9dc9dea6d6d9e6bb1c0080fb979ef3502f6c67b5903d64886d0025b128ab21e4

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 6.2MB
Sample260703-rtg8nsf17p
SHA256 9dc9dea6d6d9e6bb1c0080fb979ef3502f6c67b5903d64886d0025b128ab21e4
MD5 297a2d522bbc3b4174286cd5ba2fffd1
SHA1 fede1d77e02e07035be4bf91bfdeaa15a7c0ab0f
SHA512 fcffb985454dc536fb5cdab50b09432e94c002492490300b92d3306b1b0971e5979113ca49f101d16732158472fa2a12e63168521e6b89989928b279bb2344be
SSDEEP 98304:ca+OQV/7qJB0OBUs/J52CleJewniHfG4A:feqJB0O2OJ5xleZiHfK
TLSH
T122669E66B2A800ECD17BD17CC6564623E3B2B81613719BDF06A5967A1F33AE15F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4128	elevation_service.exe
1156	elevation_service.exe
4540	maintenanceservice.exe
5076	OSE.EXE
6116	PerceptionSimulationService.exe
3468	perfhost.exe
676	ReFsDedupSvc.exe
4232	SensorDataService.exe
4132	ssh-agent.exe
264	AgentService.exe
1760	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d1bc3e9cc4173e65.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104437\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054436d9cf80add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc3c155bf80add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f692345bf80add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026b8ac9cf80add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044058d59f80add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017d89659f80add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c438be59f80add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4128	elevation_service.exe
4128	elevation_service.exe
4128	elevation_service.exe
4128	elevation_service.exe
4128	elevation_service.exe
4128	elevation_service.exe
4128	elevation_service.exe
1156	elevation_service.exe
1156	elevation_service.exe
1156	elevation_service.exe
1156	elevation_service.exe
1156	elevation_service.exe
1156	elevation_service.exe
1156	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1968	2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	264	AgentService.exe
Token: 33	1760	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeBackupPrivilege	676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	676	ReFsDedupSvc.exe
Token: SeBackupPrivilege	676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	676	ReFsDedupSvc.exe
Token: SeBackupPrivilege	676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	676	ReFsDedupSvc.exe
Token: SeBackupPrivilege	676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	676	ReFsDedupSvc.exe
Token: SeBackupPrivilege	676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	676	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4128	elevation_service.exe
Token: SeDebugPrivilege	1156	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 3044	1760	SearchIndexer.exe	101
PID 1760 wrote to memory of 2076	1760	SearchIndexer.exe	103
PID 1760 wrote to memory of 5860	1760	SearchIndexer.exe	104
PID 1760 wrote to memory of 2544	1760	SearchIndexer.exe	106
PID 1760 wrote to memory of 2868	1760	SearchIndexer.exe	112
PID 1760 wrote to memory of 5284	1760	SearchIndexer.exe	113
PID 1760 wrote to memory of 2468	1760	SearchIndexer.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_297a2d522bbc3b4174286cd5ba2fffd1_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4540

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5076

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6116

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3468

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:676

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4232

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4132

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:264

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3044
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2132828192-1552876075-2324613956-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2132828192-1552876075-2324613956-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2544
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2868
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 842af67e818f7606a6837bcd57012bbce9c19b6990a13a7b53a74b8f7b346b92
MD5 39e95c59063f1412560526e4880b5b1e
SHA1 f0ebb4f1f6de6dd95338b18cadcd79ad80f457c9
SHA512 e11ad17fd7c4ad6b3c7084bce376a81b9288d0189fb749bdc3b12db96c688d012b5c506ea3b1ef1327141d015ff08cacd0ab14561609524fc769ee494d54c8cd
SSDEEP 49152:Sb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnVDfjkVfgAXs:03q60jBEG4A
TLSH
T197D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 5b1e090356d4d52d992aeaf84932bbb3140acd90731843e4a9e72588209d0e85
MD5 dea6375944e4b216a04eb4b4c12bf92c
SHA1 d1fb07a1a7ff251cb902668a5603b35a3488ec49
SHA512 fd8b6300967b9e977bd362617527b3cb4fb5dc875b5c78db73f124a512675ddc13b389778ca798f8d300f63511c7418042803815f7634254844499bdf6827ba3
SSDEEP 24576:fXYfDtczAOdc8feGrkd9LLBfeUwAIxeds:qtc/DfjkVfgAXs
TLSH
T1E275F124B3A508F9ED6B913CC8A2C515EA337C558764E79B03E48A250F337D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 7a2b945e899dac6926f5f376bbb585c0149b2eae9936498df1a0d93555801dfa
MD5 07a38ef2453a01984bf9c06cd0d296a8
SHA1 2d11fa5b04c025f364fdd76c59c7e6d7201756fb
SHA512 9f8669548a0b36c1c730bd0c9b526b2b1581931f10c54bf4005e265d79074bb099048cf098ddb6dd307a86b6734b46e4b5ac458e031cdadddc73295090a5af6e
SSDEEP 24576:H0Le5ji0hmxKrMndc8feGrkd9LLBfeUwAIxeds:HPji0A82DfjkVfgAXs
TLSH
T13E959E16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C2E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b6884f89b1f5909e1f83d7d292c0249c64dcda38817a22a8e5a5a095085d4553
MD5 1b5cad4d80edda0e1d11ac41e8327705
SHA1 0296823e7c45c6420005922ffe35e5bdd2879d45
SHA512 79bc0e56a8f9556668dc020ab0e0b1dae74ad471cb1ff454096aa29d8c7055516550c007740788594ca930f1a552496282b3b6050aa344ff1e333477ae415609
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWr6q8wyuBdc8feGrkd9LLBfeUwAIxeds:0/ezSC6vUzPviHjyaDfjkVfgAXs
TLSH
T111755C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 71a0a7200e6cb48dcb313295c4df1db40ee6863c75c11d357ac2a5267039b017
MD5 21a50ad5520d9114ec5cd6b74347ba02
SHA1 ca1853923d17fbbe09949a6a5cdccc63e11afa4a
SHA512 be6415925ce6c1fe3fa94b3b0b430ba12693f03c801378f9f25468d3b126b6334d541ebb837facb956d454b6c817c71574a062bb77054239998c55c3da84ef53
SSDEEP 24576:BVbqPb88hv/l+bydc8feGrkd9LLBfeUwAIxeds:BVO88hXl+gDfjkVfgAXs
TLSH
T105559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 512054df217b6edb10b7473851410242d1ac4822f5074ac014eb30e81a05bbbc
MD5 286c5f0de264a1dd378233b70e137af6
SHA1 f565e5741c23e6e757dc89600fe9df48e5c3daf8
SHA512 15685ca2b8f3ee099377a58d82e83343534c5d4436f9d22ea245cb90bafd3904ee112bb50455dad31037ad9a00cc3101d3388ab9aa366dbb2cbdea6d751e6740
SSDEEP 12288:g/bdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:g/bdc8feGrkd9LLBfeUwAIxeds
TLSH
T118652312A62524B6DB2FA930347EE43E9E1D3D9DEC486D336B57AB500C38E69F047486
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 f5ae4cfb487d6498cb58b54ff3adc24172aed59415539bbf59972311bc4d2917
MD5 bbca1476c3c49cdfd9f00fe36cac5520
SHA1 15a1b4f09b8d7f78ffa2e9fe681aeea3dd38e450
SHA512 668af525c192fba29f48b312ba00f6885e005d81b0c9e9014194d7d414ffd25ff396e28774c7083c12f0815ff77290fd71b4e71304764e7a97ee2b4c2f1a7ffe
SSDEEP 12288:JeBNUbTVO86UadcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:JJIUadc8feGrkd9LLBfeUwAIxeds
TLSH
T19C75CF3BEE28FCE2C27E9D785691C600D77678708F51A3CBE265820D8E235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 072a308028bf0e9addafe9c172b3e01f1fba16947aec09b4adfbe677c6b93068
MD5 e6086dbce4a9a36388d240d2eaf0b04b
SHA1 2af550be7f55ec34e6eb980a00952fdf3decdb66
SHA512 059eb7350a677c9e7f131bfbabf90f915783cefb86e07d967d0b8d07abf026e892f17f2dd05f975958ea31e4162ee1d81efbb19578a6145765438b6c33b89e69
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH6:eQvGAdlCEL8c/RRNw5CbG4A
TLSH
T186267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 7f5b686d75c6f0c1ed16e90e4594b80d0187ebe63174eaf4af7124520843bf78
MD5 0bbb25f5a531577fd1da6d465b0ab491
SHA1 5c5666a6099990ba18024c3eef17faa5eeacb578
SHA512 7283fd65a298b0e50129e8401ad7ef8d3de7195926558f31941c2d404087bc7a34bc8067c5419d637a273df2e98a0c0585d4b8b288303d72ca216cd951b5d91e
SSDEEP 12288:ZAwSfxL/2Dc3uDLLmt0LDQewsAjUdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lL:KbewsAjUdc8feGrkd9LLBfeUwAIxeds
TLSH
T13E85E031FA74E036C77F0DB21B36C71A582D79608F512AC3E3A88E9D49346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1da6a365df07d1ca8519c09e20889944111fe69295b391eb163a428f013f9f75
MD5 282f1b34f3b565ba38f4a0141082d638
SHA1 41a93678e0e59c6917c275b11da9cf6e912648a2
SHA512 49ef9fe6e66538c820af21bf9fb1ab21ef2c1ab150d753992b491bf59bd13a14e550125d64bb81741c309f284ec07c8002e337f485a9693996087d2d990d981a
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHyK:gUEtQevvqc2W1cpV2RI32y
TLSH
T1B1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c40581acca37424637580d2466f4996dc2d672c396f9fe94b895874675e767b9
MD5 bc231215428edff58178752ebd272641
SHA1 077a3dbad016cfc0bb55cf74f9bf5bc3a3eeea14
SHA512 6a95e87eca4582088ee2ba69c8d81fdc86f7bcc4dfcc84c0d3e09dca52b47d2acf66f79b8ae3bbe1822702c682fac5b58edeae4fe4a4ecc0813fc03bfbec1cfb
SSDEEP 49152:PCbRquA/m2yL5zQfFiV+XenmE3/zmDfjkVfgAXs:IoqtVjnmfG4A
TLSH
T1ADD58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 15dce0880c1d63b03fa83185ab9be1ce315f3a0f595c1b519800c726db398f76
MD5 7d4f9e0e50b9d9ceaa117032f3b41a7e
SHA1 b2b70fb69b2a66f45be5df3c9fc3ccbcce7c3685
SHA512 07aaea042c91346c4c2f23de98382505c6e2faa779d05d1357b9b736f07b37c9512325efc3eb7b26b3ae2e30049f951bb1c691f7249035def21b6a87ba24384b
SSDEEP 24576:hAhGL2IFoiwtA5l7S539dc8feGrkd9LLBfeUwAIxeds:hAM1Foiq5DDfjkVfgAXs
TLSH
T126359D81E7F955D4F5B3AA7899B69171EA76BCAA5E30C20F2250C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 deb94d559fa60d7efe2609bc41083deb11197c33708515d93a6f174d5cc71829
MD5 3ce132d02879c808de945ad1da6764f6
SHA1 fbe0ec99a6022b7ec28985bbf47813dd3a278966
SHA512 8447defc4941b3b74e829cb9f84ca1921b2604f9dd2a72f36f494d9995cb97d7fb8e726ff08a6a613322d1a61377c052cb6bdc1be4e657a5a507f39e542c030b
SSDEEP 12288:Bmw5HEjsChNjBFgl0WDm+ChdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsP:cwuWOWgdc8feGrkd9LLBfeUwAIxeds
TLSH
T1AD75F14672A40CF9EA6791388557C036FBB6BC062A25DB1F1760C61B5F37721BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 b30f7c235d8e5c7b4d86e16a2504ace63b9eae7b5eff2278e0a0ee35babe4eea
MD5 7bd26c70d3463d2e0203e50a9d80bf20
SHA1 fbdcb481baa7b5222d264f12775bc2847e218d7f
SHA512 b9e47e9e89577511233bea86a726e3669417d9e44535afb1e2cb8a131c3aeda0a60eba2a97caaf4b0e1cbe7c6c75d82c991c3aea604b67c6508a464e5c3c8d45
SSDEEP 12288:A7Z1IykdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:4Zuvdc8feGrkd9LLBfeUwAIxeds
TLSH
T17665124633A430F9D667923898F68519DB3A3C5AAB3543CF271647640F32FD5AD3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f5171b63e0c68a0c23a5f3dbb59eb5fc9474fc0afd79988d6225cecb184abe5e
MD5 5887c5108f563d14fea14696a71fa18f
SHA1 a0b19020321d068d5edef0cbdfcce4a27185602c
SHA512 ca07576c4598454394fa8aa97bc81e910854e908efde149cf2942586b7a6e11046dbc978541d1bde6ed8b0373e96834984ebd60ecb80914637cd70de03fb8096
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U2:bQRQyi36YOcPhLvw2gAf+PN3QG4A
TLSH
T18A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9474fb9692f4dbc696305c7999c0faa309303e0c4cb01f5fe2068521b1e50200
MD5 7d3007e349e8aea7fec189cf3caf770a
SHA1 d15a8b94801a7cb8983547c818e7dd0401429619
SHA512 27913c7fd9978e3e02f8ac54f28a3b800d1c26a7146a9f8eced97528732a5499f10f8122bf1dd626ab308c985b46bf3a15907308ac79e2241187ff4d07d5add3
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U2:bQRQyi36YOcPhLvw2gAf+PN3QG4A
TLSH
T114667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0c00da2aee1158c772f4057fe19004459034e2a731cee894b8f00dbc765b85b4
MD5 d619b43cb01a371f2365c153c5199278
SHA1 48b146f745d6c51b35012e09ecca4f6b31c06110
SHA512 50dcc895900582fc8d80c98f5c48ce950fb6fc044bfe206348970c0a8beabdbb5d205c740a3636170c94d0350c40fe13a0fcc804b7b3623ab525a15375ee23db
SSDEEP 24576:PwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0fdc8feGrkd9LLB0:X68Qg55nhceWu7PNU3/2DfjkVfgAXs
TLSH
T193B54933B2F600A9C44DE1769F4A872196D27C75CFE0E3DB851572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ccc619da61270d52b0da7304a831185fa574d48d45562c488f115c77f106a30e
MD5 946de54c578abd82ca4905ef25771bb0
SHA1 f03104881c63a5ab3edf3cdc784cc7c935d0dd47
SHA512 ae865e5bd01fe8df1a666887dc13c4678e98a407ec0df78e0de9bb7f3250d70582ab59861b3b57eb633d85018d68c96eb539db28ec0925ab1d3e640fa04f621f
SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99:Ty5112gYy5azzVva69nLKnhZ5G4A
TLSH
T113167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 72e6799f4394bfbba921e068cf8de6fe4231a76e0e264e2cdbe99f14907cabff
MD5 0f3281fbb573314000a723e3f85ef2c0
SHA1 229995d9da9cc9a92224b0080a6f1c7104f4e714
SHA512 7726b8b365dd4b05f6d18374ee11c2f66ec3eeaeee6fb449479628c53e2a6b59fd1c715e9dafbbbe9660422825d592a0f2381384492b581abf72a3e95563c4b8
SSDEEP 49152:uB+taZ3usBWOBr4tEG20bqx0z+n217aau1glYDfjkVfgAXs:8u6JmUxd2d4G4A
TLSH
T170D59D13F1DA01E8D06ED478974A9233EA62BC494B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ae3ea24362636356b5a1e710bb7b091c4c84d5fd2d6cf74cc0142dad45affec1
MD5 a71ce387e79bd7110a98700cba370b0f
SHA1 ea8b6f09ddbe55b950682bf7d817d1715bf32651
SHA512 ab346fb1b19bbc50652c447ac500b0027fbc12d86ac1a1814054edbe4d6f667aed1a504d1462d434cec317f6a9b9a9b33a773d17175ff0bf0fe21d5715eda964
SSDEEP 49152:X1hpsNoJpF1A6BU44CwH7R4x8DfjkVfgAXs:XmifPkRfG4A
TLSH
T1B7B5BE13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ff1a8c70a7db77daf94f57a9bca2ef0b1d87773d6de9c1b105a73df1213c1b45
MD5 7a8960a7a2894d61f25b71e7b1bb1db8
SHA1 3713d5213f97bf39bc8cd1ca1544c65c3e35dc81
SHA512 883af18c1cf35a897498edb40f067bd88aa2fce983d927c3f417cd4120f2e2b8c3ab14aba9b62aca69bb414f6adf633a0f44907bec49978ed95682cde49ec45b
SSDEEP 49152:CSuZQIY0Be2KNRVtOnks6NMHqlDfjkVfgAXs:c5dKvi61VG4A
TLSH
T1FCC5BF03F2E940E8E0BEE67487669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 50b199d81f116bf2efc4781cecc774cfac5069929b9b53e12efb64e636458269
MD5 89bdacf191a4ca3ae188ebb2df419bbd
SHA1 21f290bf2e333d48263e50ef3f329f0decedbaa6
SHA512 1cb2345f6abd84f9a34ebaf8c5d55973a35dbd5fcf5c70c9c9bfa6b6d19d2e92f328fdc7366ee8f525d685f7a263ce75e545be87d8456d5a0136b68a8f0cb38c
SSDEEP 49152:thtSn8EApI0figXgiDn0AP5woDfjkVfgAXs:8X2iyphzG4A
TLSH
T1FB95BE13F2D900E8D05ED174C7568632EA62BC160B35AAEF0A90B7561E7BFE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 93f7259a603d4b23c688e6ebc694750c656b23a5d64157c6f6c756ba431931e0
MD5 bcecd96a03abde8323381d616e488013
SHA1 f694fee373c8c2e8e733537823e78e434d832916
SHA512 f4e1e6d86da312956474d6f76d16602147634843a977649ab1889989414362ac978e901c995b8fe963777ab7bbe631e99d2597f47e56077321958156891fbb3f
SSDEEP 12288:2DdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:2Ddc8feGrkd9LLBfeUwAIxeds
TLSH
T1E0652312B62619B6DB2BA970646AD03DDE1D3D9EFD4929333B4B86100E38F79F0474D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 7d58ad26f1772af15c43f72ac7a7f56482cd8422dade532c120bec70ac02912d
MD5 5529279eec4b1f94f0c2e8c9d99f97ef
SHA1 272139361150ffe5da70b95b760d0bc4ce1a2b1b
SHA512 215f49a74d7a301be8f51c523eeb65193d7ce1d6d2245c38ad8091f16717fcd40e63d69fb4b3fa25d889fa21b6b257270c88cdec08bd908232f8a360aa0d0c2b
SSDEEP 12288:e4dcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:e4dc8feGrkd9LLBfeUwAIxeds
TLSH
T114652312B62619B6DB2BA570656AD03DDE1D3D9FFC4929333B4B8A100E38F69F0474D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 e75f1b9ada82f31bedca62c5f2ead42e86a19a789bc5706b505f54969d579d9a
MD5 11a81a3616ac4c1f6bb0f7eb0ca9ffd2
SHA1 4330812d0f2f86a4e11f0f3d48c97f1840994423
SHA512 5cde3262140f5b8039d12f914e50aef21a9876d21ae15c212bbb255138ed7700a159d2340fabe63b1cb166830026978454f58b5503c9b2ac440ee499fba2eae6
SSDEEP 12288:lidcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:lidc8feGrkd9LLBfeUwAIxeds
TLSH
T1B7652312B52619B6DB2BA970646AD03DDE1D3D9FFC4929337B4B8A100E38F69F0474D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 12568ed8f8139a8255a7c7c2ceb214a49a266233c9160d9744632a7112c10e3c
MD5 3bc794e5aa6df436bb59445ef2e48772
SHA1 f966d23031a9b1e892bca5a17b2315a57bee9e54
SHA512 9344c7ae615f014a084dd3b1566f0cf2d2a9d8657b098dda91ac2b6c4fa4ff50df022c3ee935fd7a2bcb2e6ad0083ed440abd32030c2b97afa8ce0be7ea2118b
SSDEEP 12288:HVddcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:Tdc8feGrkd9LLBfeUwAIxeds
TLSH
T132652312772610F6DA2BE534947AD039DB3D7C9EFE156A7B7B064A100E34FA8F007A94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 17645603ccbe80772feaa756435e8e7a94b2f060757bf0d825c83f02cc1eafa4
MD5 9c8279ff72ff473c11a83368914f7e59
SHA1 4e3ad4b755b8610466c2c41bcf33485cfcd20194
SHA512 8f7b92a44fe411de83d67593e159dba27f514f6354c49e272c1e3550842e88311d7169b3fc5b8c19be9557be402c4729e62a18e82aa86116719664c66de1be77
SSDEEP 12288:TVdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:TVdc8feGrkd9LLBfeUwAIxeds
TLSH
T1BB652312B62615B6DB2BA970646AD03DDE1D3D9FFC4929733B4F86100E38F69B04B4D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 febbce8aca2074dca8b7d3d5523680dfaead386c384ae896affa85e34899d0c0
MD5 f5936c566202c2faf72e95a16aade657
SHA1 52c092c65d3e5ca7c0e515d38956d5123204de09
SHA512 3cb0a0a802254b5c488be6a14819c3102fd44256a8bd96d69a1e750447de37df920aadbf6c7074f1913d7236773e4ec8a07b94e8db5a13fdbbab35a8888c901c
SSDEEP 12288:YcdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:Ycdc8feGrkd9LLBfeUwAIxeds
TLSH
T1A6652312B62619B6DB2BA570646AD03DDE1D3D9EFC4969333B4B86100E38F79F0474D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 3b29ca83dc4d15be84712fd3112d1da387f6706af414c0a4be86fb6acc8c5c66
MD5 64dad66f0988567d8fa3db817f6be76a
SHA1 43845e3a1cd219d04c029fdac289e412ad9e1bd9
SHA512 b2a12a2facdb9080ea9623150048a106c69997c859e5ef9e17f7ca51bd87b9028f527d7d1147b10d4149c83b36da422b30241401052b475de5e8a4db7f864c43
SSDEEP 12288:uQdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:uQdc8feGrkd9LLBfeUwAIxeds
TLSH
T164652312B62619B6DB2BA570656AD03DDE1D3D9EFC4869337B4F8A100E38E79F0074D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 e72ed0894f32e76876754efb28913298591518bf4dc497b8a346ad74466f74a0
MD5 7d592ad0094a769838eec3a366f88a51
SHA1 43130fd804f90fd354669a91f5f58c358e9d96b6
SHA512 18802bcd492e39205cd70236778869cbd914e690da4ed37e387d2bbdd646d146a2b5fa74eb9d79d6bb1a684a53b043ff489fcf573aadf81d425a6612fb5eb27b
SSDEEP 24576:xZMfzFVSOYdc8feGrkd9LLBfeUwAIxeds:xZMfzfeDfjkVfgAXs
TLSH
T10B750295B3601CF8ED67813EC8258816D6B27C5A4B60CA1F13E836261F337A15C2FF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 45502c05d0b0a0ccd26fb4fc8c98a57ee033aa8095d61388e57d60145cd00e21
MD5 2e5e890ad2839b7777e746745942475d
SHA1 dfe13f435d691c8c9e3e8b8ccf76daeb69d5e167
SHA512 9e7e61b58086a6d76039e4353992ef42a5253692ce1c49d082bd459f28cad01feb1dba6d766b8672b2d88565809935de11597706e5bec5ff70924563239c2d05
SSDEEP 12288:e/dcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:e/dc8feGrkd9LLBfeUwAIxeds
TLSH
T19D652312B52619B6DB2BA570656AD03DDE1D3D9FFC4829737B4F8A100E38E69F00B4D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 cc8ec1fdc3c4c4478aff1eb6c10d0f5798fb3be838de02b837df3b90a53041e7
MD5 ed1bf5a2859aa696eb4b055085d5bd7b
SHA1 ff482cf4d200d468dbf54280a7bef5f22c17614e
SHA512 6b86735347f1ef5001d42a5fd69dabd67d808f7da6d2ec37ef9a2ebb3b58b2c0150cfebb0b02c64a6ddde30f3ee8a2211254a99a3b6dba174c9841a1c68b60fc
SSDEEP 12288:srdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:srdc8feGrkd9LLBfeUwAIxeds
TLSH
T137652312B52619B6DB2BA570656AD03DDE1D3D9FFC4929733B4F8A100E38E79B00B4D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 527d4f50f3e67f402d283cec113e3697795df8e234872a2e45f0d33ee1e0076b
MD5 d83a3489b38bfbedc732a24983f6aed7
SHA1 e6e018410d6c767ddecbb1b10ec6906bbe7df293
SHA512 a059b97299bc0f3879383ca14f2992d88d7e162e92446bcf79c25ad6a31768d4b6263df74ea1baa1930f0aa8d918d839229e58f32e1c59ffb0cd47d147634198
SSDEEP 12288:+yPz5L8kdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:jzykdc8feGrkd9LLBfeUwAIxeds
TLSH
T139751203736130F9D13B923488665916F73A7C369B249EAF275447361F37BA0AD2BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 f2463fb36f7adcd95ce6733dc65eba860b9160600cc63aaa23a63019a7682207
MD5 fa77cc9bb6c1cd91847765e6963048c1
SHA1 04cf7c6498249d90d601ffa45957c2c391e932ee
SHA512 a2aeccebc6a5f3d10100af6d9a6f69a475c5045035dd2791e3adfb2a2286fbf02840737377d8434d21d4d01a3ece079c7e1ebe3e8256a1dbc2281e9696423e66
SSDEEP 12288:i/dcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:i/dc8feGrkd9LLBfeUwAIxeds
TLSH
T15D652312B52619B6DB2BA570646AD03DDE1D3D9FFC4929737B4F8A100E38E69F00B4D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 f694589a1398ce203354dcf1dfa352099c1f3ec7f623873bb811704957cdc030
MD5 31ec9c22732673ce91788f2ebae645a2
SHA1 0dd659d6a6dd260aa76432d323ccd3b4a3dbde7f
SHA512 83194e5939b2dbee849276ab18aa8402047b1f7121688bdba515f50e9ae9f6f21ee03b1361eb347ddc6e1531a24c4b846589ed5bb0b0956257e271ef0ed49012
SSDEEP 12288:M/dcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:M/dc8feGrkd9LLBfeUwAIxeds
TLSH
T1C8652312B52619B6DB2BA570646AD03DDE1D3D9FFC4929737B4F8A100E38E69F00B4D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 6c3fb8e27ad942207b01ad1375804aad9794fd74f45c26e8521e267363fb9944
MD5 b4eb3b968ca42497d25c0f1b71b9e18d
SHA1 a966a76661b164dbf1d730d95c227e2e58812c8d
SHA512 1770569e4ff4c7bc24c416552a42922805fa2399225b63ab3b54048ea3381715d68a634f64a4da396ef35224127974f23c3b7194a85fdf3d9d4fa65d2133eac5
SSDEEP 12288:qyPz5L8kdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:3zykdc8feGrkd9LLBfeUwAIxeds
TLSH
T177751203736130F9D13B923488665916F73A7C369B249EAF275447361F37BA0AD2BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 281a7759d6246de2aec2272707554022abfe62cc6bef50fbde2bb851f62c2936
MD5 75ca4215f492e93ef4732142497e353c
SHA1 3f0d82d76002e185935da3f57a1446e3f1b655c5
SHA512 dad177cfefed14b5c680de1075bb3ee568608d759971206fd0029503a496a3fbdcc0cd86645f7b372a6d70654b8cd80fa06b5d5f789981da7ea6f07a5d2ba961
SSDEEP 24576:VTUaLl3z0zDSdc8feGrkd9LLBfeUwAIxeds:VTjLljPDfjkVfgAXs
TLSH
T118750295B3601CF8DD27813ECC268916D6B27C5A4B60CA1F17E836264F337A15C2EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 a4f3eb82928adb41f1710bb2ae5492b19a5274c0efd72586592eedc1589e72d3
MD5 e0154bfe3b265584cde01fc955f22a23
SHA1 a8e8601d1a452baf79adb5375e391b50d4b947d2
SHA512 2f9015114807dc23efbe7698c8682514d357beae008166e5dd0f59a58cb1705c56f7540898761bb41061c36be97cfdf3161ee2c1c0ea512549669f7832b113d9
SSDEEP 24576:y3Bd9CHKy7GZWdc8feGrkd9LLBfeUwAIxeds:UBd9CHKyaeDfjkVfgAXs
TLSH
T17185CF90F3E410E8F177DA3589768511DA7A7C5A5B21DE8F03A8261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 a57d49caf9843b3d669d51a59b69d7cc2e3882229c391e2cb09a248795bd83b9
MD5 a3c1166ffd70b7fffb4249a1f25e94a8
SHA1 98e4f71c38ccd45e9dcb204a9292d4472e922231
SHA512 aeb508f813bf4a40cd2d2791949e01627ca15469a132a216dc0011a4220e90ddf19ffd7a67c03f1aea6ecea72ceff4551560d2648e462c830664ef536f552aff
SSDEEP 12288:sCdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:sCdc8feGrkd9LLBfeUwAIxeds
TLSH
T189652312B52619B6DB2BA970646AD03DDE1D3D9FFC4869337B4F8A100E38E69F0474D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 789c280abad0b00e46cbbe85b7599a1cd37be915c8c11aa4798d0f0a933dd041
MD5 b44e3d6bd2db50178cb17687fa923b23
SHA1 0a19bd32fdb84b2c340be5d6a789ca74218f9ca1
SHA512 799e15dcfcef5deff7406dfabd0ee126d8924f624d8e377bdf0fd7c5190088c970f58b8d014959553e1db00311a61e0021ded38156b7a7ff648afe30590277e1
SSDEEP 12288:bEdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:bEdc8feGrkd9LLBfeUwAIxeds
TLSH
T19D652312B62619B6DB2FA570646AD03DDE1D3D9EFC4969333B4B8A100E38E79F0074D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 3bc67a3038c0592aa1c6a29708546b7a69abf9809c083fa4676050d2fb22103d
MD5 afd728c21078522defc81c8238e73040
SHA1 3ce46c243744f8b44f99dd44a2b31a0353599bfc
SHA512 14c22e6af73e68033f97d6691afb0e54d583e5fe2d7d87f474b01acca36edd34ec5813d2a7a41208d10c557bfc1482fb306454db7833444909d28504d613cdde
SSDEEP 12288:X5dcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:X5dc8feGrkd9LLBfeUwAIxeds
TLSH
T115652312B52619B6DB2BA570656AD03DDE1D3D9FFC4929337B4B8A100E38E79F00B4D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 7a51560757e3f091832ccadef170d736a4f150e9a5305401cb61bd6f4ec5c46b
MD5 8e5cadebd1b36992050b16690c629afe
SHA1 fa658acf78364d5b3279e3da9cb9d8aaaad4275c
SHA512 5d03f30f7578b53b7dda58ee50d66a8f7f9f8ab2e83742dba0a1dba6754aa7caef3b9e06b1b660fc8c2b8000a9762303d377c75a47410a2910029c107255c95d
SSDEEP 12288:G/dcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:G/dc8feGrkd9LLBfeUwAIxeds
TLSH
T162652312B52619B6DB2BA570656AD03DDE1D3D9FFC4929737B4F8A100E38E69F00B4C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 886d12384df39710852ea26743bb1267743748d8f0cd1acffee125b1381511d5
MD5 53b49d74ceb50203fa7da90520f22029
SHA1 2f1c119706654f48539b90b7fda61cbea18eea0c
SHA512 22260b5d5353f1fc05069c9f97582d499f5ef441789ba1ea6bc44da6ee100fea53a6fb5ad5de6d3120b8f3c80bf62ec5c0c2f9b5a07d93e4571c37cd129dabee
SSDEEP 12288:FCdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:FCdc8feGrkd9LLBfeUwAIxeds
TLSH
T10C652312B52619B6DB2BA970646AD03DDE1D3D9FFC4929337B4B8A100E38E79F0474D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 d56393e46e13b6b6e2ed03f5be728d48c8e6155309bc86d3172b93e0db43bf0e
MD5 08312a56982d47bf0a4dae83a9eb93a2
SHA1 a5ee42a5aa6069e8d6d6f5a3f15fd602dbf6f452
SHA512 34f17045cd1c49dbd49b09737c8d09ecd85ab619a080915529d045ad9f80816a3f967617cd359f16f5d9e8892e622d35c38a769394212ed2b35187c039ccc386
SSDEEP 12288:jXdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:jXdc8feGrkd9LLBfeUwAIxeds
TLSH
T12F652312B52619B6DB2FA970656AD03DDE1D3D9EFC4929337B4B8A100E38F79F007498
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 8227de300544f01055bcc68f9dc480df34cfed3987b49c8f268f93c8771ed096
MD5 4e8ecef77998691ca4b1fe6c571f7558
SHA1 11d7ff37aa8394b0aec9656e8778dc2b6602ee64
SHA512 b06be2e1ada57a11820fa045bc485fff5707bb5346666b570f40a9860458311f21e2771d378370b9366faf596adfcffb49807bce797f57d716f659e0bf1ce7ac
SSDEEP 12288:GVdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:GVdc8feGrkd9LLBfeUwAIxeds
TLSH
T1FE652312B52615B6DB2BA970646AD03DDE1D3D9FFC4929337B4B8A100E38E79F04B4D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 a5e090f849007a757a54aba541977fa3bfbbd7e669b7d9809d119a950fe18b73
MD5 b7a1f795b0b5cb91b86875cdc496cc3f
SHA1 ec6fdef0a05c36c28c9b0a4d3f1b7ab8c236caba
SHA512 96b1abde17f3de19d6465c85b47f7f832b1ef64633655e0f489e68ae2c2a9f236ffd3e0f157b0a0aaf43f15bcc9e950ee16c7b457405ef6fba99f1b7a6a5e286
SSDEEP 12288:4qdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:4qdc8feGrkd9LLBfeUwAIxeds
TLSH
T12A652312B52719B6DB2BA970656AD03DDE1D3D9EFC4929337B4B8A100E38F79F007498
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 c88466eaf07d07a86e16126bfb172f261beabda327335a7bd8c65527944ddd36
MD5 05effb82435b51b7ce9ec005b6b56fd5
SHA1 d6345b2ee7d438d40c02e3b2034d232ef35cd9eb
SHA512 4561f634c242ac8761dbcfb549427366b4060847ca500ebfc524f4d5942ca326dff2e89f3f28b79dea6b4dccac80a8e9a9d5c880d0f3d2b580083e264f3ce57b
SSDEEP 24576:nfwvdk9RX6wkyAI7dc8feGrkd9LLBfeUwAIxeds:0MnYIpDfjkVfgAXs
TLSH
T16595D029EBDC04E5E177913C89B7860AF6B178595B31C6CF129A436D0E33ED4AD3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0b4e850061bf5a040a15804208fd99361a43af7b19104bfe916ef66ceebb2423
MD5 bbf814a0972ed82fca1aeb7891554ee5
SHA1 f402ca24127ba36a776388381956b1ea5626b153
SHA512 dd34b55e9600d7c521d2defadb668dbd83d9205736b20223a2d0272d0d99edd1ee6e1e19d9dd3ee83b3571a20bead5afdb5fb1423ffa018ef9872b7513a82fa8
SSDEEP 49152:7YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0IDfjkVfgAXs:FySzPwG4A
TLSH
T1F6066C96A16801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6aa89aec97e67fd5e7b21d839e42ecb8acb7ad2fb7b842ca6f2dfaacc9719f4e
MD5 be1a483346d7f10ae8b2e4d4bf9beb3e
SHA1 3b7d08d409f7af5c038e8fc6af8106fc391abeb4
SHA512 7a91672365c16883d99ffceb14941713b0fd559e9fb46722d01b2438f438b1286ff645bc52992c6c9853188819cf7ab62baabfb25bc65d031d24fd5c7d162d49
SSDEEP 24576:p47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYodc8feGrkd9LLBfeUwAIxeds:p47JUQj4irIhCnDHUPfF/YDfjkVfgAXs
TLSH
T16E65AE1DA3EC01E5E17A927885158A1AEA71782E5F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 1d1b73e96f516ea04d34734bc556f106d940475e817063ed3e3a324789c08ddd
MD5 e973166e633a23c7684546febc359909
SHA1 32b55e29d636c4fd27501a88ea01af5556ebb8ea
SHA512 af0c867976c0a23bd83599e6d1960c62c90bd67c3d11b498cc55985b86342484a9974e49b7789307ce8b40b71f160ee2b30b97c4e6d820312a93e8408ace1ea3
SSDEEP 12288:rSsfvdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:Nvdc8feGrkd9LLBfeUwAIxeds
TLSH
T1AF65F116E25802E8C12FA134C7568615F72B3C6997E1D3CB27C1F53D0F36A94ADEAA43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 abe7506437ad6e7a5736efe18e8473fd3d8ddcb696be4fa52d704107a8f55109
MD5 a0342fd2cc6d7fd2c2cf1380c58fec57
SHA1 a79e754f05f5248b82a6c83592ecf07a2ecd7f59
SHA512 c0a2011e284f6a1006199b99d9d1b79a31782a88f848da64daa9fcf4507ce6ee2fc654b999d6da32fdf1589a1111ff7b5b16ad3cc8bfb030099a91106082e0d8
SSDEEP 24576:bqdUPn0UOqInOvqex74OErtJPwxvE0Lis:WdUf07qInOvqex74OErtJPyvpLis
TLSH
T14F350604762AD64FC6AD44321E36D5CCAB707D11EE05AB0373C88B3F957665DBAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 15f797cb63357dd27c36c6c18077c9712585277c489adcd1fc376e5b071e9032
MD5 67f3cf828b15e6fc6d997bcacfcd6df7
SHA1 701517bd037c07cbe125b84ad0e7ae32df340431
SHA512 dc0264960f960b22f280e030ae7dc8b1bb23db16914a08ce88d0e6fa6aea419a51f11a8eaec9186bfd9e6c24bad202f516d69fb9ebfdc2830aeca64b1d309a4c
SSDEEP 6144:QuQUCWHmTL0hTz0ZcoGTa9AZX5/DetMxxDetMxDg0HfVw3fKsKqKY:v9achHa9A95VfqHJ
TLSH
T17155EA40A536E38FD1B76171072A6B4CABA4EC17B7056F23B3C8483AD867B1560BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 f64b657f688d7e6fa79086a7303e8274f56e4254d5af24e5bc85cf9bd025688d
MD5 6401fce13400b501154d9756b387d796
SHA1 ae5fcb1faf7c42196e4545cfca9eaba487511866
SHA512 dad41e0c53d5a1aeee699a69f109690884a30cf3ceb812d4f97f3d2ce1700367756d55a830972ca11e402381c284c5ae55e4e90904607603a6ce0e8807b3eaa9
SSDEEP 12288:Q47HdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:VHdc8feGrkd9LLBfeUwAIxeds
TLSH
T17C652312E32A1976EA3FB570246ED039AE1E3D9DEF0458E37B0B47100D34EE9E857589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4ef99a12b4a48954ae9f545f69668d313d629bd7d447a3713d197e7a2d74ff5a
MD5 afde77eb6e2bb717f3029f87770fb250
SHA1 d36d920e921043e033a32005dc2ddd92fe2aa544
SHA512 6c1cb08598462a86e0f3254aa8b430f9345e24c66ec03bb56be6883d55ca374446d9dd8edced8d6faacc2c4c491f53977ad2c5f348623754e7b80aaf68690dca
SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bYBdc8feGrkd9LLBfeUwAIxeds:+gb4mBIBhGFiDfjkVfgAXs
TLSH
T10465AF1E22EC02F5E0FAD2B89DAA4417D6B278164731D2DF1251423D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 e0f288b44d01a35bf9bc07f0986f8ba450f2eb76a9934eacb42d68dd547c8669
MD5 d9ef3bbf644958314c0396ae97d23551
SHA1 5a113a926c196bc3aa6fe907d4e5aecbfc2f55d8
SHA512 c35d7f87f1a1ad937842e40656eb88052794e84180e929523a971df82d6168d88e16bcfd04779582c328c22d898662f6efc6bfc836da313899d1f8551dbfecd2
SSDEEP 24576:nG88u8FpJqH1Dzria7/mYdc8feGrkd9LLBfeUwAIxeds:G7ZFPqVWa7/HDfjkVfgAXs
TLSH
T15A95F16176E101F0D47BD13889868667F6B2B8251364EFDF07A88B511F23AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9ebfb25788a91b7a64489b5ab530da77b8fe383039b060a4c39da3cde4738341
MD5 926ffefefbcdd4c23d3e399b4bb1d8d2
SHA1 2e50b787ad8fd72882f5e5c8132bbd1d0d8878e0
SHA512 e3cbb51b0679ca3ff7c57c851cf1078ce04d91be8ece29f38f2220721bb4f3812de96c96f2af32e40b5372982fa25b4143b3e551f00ca61f1ca91f68968c8cd7
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjODfjkVfgAXs:6G05lO43bRG4A
TLSH
T137D5C06A62EC11F9D1BBD17CD9C6860BEBB23815033456CF02A486A91F27FF4A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 73b5b559b74be7ff4f733ccdb83edbd9b8207cfda9516f748e62d44e85aa1a79
MD5 15dc7f816b4576e81840b64a13dffa1e
SHA1 2aba1b851d451dbced5039c2041322f8e96a423a
SHA512 95abf2a1afdc6c22db1ed66985f2bcf8cbc1a6281325062efe42d49716ba2ead08fd0cf4c3faed54b1dabcbbf8b9da7877a88456d60e615ba56df122da5ac160
SSDEEP 24576:cfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnudc8feGrkd9LLBfeUwAIxeds:Ea5POZ39Jt2pasx2+m2DfjkVfgAXs
TLSH
T1C565BF5EA6FC00D5D57AD17CC583861AF5B1342653319BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d5ab88e9d1d0e786314833a5c299fd9c3787b5b42a02020a5783b65eeed99094
MD5 2318236a9c8df56dc17611ae7072a364
SHA1 6cd65c865498f1ac1bd62ef21e65dedc881b36b7
SHA512 80b16b582b8ae636290eb6af8f639bb0b83969fd84f43a1f9ce4ed2e39de3888dfe8a21c7a69681520368addc26edaa79080511361ea40292b751de549b557ff
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FkAdc8feGrkd9LLBfeUwAIxeds:NNc/zEOVHFnDfjkVfgAXs
TLSH
T111858C1623E901E4F1BBE1BE89779546FA71786957308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2966717f96a0b0efa7ea09e203c4de73e231ed4dab99188e3b9e31004a14bcd8
MD5 945e99f3e8ce25ce52b3cb5765282460
SHA1 e0c3d2d51acaa9575cead3e9c73cf465c9aab995
SHA512 500bee3b85237247bf094a340647c27ead5cd0ddf94b3f25401629269389ca3826093651b8139d1728e11d88a5972144797449e60559fec651bbee468d283a48
SSDEEP 24576:2tkNvNnaFeYhJNtmZBmqdc8feGrkd9LLBfeUwAIxeds:2tMwBtOmsDfjkVfgAXs
TLSH
T1AB55AF2EB6B806E4D1FEC6B4CD238516EA727861173253CB5390C13E0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 25d0387f44bccea2f0e36e89da3d713965bd497997c63795880bc3392e9ffe6a
MD5 0e6957ebd9b204a4e53b2ca50bf67454
SHA1 e36feac126d731a48008f7ecf8462d33cdd02f84
SHA512 f726c6057d1d4bf643a54396398b4ccb013cbd38e4951d74bcbe0158ba386a8db74a5671d75ddf889116cb11f5b50bd59e13dca4903ec7a20de62cc7fdea831d
SSDEEP 12288:IHvUrBFrEjwaQsdcNeXfNS8eGrkUK9+4xb1LBF5wqeNGNNo8lKikxsQXcNXtss:IPUr+NQsdc8feGrkd9LLBfeUwAIxeds
TLSH
T10B75E12F62A918E5E63BE17C8586861DE7717866571192DF02D1813E0F37EE8BC3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 d17f18ca3783d1aa15704721987d835abd9f19687fe1555e5171509112ce818b
MD5 3d5023f45cf5c98bdbfd7552b2600942
SHA1 6b0544ce4535ff8d7f31b1bab81ca26f65a1b1e4
SHA512 e335cad31a73d25135e8f8c182fa51ecd683e0cbf40243760f83a5b372ae75beb8305f51012df141340f0eeb6e2044af579f256813185227f17f3c5749bf2cde
SSDEEP 24576:MD3FHshBIYQgAjdc8feGrkd9LLBfeUwAIxeds:MDVHeBIAAxDfjkVfgAXs
TLSH
T14985E13EE65C04E4E57BD1BC96638A06E77138AD072269DB12D481B51F2BEE47D3AF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/264-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/264-126-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/264-132-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/264-134-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/676-379-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/676-381-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/676-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/676-94-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/676-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/676-87-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1156-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1156-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1156-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1156-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1156-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1760-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1760-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1760-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1760-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1968-1-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/1968-86-0x0000000140000000-0x00000001408D2000-memory.dmp

Download

memory/1968-0-0x0000000140000000-0x00000001408D2000-memory.dmp

Download

memory/1968-319-0x0000000140000000-0x00000001408D2000-memory.dmp

Download

memory/1968-9-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/2544-398-0x000001E969960000-0x000001E969FE0000-memory.dmp

Download

memory/2544-370-0x000001E969960000-0x000001E969FE0000-memory.dmp

Download

memory/3468-77-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/3468-76-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3468-82-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/3468-308-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4128-15-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4128-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4128-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4128-21-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4132-120-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4132-112-0x0000000140000000-0x0000000140207000-memory.dmp

Download

memory/4132-314-0x0000000140000000-0x0000000140207000-memory.dmp

Download

memory/4232-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4232-100-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4232-106-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4232-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4232-311-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4232-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4540-51-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/4540-45-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/4540-49-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/4540-39-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/4540-38-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/5076-60-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5076-54-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5076-53-0x0000000140000000-0x0000000140198000-memory.dmp

Download

memory/5076-292-0x0000000140000000-0x0000000140198000-memory.dmp

Download

memory/6116-72-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/6116-66-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/6116-64-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/6116-307-0x0000000140000000-0x0000000140193000-memory.dmp

Download