fe84d9d4af9ee303c310e273c4ba0bb3fc92c7d09880d9aeb604eb8a808439bd46e36ee73053134d5a14cdb823ddbf3a4a9b70e84b93f7104
SSDEEP 12288:1eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:1enQ/tbw/2Mkjy6Fr7g0oD
TLSH
T14A5523697925F88BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 07f8f6a1298aaaaf956a88ff7f78c0a7be25d6089fda249935bed18d47afb7d1
MD5 a4298fd7ea2cfead44ca1ea67d477666
SHA1 cf71f24801047444541ffa35bb5edc3b9205cbd3
SHA512 419bfdce8df4186c1fd6852cc5353ed9647643f2354c072e14129de49d5fd3f933996c49b0ec7928123185dd3611ede68fd30e2b7f117f01281641be661beac4
SSDEEP 12288:4yPz5L8zGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:ZzyjnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1CD65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 3ee37d399db44e89b41835e775721ec3995f209b7eb83f54b611fbfc1595366d
MD5 9d7b2782d5a9fabc07a8d97e20b1ad36
SHA1 493ed2b1b83847cf0b0b3ad1b574205a45494614
SHA512 8b2abbd1f0f1013ac1c778418747fc926347ebcdd62e481dafdc7c24b262c91faae42f55fcb84881601d01787cd45dffb7d33c364ad1d437143f54c829125b12
SSDEEP 24576:GT0aLl3z0zDpnQ/tbw/2Mkjy6Fr7g0on:GTDLljQQ/lFTjN4
TLSH
T1A77501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9e799a9770b777b71e2218d64ff87767760ef0b9b07c7e4eef6a75bc6cc23550
MD5 85b6d3611d67ace80919cb9836db2688
SHA1 e8c0248840f302018a8585329e1d3d391d9ea71a
SHA512 a924cd7348ada1479a1e69a69416fda894447e227a942c561aaba8539c4b6bc3718b85023b4629f765d6ae509139738793baf1ac3ebf6b9e17f45378f88e0b80
SSDEEP 24576:j31d9CHKy7GZFnQ/tbw/2Mkjy6Fr7g0ox:D1d9CHKyarQ/lFTjN4
TLSH
T15385CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ce853df6e199209a2bb4c67145f1163bdcde1d48705cd4d005e2397482ebae17
MD5 fa67686cb60004dbc7228ce940b943d5
SHA1 57c6da21f1b18e827e4e97c912677835501ad940
SHA512 924621f1211ca31dda1a7540f083418ddb03c87571e4918c641a809c7d68d4f1fe7589b0dd90107952af27af4b7edff1be4b9b67a11e412a91adbf616af03184
SSDEEP 12288:ipGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:i5nQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1145523697925F98BFB1706F14C8281829B7B0EC6BFD1938F7B4C2128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 aba30837948ed5a74df89c47fe2c58195d3cde3147f775ddc8e9febb4bba0c07
MD5 1ab98587bb7bb20083335a2bdd7714f3
SHA1 4f0e9cdf4ceda30ff50ab79e287dee6416f3540e
SHA512 be70f0437485fcd3ade1e6c824f1b09c9d1329746c2dc650afbbdb16b8a78ecb05c301c260005eedec41cb9186d13d76b6e44fbde0ec1eda98380215227d5e06
SSDEEP 12288:TTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:TDnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1B15523787964F89BFA1B06F14C8281829B3B0EC6BFD1938F7B481129967D39406D67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 57b3daa3bff23f0877421375a2ea0ce43116b8c89ee82dde572aff57e41b3364
MD5 8ae2a0ea7618836409d5847248316d84
SHA1 7a93902f14a50c7a91da10422aba235aa5b48648
SHA512 6eed88f3c74618aad1c4dc9d47a9c07bd94ac34c2cf4af0599bc0405cd260ca7fc9fb62cc3cb883139d23eb7b827906b6b15ca8d1e4e08a9436f451c28cba7f3
SSDEEP 12288:yoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:yonQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1735523697925F88BFB1706F54C8281829B7B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 6a749e8072370ba1e45ff4a335136335014f067fee4ec511d853a25512f6e29e
MD5 6e2466b06b11444ac714d8f0e2c73c88
SHA1 c6b8086aca706de6261620147c300056149b6a0b
SHA512 a7fe02f55f766f8e61f06a00b9b0f8cbc7fc4b74a72f906f2849113477d8015634cc32ef0910c463166ec64103bb98a0cbab22c94bd330bb374a7480effb8a8f
SSDEEP 12288:eeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:eenQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1095523697925F98BFB1706F54C8281829B7B0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f2b9e734dad16a1c0a71c6058c4b79fe4db28b5cf82c3a14ac061aeccb71e7ac
MD5 b6915d045ddeca1a05ba8c72247e283e
SHA1 98a6db61269b42119a0672a1274da50463ae21c4
SHA512 9dd736e50b4af88824a163792b941f501867476cd74799fe9ccc4739597ccf069d418fe9f0d6ff1ccaedc50ff44715cf7369de5d75c23a5ca2e977e4f93fef82
SSDEEP 12288:RpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:R5nQ/tbw/2Mkjy6Fr7g0ol
TLSH
T16C5523697925F98BFA1706F14C8281829B7B0DC7BFD1938F7B4C2128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c218c3beca52faa3913f8c6bde157b5525e5b995651216ee3ecfc46657ea43ed
MD5 3dd126808ed7f9d58561bd3627f24526
SHA1 385d56e447de6304df495297055f592625361d33
SHA512 42bcb182f641f9d7abbe4f81ec4f3bbf17a3f163a7a31e054bf696b06fb83c25568a72a00408204d8edd63750b29655f21a502bf06b24a6028ebc6e51a94bf4f
SSDEEP 12288:y2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:yWnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1DB5523797925F98BFB1706F14C8281829B7F0EC6BFD1938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 6f3a10049d8c4c5fbe05c07a2f7ba5d875b58baf3a0ee77c4a8e0cfc424fc5ae
MD5 56f1efc63d0f36b7b856fe7eb61d9634
SHA1 a0fa29827b37f5757ec2efe143157ef42c0be66c
SHA512 31b1b401b53ab706356dfadc76fad13b4938c7620239a866bf6dabac261bf05b9edd7433c177dc64e6fd0b9d126f248bcb55b85bcb3c9fe14c64a1ab39caddbb
SSDEEP 12288:PsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:PsnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1F25523697925F98BFA1706F14C8381829B7B0DC7BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 3a10c2f0eea9028a38747398779bad4e3c5295264c76f5863a22f1a4b91d40e7
MD5 b839746679e5b6d391745e1c5e5e86b3
SHA1 67253272eb5b8893eee7bd083394f6ffc4408e64
SHA512 541796f230286c999f033c9fdaeee0210ea47c56c8f3f403b7612e4b2a065a23b68787dc9907996b5780c0e98a90b171d3856eeda778f44fab11389040ddc890
SSDEEP 24576:Yfwv/k9RX6wkyAICnQ/tbw/2Mkjy6Fr7g0oA:XMnYICQ/lFTjN4
TLSH
T14D85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7c0d9e79a2eee1443736916cbb928fa254b76e6fed69a8ca1ff32d4a4b89f7b9
MD5 6e514969ee8b82ab43926b655d2dd279
SHA1 65be4f737e706dca9a433e58bf32dce38b469d41
SHA512 dbfc8b3f6c9e091bb1e8de710bc5749734d31084a3b22bcce35d10c79942ded4cd66698a5577a3e09565bfa2aa506001cc3e67728655aedb262dd0a16802895c
SSDEEP 49152:GYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0dQ/lFTjN4:4ySzPqLm
TLSH
T18D066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9583382a2e219d09ddfbe20d7d288b5e5ff3f98a34f453e28716ae5c5323e668
MD5 1b4e6a4e8ad68e359d71c216328a74e5
SHA1 d8a3c929ff793cace1adb6356b37e0d4684f6f6c
SHA512 1c6db2033c42a24fbec8a4ebf3cfd1abe1f9f7a8baf700f9153b92d787c23f19bb3d5dff6709ae233f24a8890f7fc39e95a7e0bb12d8c60f0b76384ba0c72f36
SSDEEP 24576:u47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYfnQ/tbw/2Mkjy6Fr7g0oM:u47JUQj1irIhCnDHUPfF/NQ/lFTjN4
TLSH
T1F265AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 96caf1d68221455c1b7ec3e0eb187ce7492d5ae0427e442846d3c66b67a3b330
MD5 4d3031b9fa1a3082d3b899cb4b7255ca
SHA1 51d47b482a026e994ca01f5f72a5582a77a2376f
SHA512 533f58d35a344c82dd21ab2bc52d7cded3b07121a408ec3e1e10aff77c65cd2de5e43886854f5b75879c3cb37eac9159bd046ae8232d283501d95b00adaeb2bc
SSDEEP 12288:hssfuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:JunQ/tbw/2Mkjy6Fr7g0od
TLSH
T1F765F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 956KB
SHA256 33f61c093d6410d5411d074635d08f1afd7bbbe08d10ac90035352224a0264d1
MD5 563e328f723e01bfeef062257c4a863b
SHA1 9d1636808cd0f6ed7f46c3064255f0e84fbd63b4
SHA512 dc0ea6e7832152b6c11a76870bf46ff0670a0ce0b6db8467f3cdd8aff182f523b03959a85f125a2ff02d140a81b206480f8abe561af89428a4fe0c1c5de114c6
SSDEEP 12288:qo6EU3fH8BWfYW2Kf2uEQQxjeK/0QYziCLIlq9s:qofUPdfYKulKK8QYzxIlIs
TLSH
T168251800B666D75FC6A940321E36C6CCAB707D41FE449B0772C88B3FD57665CBAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 103f458bb042ea4d89ad9d2db561f1e223d336874f839691c3fde87f19c757e6
MD5 566697d30bbe998fe6f76aa78a94973e
SHA1 1581d14add68ce6c80c3cc24e991b6bde5976251
SHA512 c67949614e6b72021eaaf4376e2f8a9a560f7e1d304d109c33e5a7f8f0a4e752abb624e8d4defb715c2601c84d2daf01d09ce08457b3bdbfe01e4c05e892ed2f
SSDEEP 6144:IZsrnUFIFIj1/jlIaZ2c2I0N972dRo5Ts9MtMxc9MtMxQ/Uldw8965Dyy1I:INjP0B6Q365D3S
TLSH
T1BD65D940D937E3CFD1B62071072A5B8C67A4EC16B7496F26B388053AD86AB15B4FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 429f4199af425aea76e85fce0f55d366109a4505c1b164e8d2f27b663347b80f
MD5 ec11a76cebcf7ab36b8845b90cb568cb
SHA1 7c37184260a5995c0d55b667d77cdecb753dc44c
SHA512 33c254fa41912a054078697e5a23417bcc90ffa143cac928c9c8cdd802ace13ec659f5409ed9ccd68002e199a116e3d4c239403b0b0542fe40f26f2b6b09e881
SSDEEP 12288:667GGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:dmnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1485523796668F94BFA3B06B048828111673F0EC5AF90D3CFBB082269957D3D41EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 14b884ecd5277392e637695f9ceda8edacfb8e45f543300aa229e621d08c4c87
MD5 6c1af07c27266a2a099e2c96e53ed4e4
SHA1 16d4ece5541949fe0d3a8ccbe511755708d3fae0
SHA512 f777c092459a067e0d526241e025d5a52929c3a89306ed399e085d13edef468e21c3dafd27271cde857454a00afb612d03fd67fd0ab8987805477f00b6d25470
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bYQnQ/tbw/2Mkjy6Fr7g0o1:Igb4mBIBhGFfQ/lFTjN4
TLSH
T1F265AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 e07e6c55923614b886fc4ec907a56021a9f6501a97fa274acfb7293637383fb6
MD5 5781b171fd9489f7ecd0585ce2fa2d56
SHA1 5d416aad5a5aecbd3b902730be0d75ee17e73655
SHA512 dabeb23cf8c4ee2531882966acb97d234c88dc01fd52581fa7fd0ec9c7b5e931386a3a49153cc322fcc74bc003cc7ed5ba2f5d84c01dcc24587a1a88eae0a305
SSDEEP 24576:KG88u8FpJqH1Qzria7/mvnQ/tbw/2Mkjy6Fr7g0o3:x7ZFPqVva7/IQ/lFTjN4
TLSH
T11485F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 2a4cad5891955176c2b1ce488786611b867aeed0289f212c65862026f04c981b
MD5 a571d8c16b02a7a174a8ecbc00bceb63
SHA1 8025332f8386b2ff2952cae0571164792c2a7c9b
SHA512 4ed67b3fe9d04e671bdb8afc245da6b12b6db1957142bb2bb3b7588294080e465f3bb2da6bec7cbfb82bac3ac46c5682fba54ca6453bc14b7c2c2ab9d394e622
SSDEEP 12288:7HvUrBFrEjwaQ7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:7PUr+NQrnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1AE65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5d09a2038425547f47e3c9a4acf5adb99e03ae97bb306a250754b121fc6f370f
MD5 78bb85a59999d3c469d9f97016d0c327
SHA1 4cf8c3e319f043ded08f4d50377e3639b2ab1122
SHA512 4e88f78b1cf79525d5653992e623d270dc2bbd45fad3f5820a9874f2f00cf4af1fc6b22f3b38c14fc5e18484f97439c66b009fa2f694831754aaae240535074e
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7Q/lFTjN4:pG05lO43bVLm
TLSH
T1B3D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a013ee3f07292c0a977f222a3806255a611f75849125ef92952a717e7b15a43a
MD5 7fcce98eca25cedfbd57e1dc8c42fa21
SHA1 2e1b9f827518383991774350fe2a00d52acaf595
SHA512 8954b0020b5e767073181298627184ecd1463fa52d6a11141f8b9b677fad917a6bd52183d0540426dc023dc8b57d4e0e4b6526e4e373566f786bbd0fa410fc64
SSDEEP 24576:xfa5POZ3dpFWVM50JicR2hG0lasx2+47eidndnQ/tbw/2Mkjy6Fr7g0o7:Ra5POZ3+Jt2pasx2+mDQ/lFTjN4
TLSH
T18D65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 81afe35bdf730d57f3e2f8d4637fd0c0541411d4b01f36c36d6f1ef5c95ca702
MD5 5291688beb5add65a24a35700a7e9095
SHA1 fac739b0e729adcf4efad76f66951338044b0f2f
SHA512 11c73520607e2d0b294b11bdf6f597dee2715052fe18f2ca43fbb2c9a158c7f1aab79e1c489f542afc07a79554b190a613890c9c40558b7cd5926ad74213cae8
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7Fk3nQ/tbw/2Mkjy6Fr7g0oi:sNc/zEOVHFoQ/lFTjN4
TLSH
T17E858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6fd8fba2dcd77b58cac0579a832137d4834c99430adcead6b17965f383ba45c8
MD5 a2504b5671580f47d2545d1a15e14d6f
SHA1 993ec03b8a44cd553efbc3e6a019dbd4b33ce811
SHA512 4a0fb225b439713092cf02432f3d490565d1e6bd4e2ff5a65cd66236f860b3ba6b82e8e23e4d24a48c69ee2287d4effc625fc29d4bde7cf31a218845b7554c03
SSDEEP 24576:D8kNvNnaFeYhJNtmZBmBnQ/tbw/2Mkjy6Fr7g0oA:D8MwBtOmBQ/lFTjN4
TLSH
T15355AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 7ab864450fe5c7dd9323b3e0dbec12347f0175e96981cad02a79e6dfe57ff597
MD5 d560fb2aa406f66bbcd2cdb345e1c7d7
SHA1 6ae41785944b36abc4414906778dff4711248d06
SHA512 990ccdf2e2903f5be34107ea62d90c25dc139641a448bb409919c7a4be02633df49992aa73ff743756928d6af58011117ca0a7b30e614fb598810fc1cd628c87
SSDEEP 24576:BD3FHshBIYQgAKnQ/tbw/2Mkjy6Fr7g0oo:BDVHeBIAAKQ/lFTjN4
TLSH
T1E475E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1480-309-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1480-119-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1480-113-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1480-112-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1736-63-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1736-305-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1736-65-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1736-71-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2508-314-0x000001C1D60B0000-0x000001C1D615E000-memory.dmp

Download

memory/2508-408-0x000001C1D60B0000-0x000001C1D615E000-memory.dmp

Download

memory/2932-77-0x00000000009D0000-0x0000000000A36000-memory.dmp

Download

memory/2932-76-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2932-82-0x00000000009D0000-0x0000000000A36000-memory.dmp

Download

memory/2932-306-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3248-86-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3248-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3248-327-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3248-92-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3248-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3248-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3680-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3680-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3680-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3680-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3916-59-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3916-52-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3916-304-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3916-53-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4012-6-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/4012-75-0x0000000140000000-0x0000000140797000-memory.dmp

Download

memory/4012-0-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/4012-9-0x0000000140000000-0x0000000140797000-memory.dmp

Download

memory/4012-391-0x0000000140000000-0x0000000140797000-memory.dmp

Download

memory/4012-338-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5116-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5116-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5116-131-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5116-126-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5116-134-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6744-106-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6744-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6744-311-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6744-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6744-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6744-99-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6780-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6780-13-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/6780-20-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/6780-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6800-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6800-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6800-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6800-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6800-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6812-409-0x0000028C970E0000-0x0000028C9718E000-memory.dmp

Download

memory/6944-37-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/6944-38-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/6944-44-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/6944-48-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/6944-50-0x0000000140000000-0x0000000140180000-memory.dmp

Download