xmrig | 5298f87e9f47259bbf2e3b8d8d875a72bfeea85f3a0c46ce3bba970eb74f6421

Analysis

max time kernel
103s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Size 5.2MB
Sample260708-jbfccsdv7j
SHA256 5298f87e9f47259bbf2e3b8d8d875a72bfeea85f3a0c46ce3bba970eb74f6421
MD5 75df2e820c38b6cc49801282d1cab620
SHA1 a807645fbdf9006349ead081e6f1bd68679ee972
SHA512 dab720ab85edb1c356d498495117f7a855e8478cfb48624987c1e9d9c1b58e56e9b5da1063d50f4bca3f16864db28f3b51f62240f2bf137d0cfa3cc83e68e2f4
SSDEEP 98304:7v5vFtZb+i/AAOWPsZCL2dAslrR7OkFaJBvHvY9gT9N2b8GToyodubix8EVy:7B7Z0aJBvvVN+80ru
TLSH
T1D346AE66E2B501E4C9BBC13CC94AC903E7F178194374EBDB12A446691F236D5AE3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery xmrig miner persistence ransomware spyware stealer

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/1996-0-0x0000000140000000-0x00000001407D4000-memory.dmp	xmrig
behavioral2/memory/1996-78-0x0000000140000000-0x00000001407D4000-memory.dmp	xmrig

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
5460	elevation_service.exe
560	elevation_service.exe
1812	maintenanceservice.exe
2520	OSE.EXE
5172	PerceptionSimulationService.exe
6028	perfhost.exe
2104	ReFsDedupSvc.exe
5588	SensorDataService.exe
5824	ssh-agent.exe
1828	AgentService.exe
2100	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\833e8e82ce3e03f1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118546\javaw.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eec21798ab0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3ad6798ab0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{42848241-2164-42CB-A186-78C3293A05D6}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{067AF756-3355-44F9-9AE0-0709E7750469}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
5504	explorer.exe
5504	explorer.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeLockMemoryPrivilege	1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeLockMemoryPrivilege	1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeAssignPrimaryTokenPrivilege	1828	AgentService.exe
Token: 33	2100	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2100	SearchIndexer.exe
Token: SeBackupPrivilege	2104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2104	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeShutdownPrivilege	5504	explorer.exe
Token: SeCreatePagefilePrivilege	5504	explorer.exe
Token: SeShutdownPrivilege	5504	explorer.exe
Token: SeCreatePagefilePrivilege	5504	explorer.exe
Token: SeShutdownPrivilege	5504	explorer.exe
Token: SeCreatePagefilePrivilege	5504	explorer.exe
Token: SeShutdownPrivilege	5504	explorer.exe
Token: SeCreatePagefilePrivilege	5504	explorer.exe
Token: SeShutdownPrivilege	5504	explorer.exe
Token: SeCreatePagefilePrivilege	5504	explorer.exe
Token: SeShutdownPrivilege	5504	explorer.exe
Token: SeCreatePagefilePrivilege	5504	explorer.exe
Token: SeShutdownPrivilege	5504	explorer.exe
Token: SeCreatePagefilePrivilege	5504	explorer.exe
Token: SeShutdownPrivilege	5504	explorer.exe
Token: SeCreatePagefilePrivilege	5504	explorer.exe
Token: SeShutdownPrivilege	5504	explorer.exe
Token: SeCreatePagefilePrivilege	5504	explorer.exe
Token: SeShutdownPrivilege	5504	explorer.exe
Token: SeCreatePagefilePrivilege	5504	explorer.exe
Token: SeShutdownPrivilege	5504	explorer.exe
Token: SeCreatePagefilePrivilege	5504	explorer.exe
Token: SeShutdownPrivilege	5504	explorer.exe
Token: SeCreatePagefilePrivilege	5504	explorer.exe
Token: SeShutdownPrivilege	5504	explorer.exe
Token: SeCreatePagefilePrivilege	5504	explorer.exe
Token: SeShutdownPrivilege	5504	explorer.exe
Token: SeCreatePagefilePrivilege	5504	explorer.exe
Token: SeShutdownPrivilege	5504	explorer.exe
Token: SeCreatePagefilePrivilege	5504	explorer.exe
Token: SeShutdownPrivilege	5504	explorer.exe
Token: SeCreatePagefilePrivilege	5504	explorer.exe
Token: SeDebugPrivilege	5460	elevation_service.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4316	sihost.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
1996	2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2496	StartMenuExperienceHost.exe
4112	SearchHost.exe
5504	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2332	2100	SearchIndexer.exe	100
PID 2100 wrote to memory of 5968	2100	SearchIndexer.exe	101
PID 2100 wrote to memory of 4168	2100	SearchIndexer.exe	102
PID 2100 wrote to memory of 3340	2100	SearchIndexer.exe	103
PID 4316 wrote to memory of 5504	4316	sihost.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1996

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:560

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1812

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2520

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5172

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6028

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5588

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5824

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2332
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5968
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2576 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4168
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2724 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3340
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4412

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5504

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4112

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6c824cd0945df0e9cf4703588b3441b856098065e17690c12ef29c875fea96f2
MD5 4710252ad16f49481930ba5bcbf3c7d4
SHA1 7ded5d792c0db5c695e9f1e28ccbbdb94561e38e
SHA512 5c971b46195efc685525e45b0727c2f14d7b49bc810c869f0bf27f879e81dd4dc6b23cdf89c0e52a1fa455c16e94e620f30dd8e206fc2ca8b4101a09e297b5e7
SSDEEP 49152:2b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnAx4x8EVep:o3q6HjBDix8EVy
TLSH
T1E2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 d971c62eddecbf6905ec4be8231cbaf96200a7f8947942c3fa9d495a12358147
MD5 775e65783924a8917079db447730562f
SHA1 52c2a6e6fda714e087f95889b973b64fa026efb0
SHA512 c0738ec2ff156c56b66dba3376ae7e13be5c2e32a19fe27c6c541e81688e392521d27298060fa8b4e3c9e66c11c1c6758bf73241631384cf20e99fa25e0b0f0f
SSDEEP 12288:C1XLsswWkxy2lRq2czAk+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:IXYfDtczAkyxknw4FYnshx8OfVe247
TLSH
T12675F12877E508F9EC6B8139C9B28512E633B8554770E38B03E4A5295F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 f75b0bee1f88bbc2e3cee2e61a9a3f59d8b24ee1f4ba1c47415df5a09b594219
MD5 58c0fe9bf047949b0bbfa33d535e7d68
SHA1 7a4578e2cf5e0ec31eadf578520aafe914cff576
SHA512 6b1428abf1fe01cef969ef6f3a1dca60fe190d34efc9086a0fd00c45b5e6235d4ce89f08625b91c55986f404f698d345abce9a6d75606a220c812f2c0dd338c6
SSDEEP 24576:e0Le5ji0hmx1rMNyxknw4FYnshx8OfVe247:ePji0A7px4x8EVep
TLSH
T1CC95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3a26e09451a4406feea57575b3d0cd5da3904698f07963d74e7ade4c71461f46
MD5 3faac0b9144f3d7a9eda8c851ab31cd3
SHA1 662fcdee5dfb2529e40afbc93ec7a3e5104bce5b
SHA512 db26e63ebbca8bec04baf65351559c24009f45e6d841ea4343643d3a035cff0ba407a5e57859a0ee15337b9a2f138ce81c86ba941cdaf6a3b382cead725440c7
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWE6q8wyujyxknw4FYnshx8OfVe247:4/ezSC6vUzPvxHjyVx4x8EVep
TLSH
T172756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a8bf8115391a1a6c4518f3fd9b8f18a2dd3a516a3b527b9d56e54e3cb538bb89
MD5 5a98959781573e611c006fd22524580b
SHA1 c8544534361d9b60b6f0fbbab337a0401d864691
SHA512 8a8b11c9ca891e19a0698457ab95413d4ef1115d675cad5f3302274abe17b7eb4e56e85948affddaa5afd00f3303e1b8172169bd0ea72210f930a18d1db97d59
SSDEEP 24576:XVbqPb88hv/l+6Qyxknw4FYnshx8OfVe247:XVO88hXl+Ex4x8EVep
TLSH
T1AE559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 b5849e260669e510a936855cb4e51565fc126dd5f25e2d070247013f08d00075
MD5 01a0969f4b665e63a7ad5739d3d23bfe
SHA1 62ce47d840b4c24479126b64b123abb03e1d4f55
SHA512 4a1b34951627c0efdab416a797f7f0f2f6494371bbb447f2d62379c5469ec1872c8444bb16bb552ac796fa4dbd6c503d3ad5304ad01b587633d2c3878421faee
SSDEEP 12288:sNp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:sNpyxknw4FYnshx8OfVe247
TLSH
T16865237CA7DDA4E1FA5E14331B7572623616B9A4DA74C11BCB78B14EE0F0CA0D06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 3ae87b27bb48d09ee07fc5684409f3534ba9c85a0a46cf5d69899adf89c31eb9
MD5 f5ae6ef3db51f90accc0d963a72487c9
SHA1 810f3d3491e40d8dabd77042b6f4c2713cf80a89
SHA512 6d58230912fbf3024b3733892f4979a08751fcd890795973190aff29a2120e35544a745f5ca938adf15bc4bed57943938113ceced4cc5bb89fce10027e581269
SSDEEP 12288:8eBNUbTVO86Uo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8JIUoyxknw4FYnshx8OfVe247
TLSH
T19875CF7BEE28FCD2C27E4DB95B918600A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9ea071a0d8fa43dfe52a415079fc73175384fce39f79f8cd8bb792c3e400467a
MD5 a30ddb504b14826200d9344b08402199
SHA1 1bcdefc7b15fccc60297f27349c461d8d5cf7e8e
SHA512 479968a6f27eabdcb74f0c9c975afdcb1c5a20d62273d5635834767e78193dcee97f37f1b2b3e0f6969d39dd0ef24b00d01e2235e4e7b52722c09814acb0064f
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THj:AQvGAdlCEL8c/yRNw5C2ix8EVy
TLSH
T1AA267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 678a82a13ce2a6277a3692df29a32b6b5ecb688c19350b4741f4298f1201be24
MD5 e0ed233d676e2f4a88a3e45dda46eb13
SHA1 383db38378edf25087a96549623390b76c1d3236
SHA512 39859e74ea5e72caebf0f77b230ed2305beca82103cc65a64f6f4e1cc503f42af89770cf61e318331c897de121a0d9132104423151fe77010cbfc6813a17d7b1
SSDEEP 12288:PAwSfxL/2Dc3LDLLmt0LDQewsAjG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:Y6ewsAjGyxknw4FYnshx8OfVe247
TLSH
T14385E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8cf36f29c4ea3508f9b83f95d3aa63699cfa21ca31fae9a62319a434a49fdb16
MD5 f766a488de159d758e47429aec256267
SHA1 da8709361d707cd2d6616edf63b46a067d2ab7fe
SHA512 6fda1c10a1245cbe911c2c0fc8edfd54f583051af8d5f34c886c1ae116aca035fa4fbd1b90b0fc50b762228a241218b978444d8e6bcdbd0bb3516f7c2715c5eb
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHs:0UEtQevvqc2W1cpV2EI32
TLSH
T113474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 24809ab42fa87dfbd5c17bf2cbffc12a8dcdfd28dbb2b77b995947fd1c8214b7
MD5 c2043cf6bed7275fae2b938309fe05fc
SHA1 425a81fca602ef5581c765246acfe4bb564ed0bb
SHA512 04fbdf282242346d5ffdb165ed3cdb1077ee48711edd00fa339abf1ff2c0ac7bde2fc43784cffe911a2ac0043ea639c350590c77dcf6189b28e6400d0c23ff10
SSDEEP 49152:mCbRquA/m2yL5zQfFiV+XenmE3/zZx4x8EVep:LoqtVjnmiix8EVy
TLSH
T11FD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5e3d23bc3250f6efd0f13050eba0e297d5f994aa5c71f4be39574b76d85f6cef
MD5 5dbfa242d4f5d0277e07a87c9377a4a0
SHA1 557f4ecf7f516807978af36213f2ed4ce70793c3
SHA512 3095c8ca7260622643054f0f3a927324ab6e474b25e97dd7f9fe2a533a1e7a56271a75ebc4de99a75fd1c31aa5859ca523ce545d8f1daf2e4ad20311ab83c213
SSDEEP 24576:NAhGLJIFoiwtA5l7S533yxknw4FYnshx8OfVe247:NAMyFoiq5yx4x8EVep
TLSH
T1BB35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 767730dfad032ff91354613583758b279d0820ead0c8f9789f67b18041f7bffb
MD5 edca05682b040dc2a4ec0490776e3b94
SHA1 a92f5d8e69ef972179e197e83244f7db129202ea
SHA512 4516f971b75bc390645f789582aa0f4529330eb1b32a9ab07b48b21438ddfc6c494b7b553ba9b16a9a92f1f7d06b3404c1248b4d68178a0a9b51cf2b73db82c7
SSDEEP 12288:bmw5HEjsChN4BFgl0WDm+CD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:6wuVOWayxknw4FYnshx8OfVe247
TLSH
T15075F14977E91CF9E96741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 3e9351b9b1973c36946b7f1fdebaa2f198c941f5efaf475fc7e9e99a5be1484e
MD5 b560df0f0749bd36bc22dcd5bc67bbfa
SHA1 8babb5898dd1f6bab74f64706e8509869e7de7c3
SHA512 0653ebf35fa07e74106cabc37524c10a3b85fd2c612fba13f5499e57b940ee7cd42b0d8a28b8f5058bc3d0ece25764cab7c33f1cc719fec1848deb8be10a2d85
SSDEEP 12288:TFZ1IyW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JZuFyxknw4FYnshx8OfVe247
TLSH
T19E6512AC33E860F1E1A7113A89F15205E76274A2677183CF4768625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 82a9720660c19883425ca490df8bb524555792b8a18b6600446c2cc70a8ec1ae
MD5 df2f7b85add4df1a8ffd12557b124112
SHA1 3d80af7fe847e57e5e930431de6877b527a994b3
SHA512 1b1fcf25475598c323833d237fb46458bebb5ba9861eac198cc4e91830e17462d39a769574f9dcf2ab7ebe2bd2ee3292ba7489e59abdfc882da0eff802e20915
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U3:gQRQyi36YOcPQLvw2gAf+PN3Xix8EVy
TLSH
T1C5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 33da06a1e679e0e908fedbf51480629b7b9eaa877ff5a616e276f65bc286da8d
MD5 5d9862aecad15efbe4d98b531891111a
SHA1 f572aa024d56ef23a00c3a7be94a4ed1d2cd2772
SHA512 9dd52c8a62c038cc58ce04e22689224348c948a492c033b5ddda37cf3f01a9edb6cc86d29fed3d83c3e2e7344d36ad6eddfde603c0954b3a41224cd06a4844ac
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U3:VQRQyi36YOcPQLvw2gAf+PN3Xix8EVy
TLSH
T173667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 dff5c076def00cc3757a9a702c2c44e564bedefd102a60a623bcc5ea408bd766
MD5 d3b616a723eeafda4f772077e355b717
SHA1 ce684212f18a64cbc928255a1e146ff0d10b6966
SHA512 82de2deaa023c1e8889fcff5d40066e599a59502e21eb4a23f89b861f575f1de4cc46ce8d3934c29f07d90d5c59272194b7ae0b8a53a0cc9160b15450d64ce66
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL01yxknw4FYnshx8Z:368Qg55nhheWu7PNU3/px4x8EVep
TLSH
T1CAB55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 96c74b39ceb663145f00702c972a3a1b59ebe6f1220e6720757c0926bd1c6eec
MD5 1beaaa343464c6998c7e81ade1b90125
SHA1 73b70b007ab87298de66cdfcc39d9ad34f5a0e90
SHA512 c4285471615082877065aaf21dfd3d05893e0fee8d518a0ed9f7bc3d3c654efae5b603d3c0061bdda2fab4bd2c1758a89dc5dfd421eb8d3cf416dedf00ad1a9f
SSDEEP 49152:53aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Z:oy5112gYy5azzVvL69nLKnhZsix8EVy
TLSH
T18A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 11de83723f324ba585d305413d7febdca1df7b08d9f7c34c7d88ca96e01c3a5f
MD5 5105cbb4d01af03ba72cce7ee1ca76a1
SHA1 c055ab164513d92ccd5664bec014bd272f7a6e7f
SHA512 0469a2136cf785ad924f9e35f431d7a705c9db6ceaf01edbb6f70095187ca4a35632b10e504c8ec2e6c7703ea644b0a0832c70f73031e3cb0bb1947fdd158a9f
SSDEEP 49152:/B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glvx4x8EVep:Bu6JmVxd2dvix8EVy
TLSH
T12CD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9a62917e2546e5b733611744bc82fd8008695ffd5cfcd261e7b3d04f0cfcbdea
MD5 f17b51d1efef99567d5f2ad0df4a81ac
SHA1 8e1ca27e14cb6867d8d3bd3117f83b70f13f964f
SHA512 b162065f52ad9b80d2f4fea685f7b36429d7a7b707e27d2d0e93765b9543d76dca2d123055fbc60766b766c99e78dad66b000dab60f16fd88958d033e58b5be4
SSDEEP 49152:N1hpsNoJpF1A6UU44CwH7R4xrx4x8EVep:NmifPbRiix8EVy
TLSH
T175B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5e178d9b24e789b5439a81cec4bdd1d6f3a64f4d54abf13c042d8dd9e063889c
MD5 021d427a4829c888b4b10ebc4dcdac05
SHA1 bd6bb500ca9ff61a2b7a4fd162b3705832a8a16b
SHA512 c7fcb70c5fbd2b3b2c9b501b50d5509df16f973c2a68f8f035a9ab2605c55df9edb65cc2bcaa03d6cc936f83ecf72e4d13fff3a49411a64cea570c98883b5e77
SSDEEP 49152:QSuZQIY0Be2KRRVtOnks6NMHqQx4x8EVep:K5dKTi61Qix8EVy
TLSH
T162C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c084772ad837c6d1f7318b8b55ad2647ad8049ba1e3ad4b4240d4c3d6bd6c101
MD5 0317e8500fa73682f0ba1e8c4fd214e9
SHA1 0affc4f9be55697a3f4bcdfc3a566bc0286325ca
SHA512 813b3fb79e9dea6f96efc34c5bd8d5338a781aaa0efb50beb74207656091aa5ab83fa3f8c2c691fbbd59274cda2d4dad6a992af85747c3e31511952f53efabfe
SSDEEP 49152:ThtSn8EApI0figngiDn0AP5w/x4x8EVep:SX2iyph+ix8EVy
TLSH
T18C95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 d87b3be134130dfe795000b2417176082ccf48acccd1700cb1b71c1acf3200a0
MD5 4fdc9d8db34f6ac37a4341282b17af46
SHA1 f7c5ef7d2531d0ff9fea67d4b2a961ab3854cb62
SHA512 3eeda94ed690ab02ec38b8d3d67f071de9c5318e3eec0c6cab465c6a28f1f52dec43e1d110352291a910a30872a20db0e0c6d097e4a8534f3c2a229dd4b118cf
SSDEEP 12288:2B+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2Byxknw4FYnshx8OfVe247
TLSH
T1FE65237CBBDAA5E2F50D11734A7173626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 b312ae756a87d7e4439d06a37f42ca79f7589fe95fcc295079f368321feaa43f
MD5 b28880f34e92440e77c9f11cee70fdc4
SHA1 c8f460ed2b2ddff8c56bd1bddd2ba8ded51293c2
SHA512 7d3b2a4a699d0b25245253ec16a3acacb79d301e8bda2c3f5cd20ecc8af59ad36515a0d04235e100b1e8e6d71c84b68314583afb1549bab7bf9c6a3354ad54cc
SSDEEP 12288:ni+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:niyxknw4FYnshx8OfVe247
TLSH
T19065237CBBDE95E2E50D11734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 1d7a095eaeeb6498f71f5da5c7e1f1a73694c2a49cdc98f87798afea664c5882
MD5 182e4df3a50fa8b89fb5ef82a08f0bcd
SHA1 12ede91dc46ff2af38b01f01f61d2fea01d9f12e
SHA512 48d4c9e6602481ccbbe6fb99ca8a8a1f80602035ba4eb077096144a611fda0d03684a4772661a558ab3ad8fc7857bc2aa821d39327527fcae9119ef9e1a82e68
SSDEEP 12288:WA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:WAyxknw4FYnshx8OfVe247
TLSH
T1E565237CBBDE95D2E50D11734B7263626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 f7002d989305870bc30af0f5b319ae0b48484d4edbacdbdd9e0089bdfbf79ad4
MD5 9c07bf0429f5b41cb338468517b5af1d
SHA1 5737d8f1796e4963af419e31bed8a6fbc2192456
SHA512 c74bcb64027a5fc47e2fb3538269be37232cc40e7f7dc909d9f1fa9c10fdbc5f0e5c414e06155b5070cce4e7f69bf525d2556d1b21bfd9851af3678c7f366fb6
SSDEEP 12288:5VX+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ryxknw4FYnshx8OfVe247
TLSH
T15865236C77EE50D1E85951738A726222B365B8E5E731C35FCB24710EE9B08A0E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 8a8cafbeaac9d0320d5803be22d9100f2db760b7d705e11f16b9049c10cedf00
MD5 f2d60fe67c74f7696c3c735487eaa11d
SHA1 8be8b52a80f5183cef60d678d25f584121a688d2
SHA512 0dc0ac7464c51ce96430e6f4c4ef8e7df57b1b72f85994a47bc103e1cd8dcf9576e74e5ebf91c4b74abbe5b6445d2e75d295139abd328b8da5668499a8f5e6ec
SSDEEP 12288:V/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:V/yxknw4FYnshx8OfVe247
TLSH
T1D365237CBBDE95D2F50D11734B7263626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 9a2c78c11632ca8dac60e80846d355bf84cec1d5f404d464289d17fa8547d90a
MD5 2a66db6df98a796234901e7cbed7454e
SHA1 170740aff832fc1c6f1c5a27a3832ed67c4c0037
SHA512 f629f584827be463c6f97de172c9eb363280410c57d75d4aaea544cfe96e8ba3b15a04241b8b2c8de44dba5465e7491a2c380202967bcd944efbd5f9adb6a2c2
SSDEEP 12288:g++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:g+yxknw4FYnshx8OfVe247
TLSH
T16465237CBBEE95E2E50D11734B7173626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 11011af8471a096951fd7611aa383d07c34edc75ad1cb23f9d7e2c11971699c7
MD5 bdbbb26ee7772d9bad796ab0da460b79
SHA1 1ce56fcefef0e3dab6e9621b04ac7f64afcec27e
SHA512 4a629ea733cbf1ab2552ae364834eae6910a1648329cecf814be351731691228e79e9aebe2e18a82cba7f7741d70e378eadd6d919a502a5075f907687bde975e
SSDEEP 12288:FK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:FKyxknw4FYnshx8OfVe247
TLSH
T16C65237CBBDA95E2F50D10734B7173626609B5A5EA75821BCB7DB00EF1F0C60A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 ddfc6abe8b4b33a748c420d2bf41b4273ae31a0a530ccd76c3a9f4005ba2a78a
MD5 b6a9346375eaa2d8544460cb6288f152
SHA1 1d04f7c7ff5f14c89517c899f21546348f0ffabd
SHA512 798e0c6d2616504bc27ecf5ee83f12e2ead4d386d145199cc41bd757cb0b4751c9b00f0871eb1f7cca348dd81ef39e882e98ee318580bfe9f10355755b3eff16
SSDEEP 12288:1iZwbZzzFEoS2cPvyC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4ZMdzFVSOCyxknw4FYnshx8OfVe247
TLSH
T1797501A8B39018F4EC67413FC9259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 8df0f64c0f910c60a0903816e38c3dd53da113e01371bd50a0346e15552faa75
MD5 1e38d08ffdf96478ad456ba856ab14b1
SHA1 46bddfe5e199f0ccab98651ac846c494d9b27d6e
SHA512 709a4a0bbbacd9245a695318747b4caa239754706231df0ee4e199e2d3c9562c0962067964ad071a546fc52bbf90c2052169e98606fe595006549e5373aed130
SSDEEP 12288:jV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:jVyxknw4FYnshx8OfVe247
TLSH
T1E665237CBBDA95D2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 cce77c4c8628993c769088515f392b732331376768b70ca3d21c01c54741f330
MD5 1dbb08e4e434e7be4a7a42101b8a8d22
SHA1 fdb8eec2ee3c4444be7897666117742221e4236d
SHA512 c453b873a73a13bad838f3ce9d1f632239c82546e525e19ea73e61e9d5976c3f58069f28191691d694cba758ce1d4eae17657d58d509da77f576665103922b7f
SSDEEP 12288:Y5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Y5yxknw4FYnshx8OfVe247
TLSH
T17965237CBBDA95E2F50D11734B7172626609B5A5EA71821BCB7DB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 e51ca39a9ed99cb2048637345e55a1d69b56c3e4e39a966d70d390965a42b9dd
MD5 21ed6edb145955a20a34d6f2e2ae1e58
SHA1 1c076a769209eb95425c3126537548e44230a404
SHA512 bc74663ef7ad85499b23b3656e1422b65ab805dd11bdb158baa67c0941c886020bff126264d8aab736d85dbb287cd1332a4182b81395369f4963c5cfc96afb4d
SSDEEP 12288:4yPz5L8W+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZzyWyxknw4FYnshx8OfVe247
TLSH
T1AA75125B73E530F5D12A423689621A12F372B872473086AF87A4537E6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 b4ff7223a37026c4e9d209db22e758c3a81eb93606cbb15a30d94700727dba81
MD5 bf178c889b1b120e7d22e1bac89a7852
SHA1 2eccee439dcbef0050033c3d3bcd3db5f0639aab
SHA512 a06e01efb422e173f958c7da8dd53fe7deb7101e43d421486d4c3e31649b4c514fa7521b1eb3d6b26d4a343dbe4f88f1e4ab02d94196353d40f92ea241dfd6f4
SSDEEP 12288:UV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:UVyxknw4FYnshx8OfVe247
TLSH
T1656523BCBBDAA5D2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 1998fd5c85dd64270dd2b409d8e8306cfe8122ab673776191194b88024dc6938
MD5 76087a894765b07e25af75720cd263e3
SHA1 1bcac697f94ba0addc562c39cfb4ae62db4c0fb9
SHA512 f587423bf5a7cfaeb4746f09f3d1be476fba19d24a2448ab6f7ac07969d65636af7072483c1dd32d4266705d552428253a2c68b38cfb94aa046b7908ae645676
SSDEEP 12288:jV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:jVyxknw4FYnshx8OfVe247
TLSH
T1F56523BCBBDE95D2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 1d6a1a3fa51d436d6428528fb565110960d2e84ee7e56a801b8e0c45ab8cf944
MD5 c5fc2f7c6a404796ae562e2f5954e4d7
SHA1 214b30e99eef1855ee3574df067377f98151c80c
SHA512 c62838ec6bfcd67bccb511df033fc89da758b4b014f01f005b2dc45e3b30f82136e28f6db3b74c3e486978b85415b66af65338ba224ce8d907a222d1543a61d4
SSDEEP 12288:pyPz5L8W+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG73:IzyWyxknw4FYnshx8OfVe2473
TLSH
T11B75125B73E530F5D12A423689621A12F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 09adc0643acdfdfd10e35f3e23305a8d3da55aa87e8c55c3b916de1fa7f21e25
MD5 6ded2b9ff0d3f0bb80a6b1a9f875ab0b
SHA1 85c8b47fd37374c1d8c8c89cbc5df80102a6d8ec
SHA512 bef62000395f09e135d31ade988a916b1d55cbf3d658029f2eb439b743809362dd577d5077d03c791ca7cd85e5168f49d7b27469a5ecfa2709ad06e4e36f04f8
SSDEEP 24576:kTGaLl3z0zDwyxknw4FYnshx8OfVe247:kTFLljmx4x8EVep
TLSH
T1B57502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 0d3e8443c9233cecbaaadd05712f16f6110e80b55ba5e492a1481806420fc623
MD5 dd846dcab0c370ab06578e3b1064711a
SHA1 a4639991ad9e5ac39942357339a44ac7abf70203
SHA512 7b55267cb2e52f4559a31b6cd11bb836068d3ed95322f42aa71a03dab4f9857f7d7713413dcd53d038966269a71f069be2d5576408602035f4efff670c4f698f
SSDEEP 24576:w3Xd9CHKy7GZcyxknw4FYnshx8OfVe247:6Xd9CHKyaBx4x8EVep
TLSH
T11195CF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 aec65309bca758aa3592980113e6af05075d04ba60701b4da0b09bdea271d632
MD5 8fe292e4d3fd15992f79802e2ae23bea
SHA1 925f077e0fba6dc25007b68eb9bb3d4a0fedb63b
SHA512 cbe4a1c914b8c243934d4b2a38866f953e2c31d579dd6d667a66c6a4d6e90ea70a5c018d8168af5f1857ae3ef52cdd4eb817bc806eacb75817921a51db20ccdf
SSDEEP 12288:Tg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Tgyxknw4FYnshx8OfVe247
TLSH
T1FF65237CBBDEA5D2F50D11734B7273626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 99a4bca17e73a815446d64c725479e159ccc31820b137203baaabd45298fc925
MD5 9e9178c6513387676ad0eb844f7b66d9
SHA1 1d22d42631167f442d74f0546c2c67dc999acd48
SHA512 a9c55c86c9b96110066ca28ce637240f390469da6f447ccb1c5f118609720b4f0730a2553c9db7f90a6d3166578b42a2ac14c70692d233f05d9a29e16e646858
SSDEEP 12288:F2+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:F2yxknw4FYnshx8OfVe247
TLSH
T15165237CBBEA95E2F50D11734B7163627609B5A5EA71821BCB7DB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 fc38e9b0dad30dfbc4d378b6f1757391521d4727786d5535b8ee584189ffb27b
MD5 8bad09b2ca3f7c5b05c78494bed076ce
SHA1 5f095ef2c14d2633d48c02aba9a7e72ccf0a5839
SHA512 37e098fda64bd70d1b746bfcea7ce31365c7ff9923b08b29427d3c0f8dcd023ff4b697010cd95c02485411e16285d970701290685a9672f1bd6a1a401a9cf07e
SSDEEP 12288:Pr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Pryxknw4FYnshx8OfVe247
TLSH
T1086523BCBBDE95E2E50D10734B7163626609B5A5FA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 dddecbcc39658aac5a3c3750bafdb56652c89ea9583f524f6ce4c387c0eb06d6
MD5 728c4ed538b2a6f03576a12962b441a7
SHA1 a2ad5b320f026e0ca9d79fbb0d11423db17b3161
SHA512 93ba8c313f1a40b36a8625b7b8fc0799efeee926146eb60bb4af60decd328c07009a0a42d8408687d6f4404c3754e36a4db3206b7bcc60adf8f070c155959431
SSDEEP 12288:lV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lVyxknw4FYnshx8OfVe247
TLSH
T19565237CBBDA95E2F50D11734B7173626609B5A5EA71821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 9641f1a44e2db545ce87c40ae698244a9306a3fc89fe3b22e47bb467d6d492c5
MD5 e477521109d1b0a9c0452c370604e9ba
SHA1 e3e156baed23f0d6e8524174071738f76ae0a043
SHA512 73e0cf5b405111ef28071a55dfbe5aadc60bf5f86fc8f666d414500b12a90a1390eb44130db7125d7f39f08d9a8e378a18b356a28230d5da105bd70227f34746
SSDEEP 12288:ug+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ugyxknw4FYnshx8OfVe247
TLSH
T13765237CBBDE95D2E50D11734B7173626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 65225636f7d20c489ae59830269ee3ff27ee300b19238add17beda98dfb2894a
MD5 64aa10dd7d2ec558b9dc5136b5ddda9b
SHA1 0ee7d6353e8c907e9de21d7af9ce50b0797bab0a
SHA512 0892b13bd8b402d3ecff34f2cdebfae29b05536fb15100ecf332659406de24bfd0847616fe52c5a1af80c56f1faf55ae2c73c7d213967132debac627a1cf016b
SSDEEP 12288:z9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:z9yxknw4FYnshx8OfVe247
TLSH
T1BE65237CBBDA95D2E50D11734B7163626609B5A5FA72821BCB7DB10EF1F0CA0A02E523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 3c5a33b14e6970156d9af6913a7743fba73c17b766f851c88bcf660f19e363d2
MD5 54cac5f5dd3df6628eec5d5a64b4d778
SHA1 107e475ecac6dac4166410051a6d3d8d04807b98
SHA512 6549790ed3a8ff0d7c3240159877fedccbac979797cca995b555b0b11effe02a22edbcc25476307dfdf9b343d0eee2cbc9c93a5c514828101bccf1bdbe769eec
SSDEEP 12288:I/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:I/yxknw4FYnshx8OfVe247
TLSH
T1C165237CBBDE95D2F50D11734B7263626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 97dad3b7fceedcd3a8cbfcf6bd244c4e994f8a2ceb8b015b88eb517e3678581f
MD5 d26a27800a3a1c224d347e24ee8a846b
SHA1 2fc748aeaad686419c5742411c6385e10dc3d504
SHA512 a3dada6be987842a6004ec6e0a34253f519baa34abb62cd2673ef559d9b0d2a55817f19a1d636c8d5a18ee442b79d44d8466e5cbdc74f5762efc00ea818d9b49
SSDEEP 24576:+fwvJk9RX6wkyAIJyxknw4FYnshx8OfVe247:7MnYIMx4x8EVep
TLSH
T17C95CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4df682f601ed95338fca7cb991190b28a73ed80d83cad10722b50f2c4a4346f1
MD5 836d28e2f1d24ac19bd722b236edd3ef
SHA1 98ef60b7feedecd6a844cf7fd493d4035efd8587
SHA512 fdbb6847a3b05430a0f5d0e87218570d83b42f5fdaf786a5ee8ac9e4dc562494381d33ae0db025eda1e489731a8ef335a7106b114e0491a44946b7e0bb199ba1
SSDEEP 49152:lYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0fx4x8EVep:lySzP3ix8EVy
TLSH
T18C066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c323f08c842e80bad6c0e9531e305a7fbe4bd44924cf33d80bd71b45a99cc7e8
MD5 0232c2c099ab2d2f39b5cfd969462957
SHA1 b99d52358d2eff6a4ad5fc92562b1a1c7c00f779
SHA512 3d24cd139da37c6b892d96d9785e26cc56cc4117d2ed4bf1a21bed7d6c5b0d3ad7805f7778863780e34199f31d95f33b2c9800e370b014ae46ce91084d86fc42
SSDEEP 24576:h47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYSyxknw4FYnshx8OfVe247:h47JUQj1irIhCnDHUPfF/vx4x8EVep
TLSH
T17165AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 c8248b339d06d99cd102e2d087baaf98d0ea73b34cb7c8dcbe68e1b34482dbb9
MD5 8a893c372971d8621af2da957dfa4094
SHA1 18c131ee3fe618fa8dd0ebb64592bceedd0bcbcb
SHA512 096d8634e07ac242eb1db343dce17066f3021d51d007eccdc6be7d6a812c43864bde4fd45e058e2e9ce9a8b3f37717b0400206151b62efe1a06c2c368ef1be12
SSDEEP 12288:n+sfF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dFyxknw4FYnshx8OfVe247
TLSH
T1C775F028E29802E4D06E2176CB625641B3237C6597F1D3CB97E0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 12KB
SHA256 8acb18d3d2d165fc7ba234a98f42cc4204c15f0917212b1fa95366f487bfbdae
MD5 b5c2cda3fa44b8a0cdc6f61518edb97d
SHA1 d524a2b2da775337a6a1458f9e1bdd45b2d1fdb6
SHA512 46c75035c373cb533fb429f63e2c8a0aed425b4359b1823e3789e4a0d877aba6bc2b371e41c4e2cd546d9d27f8660356681c5088338625dd8e9b81f7d407fea3
SSDEEP 12:KTcYWEEEEEEE8lfeClnEzBRMtrC0EEEC3UTSEn8dEo5RvQvsMlE3UvCeIQP/awX2:KTczVZe+CqOS8cE8RYs0skCex/aw2
TLSH
T16C425579EF604E00DFF29A35C4827FD22F70E47D2899938B61C430AC6E18AE84C2CB04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 8e80220bc12aa8268ff781925e9328d7825f85fc1d3db152e54e18201b6b153b
MD5 f66981a843c8ec5a7b310602311e54b2
SHA1 4a944374f5d926b7d70a295d63d3f73beac280cd
SHA512 27a638865b82e83124bfe7c991d79551cab943f58ccc5a3e48f7ab74d5a439e067089c1117eec545a6ff350861a4d7798413cb42c3c3b6afb3cc9af0e0f851b4
SSDEEP 12288:A47t+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ftyxknw4FYnshx8OfVe247
TLSH
T1DB65237CA7DEA992F86D11730676A231360AB5B49B70C1DBD728B14EE0B0CD0D87E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 59d998d052d17c97c6ecbc3ab27fb3d1821d6fd319a68e93949b7c43bee79fd5
MD5 03b37a523c5b2e199fc0d38155a3838a
SHA1 53e0e00b4860cc03de37e27319e3756ac872fd16
SHA512 ad757d9d697605b728d3354f6daab1464088273521aef26578057276997682864552e0ad9acf62a4a48e6c6bd7e513b06dd4026a997af7adc550b14860864159
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bYjyxknw4FYnshx8OfVe247:sgb4mBIBhGFNx4x8EVep
TLSH
T1DB65AE1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 5e67ba74ff46b3c806d5ffcb94b7bb55fbfe79b54bbec507c728837b47e5fe29
MD5 351a52307b7e44019e1dee355c7a52d6
SHA1 7e677b2bcf9c21e04168ac1f63b6348f21094f7b
SHA512 ff4b79963359a1e6ece4cb5e1205185fb1e67b344b0583e11580e3c37419f14aa44d85c794c0245ef1363b2b1b6d341a39db81794c932fa130a977201701a357
SSDEEP 24576:aG88u8FpJqH1azria7/mCyxknw4FYnshx8OfVe247:h7ZFPqVla7/ux4x8EVep
TLSH
T12295F16977E101F0D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 e65021696d84290686e46013a888b0f37e218a5ea2568ba1ae973224bba3d372
MD5 cf7f5f562f450dea7750432b0afa1e48
SHA1 f3d5cbceaa1253be82c60d3a62ce2196ee8b352e
SHA512 7aee974f7b84bd68ff35bdbd2f4ec33aa871601be698af51ce62cc1cef225f99dd9f61e54bc7626c3f829e88581ecd8d89b57c858856032293277b92694acb40
SSDEEP 12288:uHvUrBFrEjwaQO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:uPUr+NQOyxknw4FYnshx8OfVe247
TLSH
T19975F12E22ED18E5E67AA17D89828319F771B4621711D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7a7099d9e5bf013e93cd4d41ae21fc06d75f1cee518d048ed0da8b96d5130a3f
MD5 5335017c0d9a713910f9b62ac7b110b4
SHA1 4f6d4d990142155e2fed1806866129a0beb81ef3
SHA512 65d5c0747ec447167e9dda98f9f4706ee481b7f0eaf6b0d7b9ee590389bca40cd787ec35c08791124b2a77e5a594e34f669a769dd93366d14fb404212a3c5d29
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxx4x8EVep:QG05lO43bUix8EVy
TLSH
T1DDD5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7257e7209817dc40593144070f7fc4d2e0d5bd0d7ba941494b29bf4047d2a9d6
MD5 6f687d9bb5d58b76d9290e10845f50d0
SHA1 a95d73b936f497df0292f532b90c3b0c59cefa64
SHA512 2840135b09a425be5a5abd385ace08a55852be381d908445ffa3f1ad8ef40fa19cf78821b940b026a1199982cde6ac41e5087f3b515f3b3efb799a880f15ccaa
SSDEEP 24576:Kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnEyxknw4FYnshx8OfVe247:Ca5POZ3+Jt2pasx2+mpx4x8EVep
TLSH
T1EC65AF5DA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c65206cbf618b7bd77c56a7349af44e8ce63614ab820ef6594a70145b4b5748d
MD5 126c8c9a1a78b752a708fc10d38b4acc
SHA1 f26e7187db80f9186a4fc5b9c3433679855ca0ef
SHA512 1e30450f0b04bbf9fb679df387fad212cb9b97a1b725e6536e76883d0e4431f102585f5a4572f2d7818007b9e89fc87692ad2327b5b1743c23451b61aa18eccf
SSDEEP 24576:wNcwHdjbyQ4nLC18lb/EOjowL7Fk6yxknw4FYnshx8OfVe247:wNc/zEOVHFOx4x8EVep
TLSH
T11C857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 16b1f8651a5af2a3c6ef687c1e0fffcbed8b128a90854321714d09a6bcb277cc
MD5 a4dfa6b1d72fea1353a69b823f7440c0
SHA1 57c897081e011b3ecdfeab87211bd63c2da918ad
SHA512 f02f5d09c237dbb73368b2bf11cfbb0f84866cf44e46173597b12d5e2df4d862cf011b05d251e359883656b77630dbef901d5298545c5d14a76f15479bb7d52f
SSDEEP 24576:N8kNvNnaFeYhJNtmZBm4yxknw4FYnshx8OfVe247:N8MwBtOmbx4x8EVep
TLSH
T1F955AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 1dfa2dabf537908a1cc41ca206a072420e0bec45d95600b7b7301bdb7d5b2360
MD5 bad4dfedc5034e7f821c63506c52bbdf
SHA1 50cf86aed584335d77f3a3937fd627d498008175
SHA512 fd6bb19bcb25d64d4677ec734adcbf0b6c842c879e4e31445155d12807599e88793a146664607b084d6aff296ed69c5d59259e9853d1d65c5d27c2486f6e2d03
SSDEEP 24576:ZD3FHshBIYQgAhyxknw4FYnshx8OfVe247:ZDVHeBIAAkx4x8EVep
TLSH
T1B985E17DE79C04E4E57AC1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-127-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/560-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/560-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/560-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1812-51-0x00000000017A0000-0x0000000001800000-memory.dmp

Download

memory/1812-41-0x00000000017A0000-0x0000000001800000-memory.dmp

Download

memory/1812-39-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1812-53-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1812-47-0x00000000017A0000-0x0000000001800000-memory.dmp

Download

memory/1828-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1828-135-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1828-138-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1828-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1828-129-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1996-40-0x0000000002DA0000-0x0000000002DC0000-memory.dmp

Download

memory/1996-78-0x0000000140000000-0x00000001407D4000-memory.dmp

Download

memory/1996-7-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/1996-0-0x0000000140000000-0x00000001407D4000-memory.dmp

Download

memory/1996-9-0x00000000027D0000-0x00000000027F0000-memory.dmp

Download

memory/1996-1-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/2100-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2100-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2100-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2100-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2104-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2104-97-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2104-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2104-91-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2104-325-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2104-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2520-62-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2520-56-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2520-280-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2520-55-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/3340-328-0x000002599E4B0000-0x000002599E73B000-memory.dmp

Download

memory/4112-342-0x000001BB8F660000-0x000001BB8F760000-memory.dmp

Download

memory/4112-340-0x000001BB8F660000-0x000001BB8F760000-memory.dmp

Download

memory/4112-380-0x000001C3941D0000-0x000001C3941F0000-memory.dmp

Download

memory/4112-394-0x000001C3A4850000-0x000001C3A4870000-memory.dmp

Download

memory/4112-379-0x000001C3A4420000-0x000001C3A4520000-memory.dmp

Download

memory/4112-378-0x000001C3941B0000-0x000001C3941D0000-memory.dmp

Download

memory/5172-66-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/5172-293-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/5172-74-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5172-68-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5460-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5460-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5460-313-0x0000000000760000-0x00000000009A1000-memory.dmp

Download

memory/5460-21-0x0000000000A00000-0x0000000000A60000-memory.dmp

Download

memory/5460-22-0x0000000000A00000-0x0000000000A60000-memory.dmp

Download

memory/5460-15-0x0000000000A00000-0x0000000000A60000-memory.dmp

Download

memory/5588-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5588-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5588-109-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5588-103-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5588-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5588-316-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5824-319-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/5824-115-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/5824-122-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5824-116-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/6028-79-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/6028-298-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/6028-80-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/6028-85-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download