d2c4160850e892180ecbe23da63cecac741301d55a3892b9453c57a757c59d43

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 8.2MB
Sample260720-rw2ebsfs9t
SHA256 d2c4160850e892180ecbe23da63cecac741301d55a3892b9453c57a757c59d43
MD5 5cfa25c719178568382dcc36c6356a0b
SHA1 2cfe45da2ee7282053dc97ec1d904a64114c868a
SHA512 3301b8891fb86446329cd915d75965d93fd297c6d381fe11ab35561f0c541d9cfc287e918c52bc795843b1ccc0abf0bb354fd3a8e99d18993c9dafe41c792bcd
SSDEEP 49152:osAdExHcZoQDhpjqLnV/4gXrugGVSd8Yq35yivlrhuqs0vscZBeLqVZA9kUVRchO:xkfmnV/3UIgv6XzTrlP7wRGpj3
TLSH
T187967D1EB66D40E9C1BFD2788957A40AEE727895033596DB67E04E190F23EF09E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4772	elevation_service.exe
6092	elevation_service.exe
3488	maintenanceservice.exe
3160	OSE.EXE
6100	PerceptionSimulationService.exe
5608	perfhost.exe
1000	ReFsDedupSvc.exe
1908	SensorDataService.exe
252	ssh-agent.exe
256	AgentService.exe
4876	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3dbe04a5b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e4c3c6c65418dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070cd030b5518dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007605a8c55418dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a1633c75418dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a5d7bc65418dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cbbe53c75418dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003135dbc65418dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073cba0c65418dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4772	elevation_service.exe
4772	elevation_service.exe
4772	elevation_service.exe
4772	elevation_service.exe
4772	elevation_service.exe
4772	elevation_service.exe
4772	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3928	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5928	2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5928	2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	4772	elevation_service.exe
Token: SeBackupPrivilege	1000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1000	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	256	AgentService.exe
Token: 33	4876	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4876	SearchIndexer.exe
Token: SeDebugPrivilege	4772	elevation_service.exe
Token: SeDebugPrivilege	6092	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5928	2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5928	2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5928	2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5928	2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5928 wrote to memory of 3928	5928	2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89
PID 3928 wrote to memory of 1168	3928	msedgewebview2.exe	91
PID 3928 wrote to memory of 4140	3928	msedgewebview2.exe	95
PID 3928 wrote to memory of 4140	3928	msedgewebview2.exe	95
PID 3928 wrote to memory of 4140	3928	msedgewebview2.exe	95
PID 3928 wrote to memory of 4140	3928	msedgewebview2.exe	95
PID 3928 wrote to memory of 3800	3928	msedgewebview2.exe	96
PID 3928 wrote to memory of 2560	3928	msedgewebview2.exe	97
PID 3928 wrote to memory of 2560	3928	msedgewebview2.exe	97
PID 3928 wrote to memory of 2560	3928	msedgewebview2.exe	97
PID 3928 wrote to memory of 4136	3928	msedgewebview2.exe	98
PID 3928 wrote to memory of 4136	3928	msedgewebview2.exe	98
PID 3928 wrote to memory of 4136	3928	msedgewebview2.exe	98
PID 3928 wrote to memory of 4136	3928	msedgewebview2.exe	98
PID 3928 wrote to memory of 4136	3928	msedgewebview2.exe	98
PID 4876 wrote to memory of 5872	4876	SearchIndexer.exe	109
PID 4876 wrote to memory of 852	4876	SearchIndexer.exe	110
PID 4876 wrote to memory of 4588	4876	SearchIndexer.exe	111
PID 4876 wrote to memory of 2424	4876	SearchIndexer.exe	112
PID 4876 wrote to memory of 3292	4876	SearchIndexer.exe	113
PID 4876 wrote to memory of 1132	4876	SearchIndexer.exe	115
PID 4876 wrote to memory of 5860	4876	SearchIndexer.exe	116
PID 4876 wrote to memory of 5900	4876	SearchIndexer.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5928
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.8.1355.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --mojo-named-platform-channel-pipe=5928.3676.7956395760206522642 /pfhostedapp:304f86c2de99f8e790b9b012b112bfa3bb85b563
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView /prefetch:4 /pfhostedapp:304f86c2de99f8e790b9b012b112bfa3bb85b563 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffaf5975fd8,0x7ffaf5975fe4,0x7ffaf5975ff0
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.8.1355.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1732 --field-trial-handle=1736,i,8077200491608351688,9527466037821598984,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:2 /pfhostedapp:304f86c2de99f8e790b9b012b112bfa3bb85b563
    3⤵
    PID:4140
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.8.1355.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2208 --field-trial-handle=1736,i,8077200491608351688,9527466037821598984,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:3 /pfhostedapp:304f86c2de99f8e790b9b012b112bfa3bb85b563
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.8.1355.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2248 --field-trial-handle=1736,i,8077200491608351688,9527466037821598984,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:8 /pfhostedapp:304f86c2de99f8e790b9b012b112bfa3bb85b563
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.8.1355.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3392 --field-trial-handle=1736,i,8077200491608351688,9527466037821598984,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /pfhostedapp:304f86c2de99f8e790b9b012b112bfa3bb85b563 /prefetch:1
    3⤵
    PID:4136

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6092

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3488

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3160

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6100

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5608

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1000

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1908

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:252

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:256

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5872
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:852
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10003_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10003 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4588
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2880 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2424
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2892 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1132
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2880 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2892 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4ffdf68be950b803909ffd5e99665997259d1094065a72b2f3106be17a16c59e
MD5 01e56943ceace2043d118a92918236a4
SHA1 bae455c09be4d3ce8bb763dbfbe94602ae52ba80
SHA512 b5566cbb9665602dfa651f2179724abad3d7d181bcb5b8c12d918c3bb827f98f01e637afc0dfa9f3b1a909e99718d3519f2ea5994637acc3f9e4994fe57459f2
SSDEEP 49152:Db+632BuPkFKRrdE6ohdstBhuXjfS4LWxnRLNiXicJFFRGNzj3:h3q6mjB+7wRGpj3
TLSH
T196D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 8c8bb00e908b68c91061f5b801c5f16521ff9b24688f8ea6adc8b6bb3603959c
MD5 41a1debf26a2fcad4d19abdfedfa533f
SHA1 f8c003a0665d250d3c56a1cf1ce60d84b3966c35
SHA512 14e8b6fdef34a8892966ef2c3cecd5f6403c106c9b3bf1a91dfd90866cfc2e3d7da2ce00e648d81b65f6ba4b47613deebe63ec1a63e0f51b7be2c70eacd87bc0
SSDEEP 24576:ZXYfDtczAS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ctcPLNiXicJFFRGNzj3
TLSH
T19E75012963D408F9EDBB813CC9B28411E6727C554760E7DB03A4A92A1F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 5a095159e81524df1ce256be6ea86caff2ef6375f2ce065f859137cc578303a1
MD5 eb7696ae8bf44777b86beee11b2dbf84
SHA1 ab8f45a22fe3b74740caae79bc2e823101d25934
SHA512 b84636c234cf3e1d48906fe28df0faea741a1c423c5b55babcb2f7882c620a9d463637071ca980c7f2ffddc5d6adfbcbfc844675fa82b2c4dbd73c279d242c04
SSDEEP 24576:E0Le5ji0hmxhrMO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EPji0AzzLNiXicJFFRGNzj3
TLSH
T1CF859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 765a209d9ccb2cda22e347eb1540f44fadeb51d55a44b0d51fa2d046d80e2232
MD5 0c4bf339853c912049b732f98d592c87
SHA1 a5393eb890baa5b3c802683d15a5115f144d3514
SHA512 3a9eb812440a0a3f2b4428a8ccb584d0eda4e072f1250f1c5496aac87e81814813c025975da6fbdeae54fce51cb156fb1d96fa952715484f523d013a83804d2f
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWj6q8wyu0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:c/ezSC6vUzPv+HjyHLNiXicJFFRGNzj3
TLSH
T1AA756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 91354a2b4c2f4ff6b8e1641d4f056869ab8af2aa7440b8d997fbf633f86bdc74
MD5 8d3713f7cd59b96fb37f0b651df9bed0
SHA1 66ddc14f981a4d9903d8ffc21e0328b7e1c20070
SHA512 24c1692d92811bd45be6095413403e73cf4a34c5929f1cc555bc0b5b24df7a86346686e58201e7f6ca59cf3972ba61f16d43ff9e632a947eb3b2f13722335498
SSDEEP 24576:OVbqPb88hv/l+BN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OVO88hXl+TLNiXicJFFRGNzj3
TLSH
T1EF559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f5103d28c9202425636d3c3ffc0a339517b3c548392f8c1104dd46d8bfd6063a
MD5 e8446ae7a87944a77a6407d55bdd3997
SHA1 b88c6141c02b778fbf3b384ce480b3f2af26314a
SHA512 73a510fe8cb90840caeee70515085872fedef3484d1b69e4513e41a4f18ea11069de1a3fae5defc361a64bbd92123f755cd1456848aa39d6ae6fa9161fe60d97
SSDEEP 24576:OGq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wLNiXicJFFRGNzj3
TLSH
T1F05523D3468855B1FBFD003A867A5828B5845E2C8A555DE3D2503E5EA23CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 96ba8ac7387a6a7d5c90b3cc84fb2947d359339042516081b565c85876f9f86b
MD5 45cc3746739967475d28265a8d808ca0
SHA1 43076ae54520d65f39bbb54f7d7859dda4077ff2
SHA512 0c31310ac89fe12523c869846fdd356ff7ef0be921a69523edc33b68de519ed31fb9b792c95b030bffbd1a5a26fcee3a7f5ffd5df52ff87d40fdb67cae8866cb
SSDEEP 24576:NJIUV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NJIUVLNiXicJFFRGNzj3
TLSH
T1AB75CF7BAE28FCE2C27E4C7957518600E76278304F62A3CBD165830EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9aaef0f742c866ccf7b1d9428f8dc533d22ba43296229b61ab4e6db972059fc4
MD5 e8936a8406ed988e6640f4604eb017ff
SHA1 68309caaa4cfeafbebb37864ef5bad5531e2985b
SHA512 57c5e06e3d5c73b201cd51ca991fd0b1088a09c94ad0795e4e3656e05801b51a141fe0c446967db56e660139f233a28d6e9334637986e6163423972ebc56ddcb
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THd:GQvGAdlCEL8c/WRNw5Ck7wRGpj3
TLSH
T159266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 c4853a147d15086d2cd90f879a7c857f2be672422275ff7842b6443a1d665376
MD5 a5b3d0c9021542221a313088787deb6b
SHA1 6b15e130e12e92eca27d820b72111c5d41c265bc
SHA512 d7014fda269bc2da2a7d8aa54df2a3901a594f42aa1878beec278b79f173b7b109caf82522e0e0d1fbc86c1be58ed34e50ec40b08a48eac5e694eaf3e5da976e
SSDEEP 24576:vfewsAjj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3ljjLNiXicJFFRGNzj3
TLSH
T15D75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 986cb45590547934086660de00f362cae11fefe6bfc5c95a6dfab4fa5a2aa043
MD5 769de69a55aa92a80e6fd75ea42eabb0
SHA1 30b0aa6e229282c0600f23010cccd6a1ee513077
SHA512 e349ca153964d70ec735a0707287a4e5eda4c19f3f38719773081a2fe7f97b32a66b44f0230c7d57de5ec0c602c48a36683e6a04c220bde730d9153c36fed385
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH/F9:7UEtQevvqc2W1cpV20I32N9
TLSH
T159474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 797a6c1241dc8982e470db0e60a956ee2a36b9823cb1b0fcfd0a04d227469ba7
MD5 472e6172d868e327b68bdfcf2167c5c7
SHA1 ad7d640d7263fcf678a6fe1311de025a07b7f85b
SHA512 8c4336430c20184ce0cf6eec904bb29011c58db0040a0078e2bb8a9de085e587a3bc60b237923c99166f484eaf6166e36afbf27f8e550d5f44930ce9f4a9ab7e
SSDEEP 49152:mCbRquA/m2yL5zLfFiV+XenmE3/zDLNiXicJFFRGNzj3:Loq2Vjnmo7wRGpj3
TLSH
T15AD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8c1d771e03298ef068bd47740896a1eda24e5a783ca3403965ea007bbfaf8b57
MD5 823066d6ff08b7068c07ffa1f7120d9e
SHA1 6c2a892e5036d5a8a2deaff9b0bbd914a6528cdd
SHA512 bcccf446341ae46cb3c4a0bfb498ffcaee0d6f293d2b3a0ac222edf48b22217eac7497885a487561310003b1feacd72d12550fa9f780147dcd8c40915ddc5767
SSDEEP 24576:hAhGL6IFoiwtA5l7S53I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hAM5Foiq5YLNiXicJFFRGNzj3
TLSH
T166359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 692fe05ac80ef90414e5ddff95c04f778297ae69adf406cec86464e470fe6348
MD5 6b3e905ea18ead20f5709f70ef1ced85
SHA1 0d881ff0590e7805fc9d9d40b76fcd513b64043c
SHA512 efcc07e568ed4333ba1ce22af9c694bf6cbf667a1125df109851db266201268ea37bc505140ef7fec3591404d4e47b25f862fecc8921dfd0cd36cbfa34c94fdc
SSDEEP 24576:IwuROWw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IwSOnLNiXicJFFRGNzj3
TLSH
T10765F18632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8c275b962bda4889a6cb1694683ceda947d6a0cb4304198dc532bc7a8914ee88
MD5 bac69b442c04988af9d94ee22ca079dd
SHA1 c42035bd83d97cc0b545b567d324b25df9783a54
SHA512 579a04d2de6d737fa375601fc716b7b6b33a812edcb2aa92b4b295b2dec0abf4190e84762bf9ecc752e86ea800dbddd148a9f6ec11f16367f13ace53fb4001dd
SSDEEP 24576:oZu2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8LNiXicJFFRGNzj3
TLSH
T1A255129622C820F5E6BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 32b37a253ecbfc6fda048bd378b66bc99acf3343ec253ae82b6482eb460197a8
MD5 970c6385113360db18eb5dfc4c776243
SHA1 149d0a812abf55d5d790100e91d7ffcc0b6f571d
SHA512 e96a554591532e0f96794cb9830d9438a8d5934826f3d5c453045ef393ad05817c05a2198e417912a8c0af4c610855ab63647de2fa7afee3d5cafa5ce77d1448
SSDEEP 98304:MQRQyi36YOcPDLvw2gAf+PN3p7wRGpj3:TQyiKanX+PNNF9
TLSH
T126667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 793780f41b2a5f49ecb44082364889adcb4c9bc7c53d8f474c319b1d26b82bfc
MD5 69754a90eccf1d3cbd8c88311832b38b
SHA1 a69a28bd9597bfe7e49c60694b992cae9bcb2ac7
SHA512 02f084954e5c824ac07a7bd8e7fc4751c17649c319e091690ca4abfc854133bdee15fd0cf6ed3e3ebc839a3dfa193ba2baa83279834e435873b7b0061cb47cc0
SSDEEP 98304:WQRQyi36YOcPDLvw2gAf+PN3p7wRGpj3:dQyiKanX+PNNF9
TLSH
T149667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 584123bce528fb0f057bbb1f7b5d9efcb93974bec5cda2f0b25e305ae8b0e424
MD5 07cb87f15862761fc25d9cf9461fbbc8
SHA1 3419892e745753f86703bc7c13b5fdd8e05e5f80
SHA512 8337a0988c429bd9d11848e8d34db65c9206b2ff2fb7d2c1e98396b9ec868e22aa3dec1760ca65f9e2f72664becd41808f7b25e45c7ece49583ab2e7689f7fe8
SSDEEP 49152:W68Qg55nhkeWu7PNU3/zLNiXicJFFRGNzj3:0thTRc/z7wRGpj3
TLSH
T1DBB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d5d42722c2090035505f67a8371c522451a70a7a1ad77437e943c19f7560fd37
MD5 84fa99ef8ff25a21561a6346e2ce267f
SHA1 82db4f2c74f0c9cc98735747090564a1f9de79ca
SHA512 018ec97b8862c31d4f63e5fb8ec9eac5bf60758e3654187b41e66c24cee4f3318df0ad3788b00c40f63fb3bd4c05c2ee3b197190d60a041e3149eea35ae58962
SSDEEP 98304:gy5112gYy5azzVvU69nLKnhZq7wRGpj3:5LIHRWh8F9
TLSH
T150167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c71d1874ef3d44a065c04e92891d4e79e131fd7767a39a701fa8575c9b7ca251
MD5 ed8517324e09f41fe19796873452153f
SHA1 3c215838bafd7439afae3944bdad9206467d3353
SHA512 1fd7bb877534f1986f95106abc3e70df138fbdb1a5f343f40c324a4e9bccfa5cba56c19b6e3060681103327ac31a1620e000c118c72322279d441e4b2216a1cf
SSDEEP 49152:EB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gliLNiXicJFFRGNzj3:eu6JmIxd2di7wRGpj3
TLSH
T1EDD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5e6c752210d89d3fcb8cf0d8ad50055cca6cf21e4ece663ed8b157a9226da3c3
MD5 1b1eb14c9bf10a7aabcecc0d815b2303
SHA1 2c9e78af6f2d6dcbcaf7248a18fabd6ca2183586
SHA512 c5449b84bc5a8999a5868f3323f122faf2dfb1f7d0035d0ad7ee633b592dc21077f6b9de32baa3decda94c25f875f4ee0eccec5f2598ed7959940798c9fe2803
SSDEEP 49152:G1hpsNoJpF1A67U44CwH7R4x1LNiXicJFFRGNzj3:GmifPqRo7wRGpj3
TLSH
T1B1B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d8b790c826541b0119d8dc7f67df95e146316c2d4c73e92906e097fd3b155e9d
MD5 ee1473c0694ffe5db3df3d03a4819ea4
SHA1 8f920da87b179ba6d4603a0e8bbab966280024b5
SHA512 4cd8bc485734f5545a1b7de13643f793082e840d4be55b6847f4b79dbf10a85613b4d7195e9eb275539abe92c8d06f005decfbc31cea7da8bf55f3094d1a6372
SSDEEP 49152:3SuZQIY0Be2KkRVtOnks6NMHq2LNiXicJFFRGNzj3:t5dKqi6127wRGpj3
TLSH
T174C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ea7f16ee0aa8e2733a85d60b764f8a1c223c35b16c2cc6886e5d8e922ae134a1
MD5 4ff6cf76f5758c2ebd8bf1a698d223f2
SHA1 c76dbb3f6c1c4731eab80ea240f384aa53917ed3
SHA512 c8649aa5a5d0ab3b821fc30badf035045228c84a83d47863275324ecb860a4e19e7216eec90b149cbde873ead94d70f357ddbed94394877b5ea5bdf4c90778d9
SSDEEP 49152:IhtSn8EApI0figjgiDn0AP5whLNiXicJFFRGNzj3:ZX2iWphc7wRGpj3
TLSH
T1C295BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4d54e6725d4285c81d2075573175f1065085c4d2189c6e48be97f334a75ffa4f
MD5 583f9b943d5e16dbf368501581ed3dd1
SHA1 aab59d4fe81d08cedb847d0d5d3071441e96dc6d
SHA512 573431207da95d3e1f7ea6282f26b10ee552e3e6d11cbc577b5326d20a8519e7e2d9d6879c511da1c89f558f1dd4c998b1530b0a562c77e40d29ba79ae537d45
SSDEEP 12288:lAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1785523D3548955B1FAFC0039C6754428F5882E2DEB5618E3E3583D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e80eac307aaea568953c676611e5be4a63327690e1d2b7691432fa35f53663fc
MD5 5171b6793ff770ce698a959f68b4e892
SHA1 7d29ba1a972fb5618fed44af63d00228dd871830
SHA512 6111647e8255c7f0e0a4925c6ac033f83355e8549d94f81dff8edea408146ca73745c235fbf1457f55df943bb527f42218fbb102a536e266eb1d50d686513bed
SSDEEP 12288:oriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:o//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17B5523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 279223b169e929b1a7e6ddab03fcdbf8f2eab61caca5ab7d850eed6ecfadae3b
MD5 3fe04e2bc141a11964ee6142b0cbaa17
SHA1 175bc7965b6108d0610a2cf53f8b08d353004d5d
SHA512 3b4af9f55357598d0a14a3afae28f1b5f47520e80108bc09c8e23ab58cc286e3a4bc77b66c0d19080c0ceea71574f6a3ab0fcc3c939f4b87afb587df9e9b489c
SSDEEP 12288:0RiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A45523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c842830321a84bcbf484b1be0699783089dec52bed9af7e315381b8a19529985
MD5 2bc1bf9a3f6e277b1301e6f2bdc09643
SHA1 20e105ddc142608221d8dd277ffbc8b797323898
SHA512 3836e8798405abf87b6fc60630b2667b4ddfa6843a6f2036d8a0f339575103b2d5b2eb761d946c530646ad7ece7c0d7dc641f0d1bb88ec9864bdceb4b2658e44
SSDEEP 12288:JVeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13A552393168901F1E9FD8039CA764424F2A47D6CD7325AEBD3003D1E5A74FDA9F38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 27852b0de65c6a32db07d2a216b82dd3cdd01f8d0c22f8d0af8515676a497180
MD5 94c30e9ecb655a8671a672a892678283
SHA1 4ba900ecfb90e0baf3aaf69d0054f2b285f3b4ea
SHA512 2a744b9cb4857cc875010ebff0e3d40a85966e198b9a500969ebe9d380ed81ee497ab124bc03a5fe44b3a95168581c640f761edb6ce83ccd307856eb003cade9
SSDEEP 12288:j2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1845523D3548955B1FAFC0039C6764428F5882E2DDB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 bb356b867df76777e8b99ed63f02ebf1721eddfe56a2b4051a6f987623e4c242
MD5 7faa23536410b2a53344bed993f2eccc
SHA1 19f8717931f5e9f3e3eb7ead65f781781972b3dd
SHA512 2a55f12d3b462427ee53d41452dd3913820b01087fc92ca12c424b2eddac7ebd2bc57a679ec46178e426a0723611205a06b091f5e1605291b5ed414787f95ced
SSDEEP 12288:mfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B55523D3548955B1FABC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c627b8368d038bdba25921f4cd38da197caca2f899e66fc1e1e7d0727d0506d3
MD5 2aab63247aa46965eb66b884863f8cd5
SHA1 f91d26d7f0e6c3cf0fb05e0975bbdead7f6cb4a0
SHA512 da03b37159afc8c635b8ce59221f13c43f75eeb965596810b3517195ba0cd539fefe4f412779843c5e0ccd808b4847f1ff4e045b64fd6b33b82376ebad73e181
SSDEEP 12288:0DiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:03/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1545523D3548955B1FABC0039C6354428F5882E2DDB5659E3E3183D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 37e785a158706e7c7759803f4659dfdb3ccd67b0d9a2a077d20f50b3b893b2f6
MD5 80a66c8f436d95e08fd7d23a29731a79
SHA1 92edd2904ecc878a34db68cb5d1f8a892cf87389
SHA512 65f283369132f3ecf908c5abe5bbe9f249d34d133676682f1c5560965ad481b351d6a2e44f09eacc06115c2c54d47f31f32976543173e448a35526b9acd7da2d
SSDEEP 24576:hZM3zFVSOf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hZM3zfbLNiXicJFFRGNzj3
TLSH
T1A0750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8fbc8fe4cdaf2bcad4c29486e55f370d4dad528945a6adde9c27a8b5b2f8408b
MD5 c5837784d44862c7988102443b2b973e
SHA1 8971cfd0145dae2dfa24fe90fcc7a1d81eeb2cf3
SHA512 bebee406ea5737a86925bf94708274e75f64168546a74b61409a473952a473b201a0947345063e9d0a03dace7cfeb820625f2ff071492b5d65450d256379a645
SSDEEP 12288:kciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:km/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D55523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b7ab4c949c957ec718e994d9e8fe9934656012e0c22a3bccca69889d70e3cbdc
MD5 1206ee887c4c5f273ee703f1fb54cfd6
SHA1 2344217d4b70c57eea3c393f290474e971f83528
SHA512 ae483a97f04763d70da736027730b0b142c22ca8236c3d2c08edb8cd0aa3207f1ed429a2989bcd2cae5d47d8ea2c783266a1e74cb9da80748aa91f55a2a162fb
SSDEEP 12288:EoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ea/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A75523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 bc95bb1b2d9c4fe52472371bebd8aa58dc26182363be782f09684f0a90dc560f
MD5 3342bdd0f730262786329d0b23db0d2c
SHA1 0e0ab66095e0b471650048927362e51305c58ae8
SHA512 16293c80215c42cffde2c8f7102b5b2f32b1fb66e3673e8cc22cb24c08c9856b9c5610e5a389dfa9457583e0032820ce71b9e2318cae2a249d27240b0682ff10
SSDEEP 24576:KzyT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KcLNiXicJFFRGNzj3
TLSH
T1C2650247629530F9E17A8139C9620911F7717C3647208AEF53641B7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5d3e2bfaffceebc6270beb274cee8fb534e5846cb63dce8ee09e7dee6ffa6585
MD5 79f30f52d3b19a9f3c54498ff247918e
SHA1 0f18e62e91bfc4fa529d0112dc9e155aa55bf1b0
SHA512 adc7f6daa10cdfbe1b8ac40d601c7cda21eab8ccb93d33a93045f83951b3bd64188a1ba6c9b22a1f5fbb423a8b5290f9aaab1021f37497d4008f820fab5d4483
SSDEEP 12288:nciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1565523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4a2e1393c4bddef03d258409f5d23b43720b3aad7f1dd9a6638b27e4a3f9f7cf
MD5 7bdd2d0db8cf0570d581d1fbd5b10dff
SHA1 18d9c8d2c319a13decc596743c144773c1f1b357
SHA512 817152ff1ea1aa0b52ee679319eed92b2747fac3dbe3178c1202a17ab53124d107607ee8740d25b8393aaafb6f14c82aa1f1837a7e4a14ce84aa933f935f221f
SSDEEP 12288:1ciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C45523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 86247bbcebbffeec68bb1ccec3fdf394a39d6d7019e3d4aff9007801aee4dac0
MD5 3baa5f158619e81bcde52ef8561729ac
SHA1 4fb46c70cccf7e73a3008de2a128006a1962f662
SHA512 d5d567a19da410311a96eab2c8981c4e973e6b1628eadd6ac07a2db937cf07c19361b86cc7e2f8169266a2182b7f7b791cd11445921ddd6d03a0638c7df24be6
SSDEEP 24576:uzyT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ucLNiXicJFFRGNzj3
TLSH
T18E650247629530F9E17A4139C9620911F3717C3647208AEF53642B7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 343396fb03feeaa86dd8deaaf6a64f17abb6c22555a442625fdcb9587a4e0039
MD5 b2ba748ea6f12d6aea2a7e9f5fcd63c9
SHA1 c75a97e50ff3b12d4ed0c287bc49dc58ca1e1759
SHA512 947357afe1031a0862d0059debc1b242393d234c25704cef4576d8ccbc3143864bc980f5b1355c86de1c528e9e37676861743c4523c2c1e8973733d0c94b926e
SSDEEP 24576:UT8aLl3z0zDt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UT7Llj0LNiXicJFFRGNzj3
TLSH
T19F7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 698f693032f6acc1383a27535e9b4870e078d2a616d96c1a12bd3a30b15d344f
MD5 502ffaed72a548a22172300eeb32c33d
SHA1 38eb6f0a0dc0ca5b35bc6bf0f05925aa1d1b48eb
SHA512 478040997acffeff9cb4dd6f272309cf624ca5c2d0d3ba480750068079193f0045c6c6eb3250616530efb25e218b6b517ba73602f83ee4ca9e5e97ba9bb5d896
SSDEEP 24576:q3rd9CHKy7GZJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Mrd9CHKyabLNiXicJFFRGNzj3
TLSH
T1BE85CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 c59c2c8b1bee8fa3520372eece6b323734fe2d9b3e5ddc989724eac47671c8e7
MD5 21a2fabb7c5ec0e4f51597fdb2d66ce3
SHA1 1de00f85923d780f7d742b0cc28fe5958d8b9bef
SHA512 152dd2f430c72b63c567655567553485e328451a5cd8273637c28db5017698a4803d1c6f6968caebbfdcd2bda30da63b68bed98dd3444344be144f585782a047
SSDEEP 24576:Zfwvzk9RX6wkyAIK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YMnYIKLNiXicJFFRGNzj3
TLSH
T1F085DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1618adf4ff2be982dfde3a2c8300fb17bfcb84a561eb962d8b9db1bf18e59d47
MD5 444175140c837ee16d02a6e81c43d052
SHA1 d0052f5a97ad90f4e6cd5d7c28bfcd0e9f70da86
SHA512 b7469a38345c65364c7acc0c6bf41a016bcb6c6b9686d56b407bb6a811179fed68ac4972e435a588e37d068880ae14e7fca04cc63be581acfdfd53cdcc95b5f5
SSDEEP 49152:bYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0BLNiXicJFFRGN:mySzPJ7wRGpj3
TLSH
T145066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c8bf35d6fb24c56fd4af1b2da788099eeb4a61e4b198a03b80566c3c7227f142
MD5 ba48c124c02f1a7425353da65e6199f2
SHA1 1a48c35c955914bd2f99d9f3cc615beca8b426ea
SHA512 22aeb08d0e287b4be200727705cc89d3a7e5973a2dc92e80533655a3053a1141e8b68dc00409e92e42cf0951ebbdb7275eb1501e55fbc958b57b3b35c741c9c8
SSDEEP 24576:M47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:M47JUQjqirIhCnDHUPfF/xLNiXicJFFS
TLSH
T11A65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 fb0cde6c392b2ca5b78dad8ec127d0c11e8c149a592e909e5131bee1d1f0d24d
MD5 8523c20fc0e778016259a5eeb8b6f25d
SHA1 4d8add80089a0a53d20b9e7681462da9c4efc397
SHA512 2eff3193cc1acf81e354e6f527a79825fc36e2dcedf576ac56c868ceb5999949555daf57a9b20484684c078c2eda7f27db4eb51064f2789139f45e5a06d4f000
SSDEEP 12288:/psfMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:w2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AD65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 996KB
SHA256 11944d406bc91c8cdda584457e76b87525213ba59a94916e45fdbe794aebd965
MD5 47b24bc23f0bb043fcee893c31269062
SHA1 852ddb1cc7736576bc178d6d0b31e4a202356bd4
SHA512 5168022364f71f36577a1623851cf35961d8ea859a1c73b2ca0b7c570e103ccd87afd8cf35d1f60b33ef220134b294d82f2954baebdf33b168141f4b8d5602a7
SSDEEP 12288:deMN8mK6U3fal+0YkKvYchstWn2K7Nay8:dv6m1UPaZAhOWnT7
TLSH
T158250800762AD75FC6A980325E32D1CCAB707D41EE05AB0772C9873FD57666DBAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 97d02103c004f4aa463f8bc352d4e8f75a8b567da8c0895c7c30bf83fa8029a1
MD5 00cca2409a8605714ff8dd0946dc6535
SHA1 cb95f6d8390ca81f374cf07482f7678bacc6ddb2
SHA512 cb1368a4ef4916ea8a0370f7c9d180189a4327bcb8720600f60a84740dbdd602802812499f90e0f7c54fbf855146fad798b67aea0fdb5770ea091a74d9a9350b
SSDEEP 12288:PJr3L+5uCBWGhyp3dP7FJbCbRT3LNSpNnhnkg/VeeCQOeK54Rz:PJr3aXaRz
TLSH
T12665E6816137A3CFD1F76032072A5B4DAB74EC07B7495F2673C8453AD86A726A0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c6e759e5f96e067617ee12495b6df339b06284cc7a8d559acf058ad233c260c7
MD5 078d475f97ff60bc57ac42b4b898709e
SHA1 a152e787db0b3e385527b40bbbeb8377a1d3d0e0
SHA512 914434329e30e90b2cb2847b5261accc7549932eea0f753944c7fdfada5d9403863844c0ebfc255e528e73ae0d21c481226b3d1e4df346796f6e5b6399a8b65b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a79877a9b0c95aa48ff2808da2cb4872a309740ff2b35e67d1c4839cafadc040
MD5 1e9066ff6eeed8c16dd4b1e65f7978fd
SHA1 e72a9a4f0eb01411b6e0f126c0fc5b34837b43be
SHA512 8e4e7b728fa6929013c49465afd01eb540a7541722336abda89fb3d96b0d69a3835f689b53996e475e4e60676f154c582a7367d563a582ad0c0baae2ce764c7f
TLSH
T1ACD0112A32820AB8C02030330002AA0C0828C22B800A8000A828CA2EBE0A0A80E0B882
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Local State
Size 3KB
SHA256 f10176dbacf59959d9f502c1cdfce2d27864d9600ba9ae651d919dfbb56df240
MD5 6a89ac3a7c7ebc108645b9a2fd069646
SHA1 49f426f5b5f9ea7ec8498308d056c41b305e5d3b
SHA512 8bb015ccc9d6de6ceff6c8440e7bf2d1b94975fcdd315fd526dea1cc80a261b70c136fb961b188849f7a21c2dcac4ca9caadf0e32d2913f6802e5519afd564ec
TLSH
T1E571857B69A0E9378DE2C905BC852F56BBA1506AE6D13F95D9EC0F0C01D768C1353C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Local State
Size 3KB
SHA256 5030fc9459f92dfc1e35cea15dd317fe9e7d9a4ff4a172791ac45bf7710e28a3
MD5 be1339e4c588b64134d297176d593561
SHA1 4d7746d61f3d9db4d040ec445718f41610f865a5
SHA512 1408cfbd0374d709a6d929f61d2243cf873d8e04e9448185482d6737d72cbc276c8842ff0734cfb06129a9cf7c7b676888ae7baa2976cfee0b9db482b9913c1f
TLSH
T1C581947A68A0A93B8CE2C905B9863F17BAA0506BD6D13F95D9EC0F0C01DB29D1343827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Local State
Size 2KB
SHA256 caaefd6656b6caabdcad93cdcd7d3f0d2876cfa203edee71234f6be894c79a94
MD5 fd82f4b7bc54e36647343349bdd5694d
SHA1 3a574261a200bbe2a33435bc43dcc6e5d84aa428
SHA512 b4a8dbf7233c08977174e0a84ef0bf22e6bd64111a95a9b314fd39d1a14d048f64d7dd4a83ce9e9d649370be3543c00ae1acaac44dad8fd0cb060764a48b7bfa
TLSH
T10D5195376840AA3789E28A49BD4A7F67AE7550A99BA22F51AADC0B0C00D794D1307C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58fe8f.TMP

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Local State~RFe58fe8f.TMP
Size 1KB
SHA256 68aecc33914375b88eebeae1e83363c82a0a527a403ce30fed9018b60da82efb
MD5 5a7327bc388b6933b611a2922b59738e
SHA1 099999d71eaea4b07cd4756561327e00a6e6007d
SHA512 029a3726994b628d56b694584a4d96536805ac607172e97a3c44265782965900147531849373c3428f9e207cca8e187cb8c1ef7d704a77285866effea7d7a1fc
TLSH
T1493172BAA9D06A33ACC1954A7656BFE76E2040BE83D20F4074DC4A0C01E748D972BD36
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b515059312d10795a48669ef888366e7da3bc77ac7c42448a00e5f301ac77ce0
MD5 7390f609b8053060c36f28ae6e03b814
SHA1 eb0d04e6d0d1555ba42be0296adc7ba378008793
SHA512 a0a1e91f9410e781da31bbfd33cfdbee1ba2e1cd6d70137619fd200be56fef4c768a042d2ff88a4d1eef5428aabeeb203e38c97ad9a1ba146bc57f7b7a3429c7
SSDEEP 12288:IF7kiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:su/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17B5523A3468D59B1FAFD0039857A8434B5487E2C9F1594E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f1df9747ec75d7e1377314357920e48e18bcbf272c7fbfce6a8b0bd1cd96d750
MD5 edfab1a2b5625c48667d7648fdedba89
SHA1 1c1eaf643ace68616ad4daddc6d0c2fb3b8697d0
SHA512 a8637ca1f8799c8d392679992e743a54cb8f81762975b34113734d5e29844f01f395547bdc428c21f0cfb62e4489b47f0dd2ff0e103b49d4aa031e1e2d2087f6
SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bY0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Rgb4mBIBhGFPLNiXicJFFRGNzj3
TLSH
T12365AE1E22EC02F5E1F9D2B8CDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 2f7d6b033a2bd6a936693359b730563ffb6a4804ee6e0f5c877b578e35e20b01
MD5 2cca4065484591526a2de7196391c84d
SHA1 f4114577b1bb12fa8b6b99d2a6ba86d20ef7eb81
SHA512 34596c4bf095eb542d4759c2e378dabd082ed7f1aa20c49e3338f1ef9276ab612096c0734bcd5227a8f71fa378e6a9baea90921a18c5c4e9bebdf1214dcaea2a
SSDEEP 24576:SG88u8FpJqH1vzria7/mf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:J7ZFPqVya7/sLNiXicJFFRGNzj3
TLSH
T13985F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 267f196e4115b6665ddbc1029ccf7c4be12cc8a6fcb373f66bbe2d110977fb12
MD5 a7e57b3c75c72619a0269e42f13f1a86
SHA1 dab068964acba1cf16647efa633feef4adff669c
SHA512 d20b60bf98b78f13015065e4a1f1a71a778e6c3a91ac3f414790b6533352e8c3910bcd1914395b59b39ca1066d33376cc436661e0dd2a98a32032e69b91d678c
SSDEEP 24576:QPUr+NQb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QJQbLNiXicJFFRGNzj3
TLSH
T1F865F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7892a3b0859b398dd22d34759152f70e90eef89d8af19ebbc6572a04cfacba22
MD5 dac94e1cd7febf24d8f2a4a2463377a0
SHA1 a722dc93d6e33e682df983301e2f50a7c75740fa
SHA512 d30b7998d60f68a54b8990458cf1b5c32d59526632b43e56cb8452906b837742329ca8bdc9e64d085f8a7fb1c47291a8a22cfb6b8fb3589019280883d14a7872
SSDEEP 49152:MBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjrLNiXicJFFRGNzj3:vG05lO43bC7wRGpj3
TLSH
T12ED5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3207ea0d6347acbc7260d8b9b9db08b4515b7951601d28a82c8c8d93ad03e3dd
MD5 bfcf5ddfcb248224d4241c33aae63575
SHA1 3a6f26d5b2d17a287b866eebfc963c3696095cb3
SHA512 287acf48842a8979f9423b09696afc61fcf1a0cbf28647d433e3207f64d62b46250189d3f10e6d10a9554d608806f5e6579262bdf74b729cbd021e60df0218d8
SSDEEP 24576:ffa5POZ3dpyWVM50JicR2hG0lasx2+47eidnB/TwSfVcYG3K/cJHlnFR+IGNe8jg:na5POZ3lJt2pasx2+mzLNiXicJFFRGNf
TLSH
T16A65BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5939d60d34659f4487c50df4475eb0bfa619d1570be277b3c02cc7eaf5504b5b
MD5 035877a6767e2cedfec27d0e42263c79
SHA1 0e4062f36cf273ad7d0135aed9fbf05dd34c7280
SHA512 37f92c4d26afb2cc12584d51c19a2428ac0d29bdd8cc9b7d4c7c13f6387665d0af92ca4cb7ec1396b881e11bfdf253f74cdd6bfb489f620541c48b3b48315051
SSDEEP 24576:mNcwHdjbyQ4nLC18lb/EOjowL7FkH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mNc/zEOVHFMLNiXicJFFRGNzj3
TLSH
T140858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 19a5cb188029e1e4222532dedb89895d3d403420794a4212d59ad16c3d4aa862
MD5 4f7cbfef39acd08e27657cb86e868c4b
SHA1 6a794b5fb2194edbd00524e7482b39cc3ad27848
SHA512 3b844f94e7a16e9cf8e821ecde6152e87e4ff13e9a9fc6a8e6e8c2889d57798dfd15eb930b054ed19ffd531cc753a3790f1439d306e7ad1339fa9064cd977a18
SSDEEP 24576:vzkNvNnaFeYhJNtmZBmG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vzMwBtOmGLNiXicJFFRGNzj3
TLSH
T12655AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ec586d85fb0b6ee4c152424672f753ed7f7372952a143d8c15cee9cc1310c6b6
MD5 5e5918112f078b5790cd81798a6b92f4
SHA1 0a4e2364fde7cb6a3454cdcadadce899922ce822
SHA512 a145e14b81d4192ff001f6bbaf9b6c2f8e931b3694cd8214485e0e448f63476c464b2c17a3b950de73a0bdce16f89208b18a30ecd1ba006984d5ad5557143b7e
SSDEEP 24576:LD3FHshBIYQgAy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LDVHeBIAAyLNiXicJFFRGNzj3
TLSH
T1AF75E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-580-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/252-389-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/252-390-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/252-383-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/256-403-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/256-394-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/256-395-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/256-401-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/256-405-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1000-578-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1000-365-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1000-598-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1000-363-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1000-357-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1000-596-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1908-581-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1908-376-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1908-375-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1908-583-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1908-370-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1908-579-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3160-98-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3160-73-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3160-87-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3160-524-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3488-63-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3488-59-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3488-45-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3488-65-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3488-53-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4136-166-0x00007FFB171C0000-0x00007FFB171C1000-memory.dmp

Download

memory/4140-104-0x00007FFB171C0000-0x00007FFB171C1000-memory.dmp

Download

memory/4772-20-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4772-387-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4772-26-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4772-27-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4772-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4876-412-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4876-418-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4876-419-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4876-584-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5608-347-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5608-349-0x0000000000A90000-0x0000000000AF6000-memory.dmp

Download

memory/5608-353-0x0000000000A90000-0x0000000000AF6000-memory.dmp

Download

memory/5608-577-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5928-242-0x0000000140000000-0x000000014084C000-memory.dmp

Download

memory/5928-0-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/5928-9-0x0000000140000000-0x000000014084C000-memory.dmp

Download

memory/5928-6-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/6092-411-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6092-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6092-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6092-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6100-309-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/6100-301-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6100-574-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6100-303-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download