b62accd8da489a7ea30b0592e2e539b913ddc60019abd44b4e2b1d2eca904bc8

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
Size 7.9MB
Sample260802-kpllzaygrd
SHA256 b62accd8da489a7ea30b0592e2e539b913ddc60019abd44b4e2b1d2eca904bc8
MD5 4a9ce920a85bea01ed8d6c45ede1ba79
SHA1 0559c60a40e3b7c2e9fcf569337207b68b4b6a04
SHA512 90d41f74e730857338bbf2be20bccd0b78d172b21ed38c0004b02856a3b8737988e4c65ad32548f11fbb738982e71e0d272cbebef6d579a32d6a1e0f53e0eeda
SSDEEP 196608:ypgeBJWMMps3Uu/GktYdmLPVQ+02wjuMtDlR6H8UeaWF9:yBJW9RgH+9
TLSH
T101869D17A6B841E8D0A7D078C5569A57E7B13C46077097CF0290BA7A2F73BE19E7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion discovery persistence spyware stealer

Malware Config

Signatures

Detects executables referencing combination of virtualization drivers 2 IoCs

resource	yara_rule
behavioral2/memory/5916-9-0x0000000140000000-0x00000001407FE000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb
behavioral2/memory/5916-65-0x0000000140000000-0x00000001407FE000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe

Executes dropped EXE 11 IoCs

pid	Process
4536	elevation_service.exe
4908	elevation_service.exe
6236	maintenanceservice.exe
5940	OSE.EXE
3328	PerceptionSimulationService.exe
6556	perfhost.exe
2512	ReFsDedupSvc.exe
2788	SensorDataService.exe
948	ssh-agent.exe
3616	AgentService.exe
6412	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4c83aab957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d06f857e5b22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe5623815b22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018c94c7f5b22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c59b3be5b22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a35f1be5b22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c03bf67e5b22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de07d27f5b22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f646667f5b22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000bf1e6c7f5b22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4bae4be5b22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
4536	elevation_service.exe
4536	elevation_service.exe
4536	elevation_service.exe
4536	elevation_service.exe
4536	elevation_service.exe
4536	elevation_service.exe
4536	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	2512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2512	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3616	AgentService.exe
Token: 33	6412	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6412	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6412	SearchIndexer.exe
Token: SeDebugPrivilege	5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5916	2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4536	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6412 wrote to memory of 2652	6412	SearchIndexer.exe	101
PID 6412 wrote to memory of 6184	6412	SearchIndexer.exe	102
PID 6412 wrote to memory of 1040	6412	SearchIndexer.exe	103
PID 6412 wrote to memory of 4920	6412	SearchIndexer.exe	104
PID 6412 wrote to memory of 3400	6412	SearchIndexer.exe	109
PID 6412 wrote to memory of 3000	6412	SearchIndexer.exe	110
PID 6412 wrote to memory of 5224	6412	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_4a9ce920a85bea01ed8d6c45ede1ba79_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4908

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6236

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5940

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3328

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6556

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2788

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:948

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3616

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6412
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2652
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4920
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dbb932d45b23d3dcf07f9b03f1153fc133ebd3450fd35e38a3eee576a80d0b1c
MD5 698c382d3a0176e0346511f8282c8c03
SHA1 b2a1c8cbba99f5d2db25031ac6256fc9e4ee3824
SHA512 55fb9f52d7bcc80355d596331ab3eb2dfbb3f981118fbdefff8d9d6f422047ba6bb98d0f10789d07ccb4f2fb7c0ed00dbef19af10c9076329a5af99212a258f6
SSDEEP 49152:ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxn+LNiXicJFFRGNzj3:M3q6sjBx7wRGpj3
TLSH
T1D1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 42b8bf0d33523d0f57f50d5a3274adb1431e0aedf29e19aebb7bdd27847de1b3
MD5 046424b199822be47c588dde1ae8106b
SHA1 7311fe8d2d0f2e38abc5a41e758fe865029bd3fd
SHA512 79b85cd96b752783c9112ff5ed010646582176cbd7a666b7c09904103260b96362cb250553d1fcb03f3fc20c587e59a53762ae29d0efe61f1e5e444f17349fde
SSDEEP 24576:LXYfDtczAt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OtcELNiXicJFFRGNzj3
TLSH
T1F575012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 0e18d0b130c5b950ae87d13a68dd3a0f5c45a3ab915b9878e88764d689bd7194
MD5 3bccd7a04e893fe98dcaa62ca92a3206
SHA1 56146be05454250e1324e0af25bc0064e7f1d2f2
SHA512 5f2a700be3fbd3afe7ff7d1c2171a6a973703864405bcbaf938bf1f1387163de09128b25cb3689a8b81898d4bf87f3f876e3960a206fc28a9c7bf52d3ecb1487
SSDEEP 24576:60Le5ji0hmx8rM2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6Pji0AaXLNiXicJFFRGNzj3
TLSH
T13595AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0ada5b23b9062cfec12f7a9d12e8a772a0de81ecd2bc2cb334da95897c566848
MD5 ed4c7975f0c244a0413d5273babf8b43
SHA1 22391e773771c65e664295f5f471dd80e6e495fb
SHA512 8d7d5aa5da3fa37b8fd2060e4452f3c1e53b0dc9b8b66d11322fd3c9fdca7cdc6728f8af4acac45e157a95e455d89d04de9cb1f36d5712f0ed80bb3e04f897d8
SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWn6q8wyu0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:L/ezSC6vUzPveHjyzLNiXicJFFRGNzj3
TLSH
T134756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1dc01c49ab8f746fec5300a091477fd3648765a2c25bdf14e457978390b05932
MD5 205b8b080b5d947b4784f363d2fcb507
SHA1 326243e944853b424e65cf7386dfb442154b4b95
SHA512 c180bb8489ad6fdb8e1e4af0b68de22447d58935bf0b0f0d6936b07b71c568b551dde20429cabaa10e53bb1cae1299c3df3ca1be9f145b123cefa20a7a3a28a5
SSDEEP 24576:nVbqPb88hv/l+Yh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nVO88hXl+cLNiXicJFFRGNzj3
TLSH
T169559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 5d21f7e7c9a98725be586b87dbbbb0f158707b7c93cdb0f86c290555727f2636
MD5 7eaa057b11524064afbc3320aebcc86a
SHA1 1250ff7e331159e240f7f24bda047fd9b7aa143d
SHA512 688ecbaa1be7be8fe98a3b9182e8f3247a21240292d9b8552780017f06f4646d761c4eed1e16cb04a72be933014b56a6e0ac4d76bac4709d74d7e64b404583fa
SSDEEP 24576:kSq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2LNiXicJFFRGNzj3
TLSH
T1FD6523D3468854B1FBFD003A867A5828B5845E2CCA595DE2D2503E5EA17CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 392869ace5a6f69702b1fc843010fb966458e0514f7ff7bdcfe7b1b2f5f19f11
MD5 7cb4662b87fddba6e119064709849717
SHA1 6dd1c8ac48fa961b6799c96cdf931b737cfd5983
SHA512 3b56ebdddda4169484de53c524dddd2a73c1cebb1b3b061a450f9d79431c7af0657d52a0a30df9fd1733f67a437e372417b7ed4b73ca61ebfd737f69c2e57979
SSDEEP 24576:sJIU5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sJIU5LNiXicJFFRGNzj3
TLSH
T17485CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c7404b3504f4d485d21b8447815d7bc1db251aaa515586a4a82a15c71b507b54
MD5 39430e549882d11cbcf179756ebb5949
SHA1 b7f7847fc535b117c1c996e65248b6607671a91d
SHA512 904fec3f3921af1b55873c2256418bc0c697b4267e8832d6b428eac947dabfa4b44aaf2735185f39913ff0144d8457f0c885c7f93301773ada4f8acac3d3325d
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THZ:pQvGAdlCEL8c/DRNw5Ck7wRGpj3
TLSH
T1FC266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 e286db4b5389fdeab669a2bfca0b37a83342f83cc9c28c63eeb2020a5dcce152
MD5 afed1983a441dd9c002c275d4c034a0c
SHA1 a9cf7ed5f4bda4267bb2f95f2b07c387087dae32
SHA512 3395a2bdc68d678d99f50bf2896a5373b781d5fe500ea0a2995f705961c12bebe1aadfca99f2941a85c64e3c42b4c9af2d225dff3adb0e91a1a9a5404b947b74
SSDEEP 24576:8zewsAjH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KljHLNiXicJFFRGNzj3
TLSH
T14285E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 47cf1701286839d6eadf13bacdb9b384aabd621bc5e07f44e3d7e06dbdfda58c
MD5 d35bc254bc0d1b926ac2122290d40630
SHA1 85bfa56eea296c2eaf894764d1e36234c9e61928
SHA512 a85cf95462337ace6cbf9f0428f222df698604dd292698b633799f021975a0e6ce93accd2d46938662dc6bb033e6826723e6931554129d95f8225647fc4ee9f7
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHTF9:CUEtQevvqc2W1cpV2tI32R9
TLSH
T13A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 201456e83628e25d5cfc1f29ce2c016796516b7d815bf46467738443bcd61105
MD5 897cccff65390b09a71147ea3b020bda
SHA1 ba03fcb4444b603dd302a75eac3a28293adfde47
SHA512 69e25e6ee7372cf94d472515f0fe0bb548bf9d062035076f0c09577267dccaad19d617487debbed7e6abb0e63c96f3d06c7302f1bcbf9eb095bfbe5157eccb69
SSDEEP 49152:dCbRquA/m2yL5zifFiV+XenmE3/znLNiXicJFFRGNzj3:aoqHVjnmA7wRGpj3
TLSH
T1B5D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ca8956e4255f1d35b968af49ea8f06ed984b194e59078960dad974f8c1950d1c
MD5 1f94f3cc9df66341cdeca65253aa0b2b
SHA1 cce867b3f91c9e8682a5cb2712bea9414f39ac9a
SHA512 bac1f1d4c0aa02e5e71af93e3895000c5d725605e3c00816f29f3c44bb0a36bd0bb6176ecdc542da9ced94e44ff8d981fc203389aeeb41a4180d7ce3e0837c30
SSDEEP 24576:wAhGL3IFoiwtA5l7S53g/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wAMUFoiq5wLNiXicJFFRGNzj3
TLSH
T134359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 d86947b8600e98a0066e1527303c55e59b111275acbaaf57f260cf0aa266b537
MD5 c757b3eba2846ddcec4bcdbd4fa49dbd
SHA1 815bfe83488426cd31fa42f82e81beb774fcb1c2
SHA512 c9795353bfe43dcc4c880352bd1264dcf00fa1748597698662c7c75cd9dc7f60c55361c8b7a8c990423f1c482967c2ff1d27b643977b2d9cbe004e5132fc215e
SSDEEP 24576:KwufOWT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KwoOsLNiXicJFFRGNzj3
TLSH
T15175F18632940CF9E9BA41398657C036F7F2BC152A25DB5F4360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 c1cd198e7b166080a5af9c0cfb814ecbefcee10e6d37a4cb4d3f4b34b8129963
MD5 1e743305dd3b359f71e08a900329ec93
SHA1 2290a8e4346e9cc4769d006978d40eb785a22ffd
SHA512 bd8697a5a75efcd07d7b22be29838c8a1fe8350b22132509dca3d0fb45c2eeda0211421fd6add3701d799a819efa489d2a14119d388dcf8d2768a3804cfcc230
SSDEEP 24576:xZuu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JLNiXicJFFRGNzj3
TLSH
T1EE65129622D820F5E2BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 95d5a6ae74d23c2deed5180a7450ee9d8c4ba0c950b39aa9402a624c3f450fb0
MD5 ab77e22a7f940e4821d5ef6cba57fa09
SHA1 054a34974f4784a3525c8dff34770765d50c5ffc
SHA512 b0c4cca00f6fe832174498f8963d45534bfceabdbbdb1bafc5c0dab8d37666df0e4c7016cf3defa364ba8aa9cbcdefeddc9676760dbf053f73bfc83c177cefb7
SSDEEP 98304:MQRQyi36YOcPbLvw2gAf+PN3F7wRGpj3:TQyiKa/X+PNpF9
TLSH
T185667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fa9bed8b7321f01fb8b12214422ed79bad9da89479e8199f1bdeedcf979a9fec
MD5 f99f9e511cc05642f11b49997c8703ef
SHA1 62f1f98bd6ad7e5a2ef71001eab1e6c206538160
SHA512 2c3f3a0b570da683439ab8d87add0485e270c4a33c60c4f583616d8e71bb13330dc89e38abb202c123ab7f47682a2585fdf807e44d4326fc367eb26549504516
SSDEEP 98304:hQRQyi36YOcPbLvw2gAf+PN3F7wRGpj3:4QyiKa/X+PNpF9
TLSH
T14A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2677b569beff0498aaa28e9bed4b7937b19e9c2e7b90561ba20f190f3db13737
MD5 7da8bfda4e4a3c9e2ea7fcdf037f5cb5
SHA1 08849088a0996f9b56456663515ad133c4167a19
SHA512 90b28d199a0b764d9bc5013b0842d2d932d16d75b27b5f0bbe41adeadeedff964b0ad690a9f7d5812a2fd25e49459e5efc20a088a433de274e0369a60b44d419
SSDEEP 49152:F68Qg55nhceWu7PNU3/XLNiXicJFFRGNzj3:TthLRc/X7wRGpj3
TLSH
T138B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bb1e8e3cea7f9e4462efbff6a87f0304ac0dce0b5855ff47717a033cb8eb7755
MD5 b7f77d53cdd49ffa2e8db557985eac58
SHA1 694c679f5d9c41711d128cb812e60b2d70815e91
SHA512 09e41f447a37dd9845e977ee8b42121d5a096e61b70954eaec7f2d88233a4c47d417f99ad66b544916475cd05208f33b82697be5a086c33ecf2d1df701c179ba
SSDEEP 98304:oy5112gYy5azzVvt69nLKnhZq7wRGpj3:BLIHEWh0F9
TLSH
T17F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2e504daf58bdd0e6f081f2648fd4046fd7ff2f732bfcde7b30246b2ce2876835
MD5 df498033a7163c6489883010d0557811
SHA1 3d639a1d102802f8511d383cb4f0fbfc165313b8
SHA512 b148ca41646a51ac0caf849e22bae51aa2838650bd626665eb7d9d19108ef12a3629db992266017d0f960bf5b8cbd8d189bf1040a7412de22783392cedadfbe8
SSDEEP 49152:qB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl9LNiXicJFFRGNzj3:4u6Jmdxd2d97wRGpj3
TLSH
T1DFD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4c6b09f63946227fccaf34e942cfabe1b95c9e94be0a930e54a799c74ffff901
MD5 c89d03681487270192d034584f7f0ab1
SHA1 42cc637efb38c619715387963f81091b792ff863
SHA512 c2c676a7db5fadf518dcc05077b1a4ab147b8ee2f73d823c10ad330ac64f3ae6f5397df63a23d2f31567f8787564113a8e010fa9af7795904073e428ddb9bbbf
SSDEEP 49152:x1hpsNoJpF1A63U44CwH7R4xZLNiXicJFFRGNzj3:xmifPWRA7wRGpj3
TLSH
T187B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d494454a49831f577da34f30dff742a88a2a74657df129ea494e7c9d82466ff4
MD5 201ddeac3e5cf6a5131c0a9814f4c324
SHA1 2a9e691e6bbb87747c5fafd15257f6b8bda51875
SHA512 0032dfd320a9bf1c0fcff4acf1007cce6cb75719f9b0fcbc8d55cab24d84f857390a1ce432cf99b79262d91b1e2eb7e0c13ae97f393b9ac366dd44e4f927362e
SSDEEP 49152:6SuZQIY0Be2KcRVtOnks6NMHquLNiXicJFFRGNzj3:k5dKii61u7wRGpj3
TLSH
T16DC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 74ee6cdca9c0e700cd9739719020185e090f97b7b7a5fa46627170fd7b11bc8f
MD5 417b3fd31458c58e1ffd636e72df9bc8
SHA1 b9cec89fb249ed4b5fba1123da3b1c0a72060a7f
SHA512 c793f2ecaad3c7a8b6dfa07f9f44cd41e2d0933e2f5c0c1977b953d3cbe7815167e78c3ba6ad76215554b8fda590676446c2bab7afb70be109c31a3fc1f35d75
SSDEEP 49152:BhtSn8EApI0fig3giDn0AP5wtLNiXicJFFRGNzj3:QX2imphM7wRGpj3
TLSH
T19195BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 cd9315ad4cced5d2c15a234128bd6539eccd6acb41f9a17eb47f28be84fe4998
MD5 18acda6be09ae335da722d3d1bf8885c
SHA1 ed115e5ee6fc28d03673b5c5c29fb62301e34e3c
SHA512 a67f8e77b3b1bd80c6e6f4bf36e0d0dbad818d6aad43d72a9c8e2addf38a0b35598fecb0a42fcee877750fbb4cad05bc07eefb05f1601786127c6fcf34c746c6
SSDEEP 12288:lwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:li/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1226523D3548955B1F6FC003AC6754428F5882E2DEB5658E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 336c6211d15d89a51a88098e01089d8188fdf3aadd9ba4c4dab16aa06684b0d0
MD5 e623c64d34325871c3fa4171261fff6d
SHA1 f0d98b35d66c4013841f2ddf111b4204277ef2c2
SHA512 78a5a8da52cc623515ce532b01a26358b897d97e9edd7edbac7d2edc3c78c2c847898e164c24b3b17f0b00d7230beb8e3f6dfd235917fa08e3b22a5d4edd1e0e
SSDEEP 12288:ePiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:e7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1936523D3548955B1F6BC003AC6754428F5882E2DEB5658E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 b9c135de284b9f814d5e376f6a65b28dd80a3644ebcc73ff5aa6082cc21d8dc4
MD5 57bef03ea4be1bed494e100d44385ad2
SHA1 8ca241f1d92541bce7676a21bf8a03e5a3cbc5cd
SHA512 64b41e7f1d2e95e852be603ea6256bcf58bcd89f585cfcd003f123b957591307f92ddbe9c971bc4ffe5e87b90fa90d436c92a85cd516ec32960bbe45a7fc73c0
SSDEEP 12288:ytiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FD6523D2548955B1F6FC003AC6764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 2f811796b801f1bb50726c331bf9596f2ddfafa93c6edbe98690fa2f2d2658cd
MD5 3b292137f75f13cf8d49deaea6b44abd
SHA1 937f6bef6fc3702221f15cc25ca35eb50a4fdd32
SHA512 442f9f506e3d35efcc5fe14fb63a7e700afff54e4c4ce64aef4f35787b6b4b6412667f3b2cf73dc96e9f9a00bf27da30d908002e5783c78426a063e34e568706
SSDEEP 12288:vV2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CC652392168901F1E9FD8039C6764424F2A47D6CDB325AEBD3003D0E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 003ad272c5b8a830ad93926083a8bc027aeffa12759bb22df779d0a2e26fa806
MD5 d2dc1fa059260a0ff8b2100e9c8237b4
SHA1 0d323470c5412ac4ab98010de8f3e50dd9a48dbe
SHA512 4967acfefb954a7741181e239e6ff127669b9b7dd8703275e6d251b3cc014418a41978d1bf528ab3a33c2cbcdf66e753c58cc02d6a46cfaaabe9a99bdaf1ec82
SSDEEP 12288:c+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13F6523D3548955B1F6FC003AC6764428F5881E2DEB5658E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 4acbf7b5ca4ac7a6800341648775ce9986bfcfb75a7709dd877e535ced8481c3
MD5 a8d957f6281560ece7b57a8bfa86599e
SHA1 d3513f832e4c1e16a44619e44bde23d5cd6a233b
SHA512 b44cf516b787e5da3933c9a672fd1c49421b42f4badc27d67e7352e921b23ce452c2d22b6bdbf4e3d2d7351ca8e4e62c4cd6a4236c0195f2dc88914abc6529c8
SSDEEP 12288:0riJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1976523D2548955B1F6BC003AC6754428F5882E2DEB5658E3E3483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 721e0887645637ddb6f78cd8842879cfdee2513805c9725ab9989461373f760c
MD5 a3fbb19a95c0a0af87aa1b50d4010a79
SHA1 addd17252be02413b5baec1def54b321baa4d237
SHA512 9d2fed07dae7e727467b29593e40d81019740c98146308f9dd743ebf0556740df2abe6070978ca10aed31df8a729ea8580695e13070aeb6b070f522ad73f6471
SSDEEP 12288:zXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1426523D2548955B1F6BC003AC6354428F5882E2DEB5658E3E3483D1EE278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 ec3951edfe7e2d7280bc151a04137edc1c02ab9da1963d18f0a755d9eebb4f1d
MD5 f2fcea38375f88b0c3ea429856a6be94
SHA1 989c1cb1809b865c67bc77ec772aab7cd286cbe5
SHA512 e5cf4eac011fa2e7c673e1c3164b4c45885bd8e938da811f549c3531870c330774f3d60e221da7394713be097dd4a3e6e43f0a053e1031f10c26bb23f3563bb2
SSDEEP 24576:0ZMSzFVSOb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0ZMSzfvLNiXicJFFRGNzj3
TLSH
T1AF850295B39018F4ECB7813EC9258815E6B27C1A4B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 0dbf89890db4aed9dbaade6920ab89a8be0c7bbfa771da5201e55f4590ea2efe
MD5 54fef91cbc73959b403b247b18d52b08
SHA1 f6f36a0011ab8e6e39990ecff9bc12ed41ac8604
SHA512 d6e8985543f686001d485b98a78acf86920e5628caac642f99f991cf2366cd8d4118f5550ed30fb0f6ab061be19796581e34a47c6a80ce0c8ab15fe9e43ea2e2
SSDEEP 12288:b0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:be/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14F6523D3548955B1F6FC003AC6764428F5881E2DEB5658E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 e26f9e64fc2bfd991d2261143ec09dfb48af417df3e12a5300ce56d88c1d1247
MD5 79c867ea9d0e01b9f208165cda384727
SHA1 2370e4abe2537a0606c44eb2e628018420c90575
SHA512 43fb02e5ba62ba4d107bf10a5370be37c97e0c2bf3dd40e15ada25d9b62e7382cad99029129b799494c6afa71970039d4ddd60e31211874d601deea2263efe5e
SSDEEP 12288:foiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1706523D3548955B1FABC003AC6754428F5881E2DEB5659E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 658b90c375324734f93bfa9e7fe45fb518fcaebb5cfa3195a034400c16fddd70
MD5 09293b9c1f2ac64ebbb8ef512a5a7a53
SHA1 0d1ab7f6dcf6482e040bff8c62595084f88384cf
SHA512 d5153ffffed565933cff5aba9ae8d52f47cb5fbceca1badf74168f62ef42f637f7aa0f695dafbfdad9d3717a5a580a83224474c82b4ed03be522d7bca07b518a
SSDEEP 24576:Tzy3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TMLNiXicJFFRGNzj3
TLSH
T148750247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 627c9bc2b5e4974615f3c837e107e68710e454987adedf94a89544f7b9731a82
MD5 2b8621fced1dcbae2b84a0abf4a3c294
SHA1 35aaf8f578a7415d7493afa14a03d00e355dde7b
SHA512 dd65be553e1f11e412ae8f58aadd49ceb4b480f0af2dc0e7a3ac89e20c013e2611c60322a137f4595961aace7d701dd005d3e11a028b3bfa304de7566fc42699
SSDEEP 12288:s0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:se/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1586523D3548955B1F6FC0039C6764428F5881E2DEB5658E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 f5f6e588a4c673f396b367eb054b69a0bae114f0455cd80b38272662aa21380b
MD5 43f2b3f5265e089dd87e300d7b143fc5
SHA1 38fcdee3a22bb71fee01f853258abbb4b786d8b5
SHA512 9b340d28c90007914682f5a99d1b7538dc5e879e1281f927a675e7571566620c948a95cde8daeed95d52dfb2003a349c5df234535a41d4ca514d09428e10cfe7
SSDEEP 12288:M0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Me/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1726523D3548955B1F6FC003A86754428F5881E2DEB5658E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 5dbb1bb175f671c448bb7fdf7e113114e5473c7c2b51b8e65462262d01001fbe
MD5 7249cece2b296a59174e6cd2f1c39db7
SHA1 8ff4b82aaed7cbf3ace7d2af68739d933873e56d
SHA512 5c5871a626d21a8017e46afb9537b2cfcf5f070fca4fab4d4355a241fc071c7d08bbc579d0316b4e102a81c4ec2e846aa580d94be08be85ea7a5583561c16d36
SSDEEP 24576:tzy3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tMLNiXicJFFRGNzj3
TLSH
T191750147629530F9E17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 68452008d9c41e8ae3b4c360794ea11d116be65d865cd2695b5ee0a0ad094408
MD5 7417d97b400f59b846e97013c86196c5
SHA1 69c2bb33fd9d5e49ac1e8efbf0c271c1bbc8cb7f
SHA512 8d7da5da23052d10c9437f43249aef0c024190078d3dc5d04c98c662dd0ec067446a190858413e2fe20650ff549f8415ddbf2e49dd3ffca0d322a4b6c8ca50af
SSDEEP 24576:BT8aLl3z0zDB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BT7Llj0LNiXicJFFRGNzj3
TLSH
T1968502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 d7ff796a1d3b83e251a2428adf7e34c8fd4858c86dd932eb3da8aaf9a553eebc
MD5 61fcb0c481230ed113791000937d6f9e
SHA1 31cc6cb7603046f9a4fefd27831e68848ee3b2d6
SHA512 da6c178d5b57e04541a4bfc58f5c53ef2488c01fd2335e0529874c4992de9cc24f40f03a329580fa97adf4b8b5f5e40ecef4be6afefa10e805cee2bdc351f18d
SSDEEP 24576:B3Qd9CHKy7GZl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xQd9CHKyavLNiXicJFFRGNzj3
TLSH
T15195CE90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 7dfe30ee029737f29d9a1b9ea2bf4b3617dac8ae12a089b7f776a53dd69be9c9
MD5 5e172b2ac66f863b3d244946c88550c4
SHA1 76afc7327c03edb6283ea81c0c8cd0ac32c99bfc
SHA512 08524cea159143ed637098668228c9d7d888d73640b807a1e063ac4b6a18485aaf631432a0f5913d75421c74ee67a06483735fe3d381976ff4cc5b83547bcb6d
SSDEEP 12288:xNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1216523D2548955B1F6FC003AC6764428F5881E2DEB5658E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 b57109be667dbf862e644f5de8f97e62d77ff554c3fce21fdcafcd8b308555d8
MD5 418893da316a5023bcc842b21e052b1d
SHA1 912f41a235928c7b54acd8517b4587beec6917c6
SHA512 5e600c42c8ca1166923c9767500b4b828e7c9a0ac48e5fd3a22b5e018c2c96fb0b7687c928d3fccf99cab8e5996828fc186f7ea4ddb7fa1e7a91ab11cde11685
SSDEEP 12288:XjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:XX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14C6523D2548955F1F6BC003A86764428F5881E2DDB6658E3E3443D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 329473e415d2029dd94fd983f8000f52c47a7b23531f6bc050c5b1ec82c41015
MD5 1aa330174c3932cfc5cf7c41aedf75e9
SHA1 d1dcb702cbbf4590b66ccd001afa855730521f59
SHA512 1f4b43cc4fef60d42314ba745e4232ca5b3ea6b68e2b0cc21d1706354362fec59af264d67792ebd4ec0ac286f1ee969146ab7ef158365a56f08d7bde8bd81b16
SSDEEP 12288:4aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:48/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1116523D3548955B1F6FC003AC6754428F5882E2DEB5658E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 81cd63b85c6fb0fe3179cf317c0fb570976715e63cdf8c2efee3ff754226e535
MD5 904d17e2d493125ecfd02fd657c8f0a5
SHA1 143631729e1482535392290fdc37d3db3dc8cc53
SHA512 e0caae32ebb7875de937a2ad9d3e46e5c60b87537bcf6997ee58d365cc40243410d98780a8b8f3786fe471476c480d9109fc6cfd617da2a17ccf8ae0d7e85e03
SSDEEP 12288:n0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ne/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16B6523D3548955B1F6FC003A86754428F5882E2DEB5658E3E2483D1EA238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 9843a308b31d16a2a55e9528572b787ef5244c05f4163652b076f656c39ebe7a
MD5 a66c009544b21a57b76385b0ac3e6ecd
SHA1 c16780d7d423b2ba90803394332da5b371dc5f33
SHA512 d9894d049dd7f682a72d2e19c350869d568b6972802c7082990da0ebebc0ae58b2d9683d9bcd617e74098a5a8a2b115fdb829adddbec3ee355d2084b1d54fa07
SSDEEP 12288:VNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:VR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1736523D2548955B1F6FC003AC6764428F5881E2DEB5658E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 6366408067095e3dd6b86e3dd5317d38fa8a3e1cb94eefa6624c4c13c35b831e
MD5 2b6eeded6e0944ea27f3c1b2056cf63b
SHA1 e31399931f4cef8fd7a1c78c3df6adc0e8931d93
SHA512 79ad6806019b544d8db5163d8916ff974edb6bf1acc48a44eba59f4868b335459babed06303b5a35934f10573cb5a9910b0d607700bff9464eaf94273c98d266
SSDEEP 12288:08iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18A6523D2548955F1EAFC003AC6764428F5881E2DEB5659E3E3443D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 47a0f9b4f833c6db360b322e8189e7d13a76641fba0ccced1fdc0009b944eece
MD5 be56de5931d6febfad9af08919b9e3de
SHA1 c326ccf0ebf6c4c112e84e9b5be393ba6e68205a
SHA512 4370e9495311c0f04074176fe56b7acb864e03f0194f12c93b253bbb655ed6a60192c59ab9863fae4e9e01a69604d0586ba876f7b2d7ff616299f8ebeef67408
SSDEEP 12288:w+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13F6523D2548955B1F6FC003AC6764428F5881E2DEB5658E3E2483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 f86bb948b46308390cd301984c12527556047b6ca26f58c2d980d83c16ecf3c8
MD5 5040f4f2a1a66d6950410488e57512a9
SHA1 da0839dd6c0a367c1e2e2d01a5d6b5848abb20cc
SHA512 8e8c3bc1dbbecd54ce86f2cc5edc64cba2d5f031934c9950eaff73af416166c5cc23a0178c66957018635d476923fe17bd5b343f58998357211bafcf7a31517e
SSDEEP 24576:+fwvxk9RX6wkyAIK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DMnYIKLNiXicJFFRGNzj3
TLSH
T13195DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cabf6be181d050cf9bea14dbbffbb39fe64db175dd978fdeaab86d73889cb862
MD5 9beaa6a7218bda9f68163653d6227725
SHA1 f56ede7d331e8684a9297c354b0ec908ae3e7a4a
SHA512 c2945e0e61af40e142de651deeefdb39fead8607e82aca0997fb9b71d3eaa2653218880d5440f9af146a8ffa27f639668f0de1d51b587ffd729f3e6114a0d3fb
SSDEEP 49152:UYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0NLNiXicJFFRGN:jySzPl7wRGpj3
TLSH
T146066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6d20609a9e8e45d2e6c4d104d13c258e903178e548f57ddca4c594c295e38783
MD5 a9faddb5da2b3370af96de569003e29a
SHA1 79565c57a5569004661798b2af848cf236f278ea
SHA512 f732f2adca06c1c63540f738942c0607357bc264a8b687c4581c997470a8335d257eb46e88dafa53bb95db5e4b37032d30378983d5356a2f181f6ff113e1d697
SSDEEP 24576:L47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:L47JUQjTirIhCnDHUPfF/9LNiXicJFFS
TLSH
T1BB65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 47223a2badd0840e643f288f5176536270c38ec3bae56ec32fa939f32b1d8ddb
MD5 e71f4b7b80e8fd38738cf6610de708c5
SHA1 a983660e16cf10d13e5c1e3f283da3ed622a2bdf
SHA512 7ea69ca81c95664b4bc5d3e075adeaf407249b67a2765b75ddc9c1a158b628893da508fced404a1e7fcbc1f77fa569a99a615ebf135ead24590b2ae4554c1123
SSDEEP 12288:NosfkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Vu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17875F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 013bf0c8aef834fcb4f569640f1caba32b17860cedd36f2699c1d8a872aff5d6
MD5 1e5614d00724d7399ce16f742f7baf27
SHA1 0e5a87b13af72ff86bae27f92c6479f476965846
SHA512 815ff8e97e527457759ff66210f2bf22fce2a3bb2ec4cbe84c75a6f778c61151587eb940065a8fe63cb0ebac8838100e697e005b7a04779339f6cce038d300dc
SSDEEP 12288:n9Bq7U3f60Wyhm90AwR7mM7MtVWRL7fPRkpqeM7eA:n9s7UP2wR7r7MH4L7fZkpqeM7R
TLSH
T18E352911766AC64FC6AD40325E32D1CCA7707C01EE44AF0773C99B3FD576668BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 a5a30c3b6a77034e8e65e4016fc2727ff777177c24855418116ba2320729d30c
MD5 0966acecfb67c40d03f82aab64b20251
SHA1 9bbf74cdfb4fe095e61381a98ab5bd9259ea15ba
SHA512 6e003b6f79191aabf0261b7344df0ad4bcbf6f16044ac1c26b2d4a99ae5a078be98aab50769678b4c63f8d80dcef3c27079d14402b0582eb704845988b984dba
SSDEEP 6144:V3O+oqkksN6U6v6Q62JwFaCt69vaV5VUI1mfHvGZ+255uAtPptj9sPptMxTPptM0:VwgJCcJwm9yV5VHzeVEC7k
TLSH
T16A75FA81A537D3CFC0FA503207365B4CA764EC06B7496F26B388457AD86AB25B4F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 ef45dddbb9376ff22b37838471e317cb770b1f08ab7ea6f6c61c271d89ce9258
MD5 6d5445c435f38800ad3052e160986d43
SHA1 7b51c4bfa08680a6db120ae12cd5d44492b6b096
SHA512 6bac16362aa95a4ead5ba15b34d42b0cc9e876f0a2cd989908f6b29bd9dd480915203bbbcb5cb777b6ae726588f60a77da820453344d4b8decff03a31016f71d
SSDEEP 12288:Aq7siJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B56523A3568C59B1FAFD0039857A8434B5497E2C9F1594E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 466583472430307f155280bfd812fbc9ba4e83a72be9b75abaf7bb8512d2e219
MD5 2be28c61ee0349b42178a955df378889
SHA1 ec1addc6d16f222b1c9249f88336448dc89523fa
SHA512 79ee53e8212a02455361912782c4ab33a907fc7b9bdd1711c16a9fa51b2a5400bcab34285f41234440ac5131b6e8ac5809cbf1dcf684c88bdacd584c7bc8de4e
SSDEEP 24576:Fgb6bmBIi49WNNFpg1rSvFv7bY0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Fgb4mBIBhGFLLNiXicJFFRGNzj3
TLSH
T17665AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 c0b2988ddef80e0374e1578e193496585dbd702d6ba0da1e4c6d06505b7a2a81
MD5 40b88279e56304a4995393f293a6290b
SHA1 7487e7d563c0348966d30beb88d3700cfa465116
SHA512 f3b72c3aae87d99b5faab6e379862cfea47e83ab7dd34ee61af112c08bc99a98cfe1d276e7e5d60ba9deec3ce57c98ba619dae966d393622ec625cc7e93a82a4
SSDEEP 24576:BG88u8FpJqH1+zria7/mb/TwSfVcYG3K/cJHlnFR+IGNe8j3IzD:E7ZFPqV5a7/cLNiXicJFFRGNzj3
TLSH
T17695F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 278569016872011404172a566eeb7665d1b50bb1d97fbbd95bb16ebf1131827c
MD5 cdbf0f8eefe06c7cabbbe9f62ab65075
SHA1 73350f2911484f5a4be40ccf91932fd9c6c2ae57
SHA512 9d93a0c8577bad9ebe5c9fefc541890a8baa513a0dc70c48775e9af8458cfe650f39724c5c8ffc264a9ae4fbbbbde3bca21f2da3a74a961689959676810a10d7
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/LNiXicJFFRGNzj3:NG05lO43bS7wRGpj3
TLSH
T1B7D5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2aea57ae28b141d5c01307019890beb336a86a61da3d05b090724acbb3d407b6
MD5 3a9edcc70e41b18d8a20418d5e105114
SHA1 9fc11898fb54595dc2091bcae86cfd6171c13ce3
SHA512 2478b21dbb8a79a161310730181e88ccc208e888ee5cb38ecaaa896a8e217c3a25105b8ba37dc753f3f6a09e1076c2dd9866dd64a761fbb9f8350a4bba2dfcc7
SSDEEP 24576:Ifa5POZ3dpuWVM50JicR2hG0lasx2+47eidnN/TwSfVcYG3K/cJHlnFR+IGNe8jg:wa5POZ3BJt2pasx2+mXLNiXicJFFRGNf
TLSH
T18B65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 74b06d97204917461d144e22afa3523fe4fc86446a64db2b687ed30decb6fe0a
MD5 9b108e3eae216327edb2deaba68a226b
SHA1 985e3c3f3a1fb57702ff9bde49c9cd6c21c81dbe
SHA512 8872155062691f7910b18332a573b6369a79eba82d9750d6ef873acfe3ad19e8a069236576ee509c1ed3906f99856f13664e72c049e9e210c6e3071246b44301
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7Fkz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QNc/zEOVHF8LNiXicJFFRGNzj3
TLSH
T1AA858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 152fc4fdb1ee6351ba3b25dbb02da687400d4d34b4486d5d11cfc00032cfffe2
MD5 a9f8777b3d58abf3d8ee325a505bbb58
SHA1 c3eecf0d7c411fef69148d01fde9d5866477e5bd
SHA512 9037496bb34d2c140e157dbafce11bc89d23b5f79a3b6d566e05b81f6074c604597cce7280a5bb6042bf7497e94f1b3bd0daac106acebf5e4e572eb918f33a5c
SSDEEP 24576:ETkNvNnaFeYhJNtmZBmp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ETMwBtOmpLNiXicJFFRGNzj3
TLSH
T18855AF6EB6E806E4D1FEC675CD238512F6727861073292CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 fa6a853f6b37c518fb683f42c3b707f266cd70fa254347440489f48945ddc71e
MD5 6aef6bddb0f9bbd4be08143b67d8da58
SHA1 73d74313449fc806d4f1e244764bad940e927f0e
SHA512 c3660bab3c6ff9100c0477b1cbe98750f2b74f97aca867891e48360f875ff227c710980f8606cece8a1a9b0df5d7bfe85152f39466bb7d2c4bcbf727be2803d4
SSDEEP 24576:JPUr+NQv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JJQvLNiXicJFFRGNzj3
TLSH
T1A075F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 e2553d2f2b2778f87cacfe15a5f18fb966fd4da9978649b5959a455757257187
MD5 38cfd03c66a94979e3740e3f70e0c62a
SHA1 4a58b859735f800c56662f2a2ea50c782c9f3692
SHA512 953b6cf1ff0250173bb04373b514d512301ccd79f3c697518a4c58ece3c955e3d243611881a76d8fdbf72caedaef41c0d01089ad9e53a0b8f7a17680d9b27e95
SSDEEP 24576:ID3FHshBIYQgAC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IDVHeBIAACLNiXicJFFRGNzj3
TLSH
T1B785E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-121-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/948-113-0x0000000140000000-0x000000014020F000-memory.dmp

Download

memory/948-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/948-315-0x0000000140000000-0x000000014020F000-memory.dmp

Download

memory/2512-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2512-332-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2512-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2512-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2512-90-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2512-96-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2788-108-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2788-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2788-312-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2788-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2788-102-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2788-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3328-308-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/3328-67-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3328-74-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3328-73-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/3616-127-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3616-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3616-133-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3616-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3616-135-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4536-21-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4536-23-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4536-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4536-15-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4536-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4908-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4908-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4908-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4908-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4908-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5916-1-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5916-65-0x0000000140000000-0x00000001407FE000-memory.dmp

Download

memory/5916-6-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5916-9-0x0000000140000000-0x00000001407FE000-memory.dmp

Download

memory/5940-293-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/5940-54-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/5940-55-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5940-61-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6236-53-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/6236-50-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/6236-40-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/6236-46-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/6236-39-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/6412-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6412-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6412-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6412-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6556-84-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/6556-79-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/6556-78-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/6556-309-0x0000000000400000-0x0000000000567000-memory.dmp

Download