db68b760c6f2fd5566a84565968d5b0a6cceea67409261306ecebec74b38e06b

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.5MB
Sample260730-vgnrgace59
SHA256 db68b760c6f2fd5566a84565968d5b0a6cceea67409261306ecebec74b38e06b
MD5 cfe6db5778da5206be8ef67b5d5672f1
SHA1 43f4a678c6ea80ecfd5f22032a1556ad5c8f64ce
SHA512 f6021b133c8b60c5f26dc36e4f8b716b21aaf64ced2ca30a12570f5ab839ac672bf85f049d7990fb9ae1e6b30313c0d030acf477bedfa6639385316996d94010
SSDEEP 49152:whA6yeRc8pSXQWL6uLenMQQJbSOgMw+rUne9LWZdul9mZaiZ4Dy64X9/0Fx2Wd2r:4tgXJDNhc6+mgRP/XeN+1
TLSH
T1FC26390673F90399F1F7967896766606D972BC199B20D7CF02A0915A0E33BE08D7A733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5460	elevation_service.exe
4740	elevation_service.exe
5628	maintenanceservice.exe
3692	OSE.EXE
5804	PerceptionSimulationService.exe
4568	perfhost.exe
2264	ReFsDedupSvc.exe
1080	SensorDataService.exe
1516	ssh-agent.exe
2348	AgentService.exe
5708	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4c912e20e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000039e98ab4420dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083660aae4420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091c513aa4420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009eddbef54420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2348	AgentService.exe
Token: 33	5708	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5708	SearchIndexer.exe
Token: SeDebugPrivilege	796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	796	2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5460	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5708 wrote to memory of 5884	5708	SearchIndexer.exe	101
PID 5708 wrote to memory of 2360	5708	SearchIndexer.exe	102
PID 5708 wrote to memory of 5620	5708	SearchIndexer.exe	103
PID 5708 wrote to memory of 4104	5708	SearchIndexer.exe	104
PID 5708 wrote to memory of 5760	5708	SearchIndexer.exe	106
PID 5708 wrote to memory of 2244	5708	SearchIndexer.exe	107
PID 5708 wrote to memory of 1736	5708	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_cfe6db5778da5206be8ef67b5d5672f1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:796

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4740

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5628

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3692

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5804

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4568

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1080

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1516

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 724 2820 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5620
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2872 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4104
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 724 2820 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2872 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7f701001071838fca58dc1ecfd3f875cb71a87dab435c8ca64e59bc8a6ac6871
MD5 b4df5861614d07850bd08dcda33ede14
SHA1 701ac697d0b4ecd9d0405b5714fc067487feccfe
SHA512 61a66536dab42cb705aff0d58d219e0c87eac323b8d71378f6bad1ec60a928b4b8d873789ac3ad3c347968e9be9058c5b3825cf2836e1f5614d94aa0ed03dcd4
SSDEEP 49152:Pb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnc6mGvKVO+n1:N3q60jBHXeN+1
TLSH
T184D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4a4da5a72834b72cb29bcf147694bfdeae0ef11965d64ae265709fa66a026b52
MD5 e346763b2539960e36f0ccb780cefda7
SHA1 9475182a0f0215c64f09666fade501368dffdccd
SHA512 e1f376ea6f5bb118cdaeae63cedf18dad4f2ee3bfdd5d71839d974200e20f9c50fc39ae2794657ddd94148bf886e1946c4e0b7510d712c708bfdd48008414f0a
SSDEEP 12288:61XLsswWkxy2lRq2czAIUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:QXYfDtczAr6mctvE/BT76+1NCE
TLSH
T157050224779504F9ED6B4278C9A2C112EA737C9547A4E7CB03E4892A1F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 c92824c8e329f0f7014baa04601de5c84da5b32e7d551108d8e265589fd6bc59
MD5 c19f1e85372758d082ae8f78cc9cae2e
SHA1 70385aefc7a8638eb68404fda665bfebaad13452
SHA512 a10100769c7a891d080ff3c3bce2ab650f2078151cfac19cf6acf3654281f9cc6ef0cb45d81e4a9677d197c0c996216fdaf141fd4f2b16eb41f0eef2a81e0549
SSDEEP 12288:SXZNYVLeyUji0h90ZD0wxpGZIVuqrHs3UtM6hct28uP18WR/FW2Gb8JTCMMK7LIs:W0Le5ji0hmxNrMk6mctvE/BT76+1NCE
TLSH
T122359E16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4af17897cec9206d20bb068dbf923a975dfa14d92ecc842d3ee157a004efb5a1
MD5 d4731200ad71dcb815660d5bfbe60496
SHA1 ad531ecbea904a6e6cbae1e396066245c9aea26c
SHA512 30ae82ed44c397b43cdbfe2602f39ea0814847588e7853bcca543e8e2384555b8e07c49ed8c6e55aad8fe4fabc96c6516bec96416e4acbb9d0ce9e40126f5672
SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWr6q8wyui6mctvE/BT76+1NCE:2/ezSC6vUzPviHjyh6mGvKVO+n1
TLSH
T176755D15F5788323D0B2D0BAC5D6BA9AFE723086573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f47745d0467ea173d244c609fc663f85ea0f5102e6afec4cfe1b39a823b00983
MD5 7432400fb440b6f5b6a37a005ea90ac5
SHA1 fcd3708c8b83328be0219906d5a398b5750b9bf5
SHA512 3d34be671f44e0fc6667ce4f15943d126e06b496883dc5c293af94a62d336b0ece6efbee75f97003aba61dbf94bab3ce85b14683ebaff800b4a2f630281151d7
SSDEEP 12288:5VJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98UUtM6hct28uP18WR/FW2Gb8JTCI:5VbqPb88hv/l+b36mctvE/BT76+1NCE
TLSH
T12955AE66F5748331D073C0BAC5D2A69AEE3234425B318ACB1246D72C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 8af4e656eaf45b0c9f0cc899fd70bbf45b784f23a6eb294d4caaf1de1b476145
MD5 66de4f5d5f0c2c066a76b9e478dcef2b
SHA1 f165b2848b30b317ebae9f87f32f208ffb45a2d6
SHA512 0c3a223060da0412ac916f71d68f630302dee2021f7531c55d900d10dadc9d137701c61d80f5f63e1f9922261e135e499585d4dc086311a41ec9c00937e31807
SSDEEP 12288:IjDUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:IjQ6mctvE/BT76+1NCE
TLSH
T1EBC42382881B11D0EFFF07F16395E296E8516EF934DA1C81D322991F9D30162FD0BAA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 281d336beb0ab0171865808bc615db485920eb0542c545ee12a33eb2e5404ad4
MD5 d63c7721e0c2ef005cf458693b346dd8
SHA1 1d2dfce7acb2a94cc1ee65ab43277133a4cb96b5
SHA512 e5071c8ec3913ca9771b25ca7ff550e41240021fd0fa7a04231bb36e31f170e24c5c55e9f1d7f7b20b138f049f6d69e4115fa3f129bdd4efb7c8eb0716ad687f
SSDEEP 12288:eeBNUbTVO86UsUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:eJIU/6mctvE/BT76+1NCE
TLSH
T10605CF7BEE28FCD2C27E4DB85691C240E77278704B52A3CBD165820EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9bb53881aa3062e99cee2fa45ed315378426a8adaa9c9b9d861c3ba554180109
MD5 40e7a3149ddae0384afad51dbdd7b82c
SHA1 91a3dcbe8fb5016d6ff69a4f2d465eb75ecea150
SHA512 1eb8f49ff8a98a92ce5f0cdaa5458e9f1fc00d2c82e452c92992f0db1a8a1949d0e7287d51d5211a997614ce43c10f8d85f812d526eb56c0f7ee06f2d07c8bc2
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THh:UQvGAdlCEL8c/RRNw5CSXeN+1
TLSH
T10E267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 85ab7c1aacc3f8f15228677176964cd864a5fe3ce165b0328617c23a6b56337d
MD5 a9f8c13757fe6af2d4ce883dfeb33c98
SHA1 3b9e7add493e748bf0838f452de7272ce0b729b6
SHA512 a10f664c5136c8fe46f17278a27ef7bf86cc7563c7fbe3d428e5291fe524c1f31cf63ebb08c20cc6252b3c8bd734579de0e55f14e7ac0fbedd30ff53f86d0592
SSDEEP 12288:wAwSfxL/2Dc3DDLLmt0LDQewsAj2UtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ17:FSewsAjd6mctvE/BT76+1NCE
TLSH
T1B415E031FE75E036C7BF0DB21B26D316546C7A604B9219C3E3A88E9E59302D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d7589c5180b33e9c627e05a6890793c0f96c98fcb80acd2733052c6d0b53e4e5
MD5 d24c0f7f430a19100c7e1b27fa1c0897
SHA1 8e285cb7114b2c5df1e00b5ade93bdb5ba14b22b
SHA512 c18c47bbaa40b53ed66c849e15fe04961da19ed738122c32e85e50d5010b2ede138e2b1918cec0aa94f35891f773b6101a72dfd951ef2d820f67dc0397978b2a
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHVXeN:rUEtQevvqc2W1cpV2RI32Ve
TLSH
T114474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d93d83cafe32620940306a9d64ef993ca38ab7da630d08d39a10c8b469e33ac8
MD5 13d4f17c6a0da1d037fdaf59e7ef5ac1
SHA1 a5c6094875be81ff993819ed740828f29094e90a
SHA512 8bac6305cd1e78dbeb8ebeaf0a053a13471f2eff69853f7755d2366b08cca4e1bd8fafd56a53df80c47da6a87355a8d06e1163e52e1eacc108ca338d751e828a
SSDEEP 49152:/CbRquA/m2yL5zQfFiV+XenmE3/z96mGvKVO+n1:YoqtVjnmmXeN+1
TLSH
T143D58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d70210b4ab3114107048644cdeec0a6f0ee9b6ab595447ac9e24093e1928917d
MD5 4ec2ffee00556ecf81eb787d4cc3292f
SHA1 58f54e1f5fa6ee9973159496966a2fc9bc5981dd
SHA512 c027957b6c1fd0f537af2d54a10c0c1a747a843b06c1d64039958c0dd7d455111c9dee82204f6e8e034cfc4d72f06fa56dbf8fafba0cef5f61d36fdd54ab0f81
SSDEEP 24576:UAhGL2IFoiwtA5l7S53G6mctvE/BT76+1NCE:UAM1Foiq5W6mGvKVO+n1
TLSH
T19B359E81E7F951D4F5F3AAB899B69171EA76BCAA5E31C20F2150C11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 e23291e59788ef5afdc802598f77a5bcb9b84d7f68dabcb115050090bc02e4e5
MD5 9ea001ca8e356c2d5fa52d1e7c0de727
SHA1 f8a5fe42e865a8690b1afcded1210dbe7081571b
SHA512 d15adef577e8081f450bb264e5b95b8d80c102f573624c5e156f8b0e1eab8cc2f580b294211420a22c0af46cdc1c7c8a6b260d12af18024a5ff5f0a2ef205808
SSDEEP 12288:xmw5HEjsChNSBFgl0WDm+CJUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCr6:swuXOWB6mctvE/BT76+1NCE
TLSH
T1A005F14676A508F8E9A742788657C136F7F2BC513A25DB1F1360C61B6F33261BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 e6491a87fbb40fde71c7dfddde13b5b275aeef8100cd6418e03a404f375d565c
MD5 8fef81d901131ac2bdedaa184e2a5dcc
SHA1 f5a69ce14848bf72c7e979613ee7160ca6cddabd
SHA512 8aff2d8cdd9e202bc5ebefa140322c4dc69b8aece765c3260876ca915a93e81ea9af2ca6de593ebc055edb81039c017bc00410f41a981759d0f5914d4628b88b
SSDEEP 12288:T/Z1IymUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:7ZuM6mctvE/BT76+1NCE
TLSH
T192E41286226520F4E5E702B8C9E19245E77178E6377603CF5221466F6F33AD26D3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f21edc51559298a189104449706f0958c3539f7f16a0522c5b86bf93cf0f9cc9
MD5 159440bfd24877f4aecfdacc9e095cb8
SHA1 3f43097b5e56b10454e1e14c3aa39e41f2e55c3b
SHA512 a287822accf10f00706cef99ad3beb3e66c21078d3729238214b7d075009ecee067e940bd983d9f1fa9d4779966b4205023eb6b1084e05adfea6609a0cc915e0
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ut:oQRQyi36YOcPhLvw2gAf+PN3zXeN+1
TLSH
T15F667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 82f4d02d8f9b3c087667c95d2eb577276502de550b2f489939e767cb5855ecd0
MD5 d7a2d80e8e18748555bbb0289f659073
SHA1 249eeac6a2701080f57625f80196a46d581fb2be
SHA512 8cb32814fab60969aca612a97f492a923013ba65c3ef6c75ee0af46621c46a0ccf00c40e269b2b3cec01b35c893e75595086cd909fbfcf0f3ddc41159395d931
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ut:2QRQyi36YOcPhLvw2gAf+PN3zXeN+1
TLSH
T18B667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bbc4a63948d1f432965fefd55670280936089f20fdc02655d2086f007d6afab8
MD5 bbd0feb6fa4555700defa90a5be17d5a
SHA1 fc2d7c792b6ed2f3cd00f0b9081e3980162e8bcc
SHA512 10e759fbca9adefa6c95850763bd549bc4431c7be4cfc2b8f24b06f3bd00f1a850d2fdb88cc0f69b8a2d8d1114a008c8c90db7f44b93814f73bf1f2fc454c677
SSDEEP 24576:IwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0c6mctvE/BT76+13:O68Qg55nhceWu7PNU3/t6mGvKVO+n1
TLSH
T1D0B54933B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 80939b77d444ec8e72d7e8a7d27f347be34fbee76b6a936e965ec339ca5fed06
MD5 69c3e8df81a34c76bb8099a559e95139
SHA1 718c49833874b4db035773c861f854d9993fe17b
SHA512 48de79579e02ed7e7b24aab43a84320e8d25b239e13778affeec10a25c4f149f3b1b22fe040df0db706d901500fe65ae253606116810e25d7956f19f105d85f3
SSDEEP 49152:R3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99n:wy5112gYy5azzVva69nLKnhZQXeN+1
TLSH
T107167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3577dcc93855944f13bab1fa3ac57d1624bfd9ade8443e8d7e8d8e44b3d75310
MD5 89094894a6db69bec4d1c4c866bbe0d2
SHA1 e23dad2549bad8e43428175e7c7717d9d4f8a54b
SHA512 b8fed3b30adbc893939deb6b6ce2c2f6af5cb8486082f0cc5ad82f012e2f674be1fc56fb8458cc57eb7a00b47115074ad9c6b28945ea2c96187b8ef42b00a924
SSDEEP 49152:jB+taZ3usBWOBr4tEG20bqx0z+n217aau1gl76mGvKVO+n1:Vu6JmUxd2d7XeN+1
TLSH
T156D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9103928051633a2f6fb6fb0e2a8728ac4a5de23ac47cbc5e7498518d05140e47
MD5 bdd0766eaf53eb2505e89f1cf05dcaad
SHA1 7ba3151751ce6e12d3014d7c94ca976fc0251d60
SHA512 493f2eda7875804f9b278da9dad3e9f0bdb2b08bd4e64b8c9a9ec00018f9bf6645edcc7f3117f16fcd17b195ac8bddcb0ac0cce265b572df1eabea5939e606db
SSDEEP 49152:91hpsNoJpF1A6BU44CwH7R4xf6mGvKVO+n1:9mifPkRmXeN+1
TLSH
T1A0B5BE13F29900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 31c6a631c53a5878e3de23adece565c34cbbb7bd8bf33511f25f779e88614f75
MD5 1b102702a6ddc0a82adb81096bb20870
SHA1 1dd496433b92e5fc645c29490e12e4643ce020d9
SHA512 c8bef6e3d37c80751dd55803639c73f7cdca7293801123ecd5a46110d933e25e66eb5f5f4da9f8dc1d59d7f5f9052a72e6e25653070f261b0be6d07e6ceedac0
SSDEEP 49152:xSuZQIY0Be2KNRVtOnks6NMHqM6mGvKVO+n1:f5dKvi61MXeN+1
TLSH
T171C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ec021a8fc440eb6f9e6e55210e108f04ac723efe0de8eb69db26ff229a01a4cb
MD5 b1511c0f362787251a3562d1a3ae6093
SHA1 ced5edcc089bc0c4bcae2a1f1fb5174a27f6a902
SHA512 2cb1d59a7c7a2d6718905fab4e1b2daeceba7c3225b0d7dd83ca3e7bba5bf988eb10f30175034c13996fef8259cb3b60b5477e6c24d6606b0d5362256598fa65
SSDEEP 49152:XhtSn8EApI0figXgiDn0AP5wr6mGvKVO+n1:GX2iyphqXeN+1
TLSH
T1B695BE13F2D900E8D05ED174C7468632E962BC160B39AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 2c9c41a4d2d74de7eb25c3d8f04571b45a6ae0074a6697fed0404efb3b36dd71
MD5 2e2847917570fa3547a6e9ee52e6419c
SHA1 c899081f2a7de6c3d6c669da045e5572e4b41bb6
SHA512 681f2bb27675133c7f7f35b118ff7cd40fc45e2d756c9b602977addfdf8e5ee4d00fe20ec0247c4de205a9228e42e56b5612b56aa8d3b1d5b12c36ea7da731e7
SSDEEP 12288:67UtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:646mctvE/BT76+1NCE
TLSH
T100C42381981B01D4E9DF07F19395E29AE8502EFE74DB1881F316841FAE305A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 96730f89f80ddfb2086651fc9fc44cf4fadf0d388f90f9e3404ddbbded68933d
MD5 d016f26c33cc087dba8745e04e29dcc8
SHA1 6ab104ca60c37ccb82d6df112d19bf1aa344fd2b
SHA512 44761ceb5269afcaf60a491ecf36b1fcafa28b16ede5e2a215705b4badffe88843d350d5b31b2a4ad55fae5c5639c787fc44d79ab335040e1c463e064be031ae
SSDEEP 12288:vSUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:v56mctvE/BT76+1NCE
TLSH
T1F9C42381981B01D4E9DF07F15355E29AE8502EFE74DB1881F326841FAE705A27D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 fa2f16042d36ea14506d20c5dec73c4a59eda2c7a994a8337be1f60037ab33aa
MD5 4a82ea169ab619cc6e60f5575b02dcb5
SHA1 e1c706fffe7e2f105c5b244689e7cc96617b2c80
SHA512 704f42ef4f665ac0a856ccd1f61a5721c2ad09990c44210c0a1c7cb14487f29f59f8d5b6222c832baeaafa8f384ebae3c7e1954b490d17c6756312e3ad7b691c
SSDEEP 12288:HkUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:HH6mctvE/BT76+1NCE
TLSH
T1ABC42381981B01D4E9DF07F15395E29AE8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 c16871bfcf4d119b99219313ae3b1739d2a7a8258be082932bd212c103088268
MD5 c5c8acb7bee74893743a2d5c7e4f1a9b
SHA1 49bd49f2332dfa37307daaff6bc22b19ba4171d5
SHA512 18d621ab19b6778dec3d7d193e82f3096baa1240ef89223c44e5d5f82247c4522091205f7d495ead981595cbd3c532b07a659ee1ed1c5e7c5cf8f1c31af65ed5
SSDEEP 12288:jVtUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:k6mctvE/BT76+1NCE
TLSH
T108D42382692B01C0D8EB43F0C6A2D256E5B07DF975A719CBE311491F5E303A17D2AFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 73d6932385e1db3d98c7b67bab1bed3b5c26d6542135c78f1d6f82a85c6cdf05
MD5 b7f0d80a163970b8cf57bfb44ba96e33
SHA1 506e1677b008f3df99ca20c21bb52f2b5b5fdf8e
SHA512 df7ca7d994ed5da376ca86b80d730f6f60ba05df78ec734314933ab8a317f13fa0692aa5b4f13ed7499caa09234f6c524239a2b52f5f79f5e047295925baf643
SSDEEP 12288:SVUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:S+6mctvE/BT76+1NCE
TLSH
T155C42381981B01D4E9DF07F15395E29AE8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ff4096623c0579d2ce5ef5752a0953ed2f65ac361991bea9d49cb5cf606ce702
MD5 622f2f65177904165e8bbddbd8209ac6
SHA1 11b9faa78577867f99ed9529f873a8dd1ebb418b
SHA512 d094e6b34296e893da9354a62f1b3b4b8ca6af4455ee1cfdaf7d49bc9c1f47bb85eb66215726d80db12ea990e3da2f6d4962c94453e16b6c0c360e17a153683e
SSDEEP 12288:duUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:dF6mctvE/BT76+1NCE
TLSH
T158C42382981B01D4E9EF07F15355E29AE8502EFE74DB1881F326841FAE305627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 04676d5d39d88a017b5b5320be597ff27aad5e620003f196657a736b158aaf82
MD5 a42a97aeef838aaef5b1ee65f7b68e6f
SHA1 715edd78df20d9265e50f8ed4d5fa5cde0f20710
SHA512 75303d783f350fac5add54dca0ec4db92e631d9bde67669ed0dd977e133f27f1040d8bf169fd78328c66d47d3533970aba7475f738283f15d9612fbee58fb6c5
SSDEEP 12288:4aUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:4R6mctvE/BT76+1NCE
TLSH
T120C42382981B01D4E9EF07F15355E29AE8502EFE74DB1881F326841FAE701627D0BDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 b1c3e309481e4d86711670442ff68f726314068f7b4fceb7fcfe546eb55c7ee9
MD5 e73c5e7a28a823515807f4f2ae9e5156
SHA1 7f1fb40741f034aabcefc737c27c79527e81b872
SHA512 e5b6f0427067344b4e35c3a1f3d6d99b1412b41fef7f9645b2cdb0bfd2e6b5fc0bd8d1f66db79c6b2bd4cf66a56c3445569ee5278c8453b33cff48579041e658
SSDEEP 12288:OiZwbczzFEoS2cPvyyUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:xZMMzFVSOZ6mctvE/BT76+1NCE
TLSH
T1E4050295B35108F4ECA7427EC9558506D6B27CAA16B0C64F13B4362B5F333A11C3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 394ce4293614ecb2d7750bbcf1e6139775ff4deb396448e6cc966c08511f622a
MD5 bd06626a78d428cbd48ed01cb5ec2283
SHA1 1765ffc6cd425a84832f1254e9165027dccfd387
SHA512 387d905f34e51c704c5503d668f6a3c428f2cbd6909509f2e88e5cc5fa4ef1b1b52f20bba477a7f7caf610891a5d5418f23ea36445a299fbfb62a876adb21dee
SSDEEP 12288:+fUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:+86mctvE/BT76+1NCE
TLSH
T1A1C42382981B01D4E9EF07F15355E29AE8502EFE74DB1881F326851FAE305627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 24d355c680850ec098edf681842bea69c594f00605087e0a615aa5e52e0375e7
MD5 32cee6f5d8eff8f0b8d10443cd14483a
SHA1 ecf7de06758d8415257edbdd16b8ad93c18ba34d
SHA512 7db5310d0050913cb7c36dcc525c4533386fefdb140e4f09f84fe7ceb1e8de008a8cfef56a8177e56f92171a90e1e356c5bd85c18fefaa8ea386484b7c0fcde2
SSDEEP 12288:izUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:iA6mctvE/BT76+1NCE
TLSH
T1C3C42382981B01D4E9AF07F15355E29AE8502FFE74DB1881F326851FAE305627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 ce72c8f4fe9696fe91189e94d69eae9fcda08691eab848a9e966ef136b4afd9a
MD5 21d73123b7f818d1c0f43febdc91efc5
SHA1 d1e2a6d7c74c7312fac7cbd439674a07fabede52
SHA512 1c244af5a89451648c9657c9161c95ac0742ec4cbffe27ed0e7d57afcec3bb0338736c964ce913ff66ee5dc1ed20bcd951ea1cc3a28594ca6201192104b9c53a
SSDEEP 12288:uyPz5L8mUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:zzyN6mctvE/BT76+1NCE
TLSH
T1C2F40143726630F8D5BB4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 70d72628176706be2dadb48ff6f372f5bd16afa68e0f05ff4ef8e1e0a584023a
MD5 0bd350bba449183d267bcc170e063dd4
SHA1 64422f953cd78141e97ca3e1d86535abc4c9d1b6
SHA512 c06301ea43b6bc2ef2c128671f2af001f0c343768290ee7de6ae8718866c5d7727c1439e1e55dbc3153168214e9a9a1c2cb0bed5e96b841d1df2b9464701d267
SSDEEP 12288:+fUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:+86mctvE/BT76+1NCE
TLSH
T1AFC42382981B01D4E9EF07F15355E29AE8502EFE74DB18C1E326851FAE305627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 406caa66f36eeb2f6bdbb5b84b600e1a0d61485d53c7e93f243f4b62d62519f7
MD5 3d4aa73d00ab78701e607c612f95aaab
SHA1 04bd16c1e9f45f0417231bbde3f37b736958ab84
SHA512 8adb3cff18f17d25c44df2dc2df250675b08c299f93bf44c753449679b2289e23d158ed9b375f81eca176eaaa1d861bdb13f87ea702aac2577798eb46a12c829
SSDEEP 12288:qfUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:q86mctvE/BT76+1NCE
TLSH
T150C42382981B01D4E9EF07F15355E29AE8502EFE74DB18C1E326851FAE305627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 59afe02157636714428babe7227b95c13f501cf412b3f567cd7af0dbe488316d
MD5 b020a64b29066b2ff72e3c1293f95054
SHA1 b82b13a69c132e15cecc8ea5bfa9e62d710c9a35
SHA512 94ce0f65b80a043e032f024017a936ee7f3c8eec66372ef750ee77e4e31d6249afb255e7b5fb26158996a62e00d11225e3c4c93a93a56948fd93a272a55f1134
SSDEEP 12288:EyPz5L8mUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:dzyN6mctvE/BT76+1NCE
TLSH
T123F40143726630F8D5BB4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 65cbbac89237741da5d65ef33f5d35be941e40c72067d858efe7dece40e502e5
MD5 7b9913cb7128ca553b29b838f14c9444
SHA1 99f24ac5c675eb12087dcd4f0b111c84e3ccb1c7
SHA512 d1a717c5410fbb5a683f3c97d827139518ace3402fd67e6a519160631135c7b72dde882f352f0442572f3e39b7f987eb2cbdade4aba2ac77abc5f9094102ef7d
SSDEEP 12288:MCd9MWYoaLHF3z0z04PDvh0UtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCr6:VT9aLl3z0zDX6mctvE/BT76+1NCE
TLSH
T1C8050295B35118F8ECA7427EC9558506D6B27CAA1770C64F03B4362B5F333A11C2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 c1c4b1667254a004a99ed17f523a6d3e522ffb122f61677148460648da5767e1
MD5 8f99879078546f39fb8e5e2b6bed8f14
SHA1 255d67193005201dfc5cc16ae9b3e3effa14ead6
SHA512 7f3c6f51a4eb4b77cdb0da5d10aae1c22d2efa861efda79ee95a76651ade89de059ead37375d91d19786c30993a3cdbfa86ab4e7f8143304178d1e7a7b6ba119
SSDEEP 12288:vi4e7oRdTfgwCHKy7GLbbdIvRUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1Wrox:v3td9CHKy7GZT6mctvE/BT76+1NCE
TLSH
T13D25CF90F3E410E8F0B78A7589769112DAB67C9A1B71CE8F03A4651A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 b4420feb0e3bf9f454d94a48b1741ee1fefb18e0d93087d6cc1285857796eb00
MD5 2aaea55cbf73adab5599483b7fa2e883
SHA1 2955601097d54056566cee9217d33764ae0796bb
SHA512 a1f19df8ce4886df929d8a4d4cba9ace01cbb2f80749ac07002b5f98139023521318a949a5a7253f477413e46481898bcd48560134ecdda6eae8a3475dacefd0
SSDEEP 12288:TEUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Tn6mctvE/BT76+1NCE
TLSH
T1C4C42381981B01D4E9DF07F19355E29AE8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 3d3ec3f591489b8c44f2ed3a4d98ddca3e37bbc805644be09e1876cbe0e17f2d
MD5 24a222fac3b0048e530d0f069dfcf0c6
SHA1 3c000ae0b43802b100d63f887ed6c7dccfc82d05
SHA512 c9dac5e964866df3bd8288baeacda789a0f74835c57cbcb1a5e1bd89a9c7eac56d4d43582db691e9175273afd2344249b40948d7698a39abd10d744d77d5c3f2
SSDEEP 12288:XGUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Xt6mctvE/BT76+1NCE
TLSH
T19AC42381981B01D4E9EF07F15295E29AE8502FFE74DB1881F326841FAE705627D0BDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 9f5b0f8375ff5d0ce7a2b1d2e5ae7af84b9c6daae4f57bfea6c31c25da8e6f43
MD5 960ac69873794ddec6b7c3ab9563e1d5
SHA1 82eb0eeca0a44709ad8fd660327a350d2648847a
SHA512 ddb66da2a999b4620d9a657b8fb6b11db5bdc9e1c0f49e3e1e8f1da6fdb36ea13b94e970291aff3084b2fd7a8b8aab014c12e013f6ba10e21bb72fa0a03a88a0
SSDEEP 12288:JRUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Ja6mctvE/BT76+1NCE
TLSH
T1ABC42382981B01D4E9EF07F15355E29AE8502EFE74DB1881F326851FAE305627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 1193cf842c93860182625995c2d20750aaa324610b6cf8ecfa9594dc9935df59
MD5 cebd6ed5146aa92dc969158fa68c415d
SHA1 655be61fad4ee8112b006582e32d902cfea6b088
SHA512 86e3768a054a474b6d74d9b0a2d41c26c48ae5ddd5c18771635df70ff4c0481f9c60b3bb5ac7cdf66b9d9e7b252bb35fa4b012139a59ec12d3abc58022ea2183
SSDEEP 12288:6fUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:686mctvE/BT76+1NCE
TLSH
T18BC42382981B01D4E9EF07F15355E29AE8502EFE74DB1881F326851FAE305627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 1ab836502587f890f2201a6b22f3c3226971637270f96fb783194275bfc3acb1
MD5 1498867e5b8279ede4f1b6c4f4e7571a
SHA1 121ec3a9fa1f0d6a0ef97e381cec74af9497ea98
SHA512 490a31b7f3d02f4ee45b04dc40aa0c1965ee2b8ba76db23612dc6b53fa9be29ceab230988fad3d9c08add9574e4fbc00f3c36828c0d83af4ca61c3bc1ee16e11
SSDEEP 12288:LEUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Ln6mctvE/BT76+1NCE
TLSH
T109C42382981B01D5E9DF07F15255E29AE8502EFE74DB1881F326841FAE305A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 0fdac199f51436a79b98c409a616d704694049c5e72b4a6c2285c6978f01c5cb
MD5 d99399a0cf3df15b5324f57a51535b33
SHA1 8bd6042e1bf014bd3288f86ca5605092292dddaf
SHA512 631035927ca74f9ee349ed8253fd03e2e1590be7ba4736bc1a42e2eb5ccdfe47b1764de0e14038920eaad6ce156cad3611df3cfafd4783df970499819b8b6bb4
SSDEEP 12288:QHUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Q06mctvE/BT76+1NCE
TLSH
T150C42382981B01D4D9EF07F19395E296E8502FFE74DB1881F326851FAE305627D0BDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 46153f76740c53c6ad99a89a4e42e4e222362276d83db91cefeb1913b71904c5
MD5 0273b85cf03ad4325f8d2c49f440bb51
SHA1 47dfab324abcda8a86a57eb3b8e73363879ff59b
SHA512 aeae9a5f1117c108fcbf1515724e41e29ed57971b71b1e3db89836b553106efc480e54b24616faa1f96041422bb1d83c685314487e0015f18755aad777893354
SSDEEP 12288:dVUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:d+6mctvE/BT76+1NCE
TLSH
T110C42381981B01D4E9DF07F19355E29AE8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 4b89d764fedcae865b8f0ef75be5bb929f14fafaf87a3e420801f3bbfd2cc3df
MD5 4fda277de8a44465fe347f3789814d5c
SHA1 2a2033b4db6bb26cb226e933d00474740fce7edd
SHA512 5c16940bfe918f6212afa90938a7d5b1fe1e442cf8b35ec44b5c0c09c1279deaf79b0e81d7d009d4802bfd82e00ca1f56fbb0accd4583bf0a977a8e3db83f92a
SSDEEP 24576:Ffwvok9RX6wkyAIw6mctvE/BT76+1NCE:LMnYIw6mGvKVO+n1
TLSH
T14435D129EBDC04E5E1B7927C89B3420AF6B178691B31C6CF125A536E0E33ED45D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b909dbcc7a8d592a3738389ebd291ec056329889eea6699b6542ebf81250bca9
MD5 e889d351e100d62fbe8ee59b30847705
SHA1 f5245efa1ae088f7b0a9d3a82cf4c17284fc1751
SHA512 cef7dd52c1d6c20d6f6e3145d3e28a6cf844b5168bfac635bb5b2671686c818766f17a60e504ae48cb0e6db4c5ca5d71648b0887185d9b7f32ba6976ad14b0e3
SSDEEP 49152:3YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0L6mGvKVO+n1:hySzPTXeN+1
TLSH
T149067C96A16801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fb8bb8970cdefa305ce911fd4b5a3a474a3d63d8d5e309dd002b04e46e686be6
MD5 ab8811076abeacf896ed6f16f24b82aa
SHA1 e095733063d1d0769c35dbed9d243d65a3ceb9bd
SHA512 b4caa9528c2d5c611860a2242db5506bbbce4493b1b0f4edd4e156ec0f922afd7e57fcc7e628e29b1064a7d90fc777df01d0341c87bbd358d3682f507272aef1
SSDEEP 24576:k47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYJ6mctvE/BT76+1NCE:k47JUQj4irIhCnDHUPfF/76mGvKVO+n1
TLSH
T13765AE1EA3EC01E5E1BA92788515865AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 6ab5774051bd85c2dfbcbb0edfbbb3fee2de69dc06f6a7341f12fcdcd3e52d02
MD5 0b7883a821678d9001d66d9ceb74129a
SHA1 9dd44e3c75da33caf50bcb593662a13010e27d9b
SHA512 7c22b40f86b20a2baaeaed478df4027ab4501c79458835ec631ef87ede23108697040a051946a9eff42c0b9e9e6c7b7a0bee28dc48b3183d573af7fcf8a68868
SSDEEP 12288:9GsfvUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:3M6mctvE/BT76+1NCE
TLSH
T192E4F14AD25902E8C0AE12B5C7569241F7333CA597E293CB63D0F53E1F326906DEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 ff30c979a1036f9318458fcf1d3cc9e4651a9b1ab8d493840723f9fd33404c14
MD5 3c52a30b06dc174eee46e0629d5537c6
SHA1 81b4348d1f75acce461f3ef75a1a02d4b213e89b
SHA512 ecb9c424fd3f5715bdea4440456808fcd2da50091aeb6b896e8a06912419a7ec8322b58800b89792a5f5232f67e5395316904cb081cd4c9ac438f9676b091f8f
SSDEEP 12288:qM7XUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:HE6mctvE/BT76+1NCE
TLSH
T1CCD42382951F1184E9FF07F0529AD225E4157EF93B9A08C3F212851FA9305D1BD3BE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 812ee36387c8ed90807b46bc99206c982e99d9bba68861529bc9fb77816d1758
MD5 8c82f598ec7bceea786d1fb02a9589db
SHA1 218c1efcb341170520cca8344dbdca3e7fb6cde3
SHA512 9676d80b6d02ccef6e01ed85efb340862f6244add6f3dde37ce6063c75faca8c473dee23686e6899a22dc319a192cf4ad63eab60377fb2ea64732a8aef1a21b5
SSDEEP 24576:9Jgb6bmBIi49WNNFpg1rSvFv7bYi6mctvE/BT76+1NCE:Lgb4mBIBhGFJ6mGvKVO+n1
TLSH
T17A659E1E22EC02F5E0FAD2B8DDA64417D6B278161732D2DF1251422D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 706b90ac7a84751e7e797f57cdb830a746475eb4b9fab102f26de3891311fbdf
MD5 cbad1ea6dfd2a73b64c6afedd4922645
SHA1 cd12ae998416f5ade1c7ee789a890058930bb392
SHA512 0a1ae77490b1cda7da335ca7b94581872cb71e7029a368419be4e8af6625e2e5473e0a61c51369eb62efe7e4da358ef89ed83227c6e3e34f287451c51e1bce81
SSDEEP 24576:DG88u8FpJqH1Wzria7/mZ6mctvE/BT76+1NCE:y7ZFPqVha7/66mGvKVO+n1
TLSH
T12D35F16176E101F0D47BD1388A864263F6B1B8651364EFDF07A88A561F23AE54B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 5cc422f5ed5d6e28ccde279c6fa752c5e14d7fa24855d88c7e10a85f8a3f3ea5
MD5 ab67bd5381308c4a509179ec84178505
SHA1 2785ed8cb9cbe3882fd441a11ad61b5b1f0591e4
SHA512 6ac4d61d609dbdcd6aa30780c10ffadac8abeffca16f7584a84c773ae36bfc3986b86ebcca1b4af8ffd0e066f69d9f344705a7e75664439cedf5f58e18672e51
SSDEEP 12288:4HvUrBFrEjwaQeUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:4PUr+NQ16mctvE/BT76+1NCE
TLSH
T13105E21F65AD18E4E67AA17C85828319F77178A2175292CF02A1813F5F33DE8BD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4d0442b64482740cab1a05b6facf60549a8232eed3fd9a11d891cb8abcbf36fe
MD5 861b975c85c26fc467f4eec74f7ff118
SHA1 ba0b2ff54ed3dda509f8ee2c62c70f3e5d3212fd
SHA512 44b858ac54a7d391d7ac30529e076cd462f3b1327328babfa7997fec8c5011cbc41cea3ad33ff134b61294407e2aeca067794b92d82cdbcc2b9f8746e962d5a2
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjF6mGvKVO+n1:eG05lO43boXeN+1
TLSH
T10AD5C06A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 27e51fd6602c1237321421f797853dffdbfd2eb40ee9cee539ce4ad2e39ed141
MD5 aaf758b565c518c69dc761a8f0b1733d
SHA1 d0bd505ff02e02578f9778fbee5404841294684a
SHA512 9c1de451fa314368120fe3094ec4e81fd24383d394c40ae7c646bad1884236362fd83e3c24f8bfb68136ed93c38a633f8a46d693fac974fda40d4af9fa53209f
SSDEEP 24576:pfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnL6mctvE/BT76+1NCE:5a5POZ39Jt2pasx2+mt6mGvKVO+n1
TLSH
T17165BF5EA6FC01D5D5B9D17CC583861AF5B1346513329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 353b71698c84abb859c09e602287ec18bd70b64fc3151cf54f09b981d7d0717d
MD5 2afb32546204039cc686237ff29d9f56
SHA1 97cc2f90f4de72b9c995a72b012bf5470aa2a8fb
SHA512 ea0f79b07f4073fb68b01cba5c25e24ffb6ef4129fd7ebb62f079d64316da8830f35942bce5e917e385444394f91d545fe3aec8909e4e3f6af4c535ef7050178
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7Fkh6mctvE/BT76+1NCE:tNc/zEOVHFa6mGvKVO+n1
TLSH
T1D4858C1622E901E4F5BBE1BE89779546FA71786513308ACF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a10e97346906abb742b3d1d1848bb0d4212873b6b19ac9c22a3ab9adaa01fd18
MD5 1bfc0161dde046abc533fa449db160f8
SHA1 d234e24d889ff238410f63d6e04e2948d0985819
SHA512 a1989c3165a09a214f950beb49ebf15a0071fcaea89f26a6527e4065486d6e1fec496006277ac8453912992f7e069d7ca2cbd10564eb45c5302f6a0018f2a661
SSDEEP 24576:NtkNvNnaFeYhJNtmZBmv6mctvE/BT76+1NCE:NtMwBtOmv6mGvKVO+n1
TLSH
T1F055AF6EBAB806E4D1FEC6B4CD238112EA727461173252CB5390C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 1b2ff5b8b98d36e3573cac9d423fc4e952b2a13e4abda06dc03ed0ed9ec215fd
MD5 3e5ee78af1d0ab0cc1e6b268a6f3c464
SHA1 4305ba6d89e197181818e5ddea05df3a8e47d68e
SHA512 aeb0918d9672459d67a0e0023494d800e77261c7e0fcf2c4f4fad561426613e70b56641528ff894e97cf029a5712ee01fa40304d68a2d97e41ea586269ffa378
SSDEEP 12288:3QcMxWDXN1Dp/fshBItT1IQgAbUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WrC:PD3FHshBIYQgAY6mctvE/BT76+1NCE
TLSH
T15D25E17EEA5D00E4E57BC2BCD6638606E67138E9032255CB0294C1BA5F67EE47D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/796-1-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/796-87-0x0000000140000000-0x0000000140483000-memory.dmp

Download

memory/796-9-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/796-0-0x0000000140000000-0x0000000140483000-memory.dmp

Download

memory/1080-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1080-102-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1080-108-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1080-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1080-314-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1080-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1516-122-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1516-313-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1516-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2264-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2264-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2264-88-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2264-94-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2264-328-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2264-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2348-137-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2348-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2348-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2348-132-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2348-126-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3692-285-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3692-54-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3692-60-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3692-51-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4568-78-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/4568-83-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/4568-310-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4568-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4740-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4740-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4740-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4740-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4740-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5460-23-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5460-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5460-14-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5460-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5460-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5628-53-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5628-46-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5628-41-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5628-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5628-62-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5708-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5708-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5708-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5708-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5804-73-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5804-67-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5804-305-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5804-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download