0bd8cfe4b3de94cbfffc0e9748fc1bbd9a0c23f8442374a5fa1b0904aa21fb04

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Size 1.1MB
Sample260803-bas8tsaj5w
SHA256 0bd8cfe4b3de94cbfffc0e9748fc1bbd9a0c23f8442374a5fa1b0904aa21fb04
MD5 00e39f433c02f1c4e62643b25bd844f3
SHA1 8490d35f60d259dba7e8faffcad1a63818aa9793
SHA512 ea21d6554c15a025487ada739e5ba35064191085bde6f462d92640735c1060fabe3846d7769bd1aefc9d68287654c8d31795999f162fced6f47a072f90ad8df9
SSDEEP 24576:ZtV9xkSqGpFKP0/PetYPCL/ssBTiJQgnnGkh+:ZtB6s/Pu4KssoGL
TLSH
T13045D017E39210FDD06AC2798B569131FB72F8464770BAEF13A096362E27AD05F39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4736	elevation_service.exe
4316	elevation_service.exe
4116	maintenanceservice.exe
5032	OSE.EXE
2972	PerceptionSimulationService.exe
2820	perfhost.exe
908	ReFsDedupSvc.exe
2848	SensorDataService.exe
4272	ssh-agent.exe
5936	AgentService.exe
2860	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bd373428209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaws.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\java.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b25c2b07e322dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2370f07e322dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ed3a605e322dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed50fc05e322dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031d10008e322dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeBackupPrivilege	908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	908	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5936	AgentService.exe
Token: 33	2860	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2860	SearchIndexer.exe
Token: SeDebugPrivilege	1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	1780	2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	4736	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 3560	2860	SearchIndexer.exe	99
PID 2860 wrote to memory of 2428	2860	SearchIndexer.exe	100
PID 2860 wrote to memory of 5020	2860	SearchIndexer.exe	101
PID 2860 wrote to memory of 4320	2860	SearchIndexer.exe	102
PID 2860 wrote to memory of 5944	2860	SearchIndexer.exe	104
PID 2860 wrote to memory of 2188	2860	SearchIndexer.exe	105
PID 2860 wrote to memory of 1964	2860	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_00e39f433c02f1c4e62643b25bd844f3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4316

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4116

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5032

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2972

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2820

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2848

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4272

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5936

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3560
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2824 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4320
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2824 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2188
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9088e83cb3624973fa326d0c1ba05d58e153b2afec52ca380c75824914d2903a
MD5 147c93997fde45b685aa2ac4abbc5078
SHA1 2856ffc11b2931505f3fc11406949fc8c1c646ac
SHA512 66a73c7ff7e227b117b4d1385abee03e8a76b0d65b089a3a99b0a6b83223d192d720168e9ca300418e119a26e195f98b64f8943b3d444f1cdeaaefa81418f365
SSDEEP 49152:Xb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn2ssoGL:F3q6sjBqsoG
TLSH
T1FFD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 2522f4527bc45e7da0afe1377cbb296d6f48c2e3465556e319dde9015ea70dce
MD5 813a36497eea0c16f6d6fe9294f92694
SHA1 e203d73af0c612c12b77f6fe7fb082ec0394188d
SHA512 1198edb72f7cce85f2c435192d22b592b3ab7fb8ee7445ff2f90336e233fe33588ec014a74e2bfab760d007d995db3d189109d74b18761a7990bde72f8d71153
SSDEEP 12288:q1XLsswWkxy2lRq2czAxL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:gXYfDtczAxL/ssBTiJQgnnGkh+
TLSH
T15475022863D409F9EC6B8239CCA28511EA337C9147A0E6CB03E0967A5F337D45D3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 34155d56d321e9af5a11614bfeefa83375969a52ed918fcdaefc44bcf7f138ad
MD5 7d2dad45c57cd24cc9eee744c466a2f9
SHA1 25c101a2a61c505e4ff717a20dfb58ac13863764
SHA512 cf0da753f0c27c5894858d9a6d276ad3009b96695ddce66d7a0e523a2d650a838e4035493a910f8950db4bc9b8bfa1de1ecd4605865604ad76eebead4da699d1
SSDEEP 12288:sXZNYVLeyUji0h90ZD0wxpGZIVuCrHs+L/ssEOT9EhnJQB6fugoZrk9RAIx+Edcr:c0Le5ji0hmxxrM+L/ssBTiJQgnnGkh+
TLSH
T1E9859E26F6748331D073C1B9C5D2A69EED7130825B3089CB4286D77C7E67AE6893A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 16d744f98594eb7ebfa7d30735d1afee641b6c4c7acca57690afa43aaa51a45f
MD5 46b44bf5ba7948bb74b38bb2b30c2793
SHA1 6051a53329de5b002849d0b78b03be1996992f8b
SHA512 e730f041497cb88e6be3b990bd0927889db638a93c934dc81947e2222ef78f1f176598ee7cd0380bb694337fe09cf3dbb23a2ca4a777a1d45a25fed14a264e2b
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWn6q8wyu4L/ssBTiJQgnnGkh+:5/ezSC6vUzPveHjyfssoGL
TLSH
T1BE755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e32b6fd227f7a5e56d63a763f1d926e72eb37bcba427a6fe0e22cfd1640118d0
MD5 251c2bcf937e2370a53c9d18a0c2d119
SHA1 9a93e04b54836145166b67213137b29e46063896
SHA512 9220d329f35adb058652279486558e619a66550134bf3903e9cdeac2b60cdfed652d7bf968359483c0f52f034ff49531ffe2c4ecf7ff521f61d611534eebf15b
SSDEEP 12288:4VJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98FL/ssEOT9EhnJQB6fugoZrk9RAF:4VbqPb88hv/l+YFL/ssBTiJQgnnGkh+
TLSH
T192559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 16f8fafabf0388fee57f3225e9297774d338f738eb25c7c61d9172f82394c3fb
MD5 e48d18735b3c5febf3fbe68c2573cb94
SHA1 145fe9dc7d76510f8ce18827e5357f6e1906907e
SHA512 68c90e3f3e070d624ea98d1ba81158c3b3e5e0a79a01177dc54b30ad63d07ef441ca74dd4107fcf530be3f2ce80af62bcddf58d997a317cc65b299ddb7a8ab68
SSDEEP 12288:mLiL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:mLiL/ssBTiJQgnnGkh+
TLSH
T1105523A6C79C71F0EE9F07320DE6A518E615BED264C80451219037AEED369A3ECC764F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 204f64ea3b24babbe600700dad0fc1bc284bcc370eb77f34825a87bd6ea50725
MD5 7427efc4129d99799d1754f23c482694
SHA1 5171e56980bd2c66c3530f2182a83cc8577d4058
SHA512 f311cde5800b593bdbd422d929d09eab183a5d67b83921a62202dbf8757c46f90db2a819243465e60ae07400304f272d85a8764d244772b106a7811e0808ac9c
SSDEEP 12288:LeBNUbTVO86UNL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mYq:LJIUNL/ssBTiJQgnnGkh+K
TLSH
T1D475CF3BEE28FCE2C27E4DB95A918600E77278714B5193CBE164830EDE235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0848d3a4cfed1a1ed4d09787a184a0bc1d1e3a5943d6033eb85bbe072e59319b
MD5 ec922bfbd1b69769f62a4abd86bcda0d
SHA1 cb1c32925e7c1f61038cf706484d11c7c09c8dc7
SHA512 1b5c3a1fa3345626001314cec372bf254fa17cb7947292436c8f91fa1a8b276a1b6bfbaa0581beac0294f20f289fee8364f3e058bb869ef2a2682116d22234e5
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THd:tQvGAdlCEL8c/DRNw5CpsoG
TLSH
T114267C656BF880F5E0A7E134897AC6B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 89d448819e046763955d7b81fc6bc483f9430a188550da1d63e3dbd84c5ba715
MD5 77d4283ba87bf3e3466800666aad6877
SHA1 96d3d10ab82e3c09dd46a52845937e2222c2264b
SHA512 0344cbc5edce59cce8f5816b5876443e12574e4a79b0d2668b876cbe4a1811180c90a6a7b8fef8210be1638be0c9535c33144619abc7e3e914be868c9965e589
SSDEEP 12288:0AwSfxL/2Dc3RDLLmt0LDQewsAj3L/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttN:J0ewsAj3L/ssBTiJQgnnGkh+
TLSH
T1BB75E031FE74E032C7BF0DB21B36D716542DB9604B9119C3E3E85A9E99302D22776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0b82d8e6f87a2f98ff3be9fa953edc86cda373ef8fdac38758399f377952cfd6
MD5 ff4a769633ac71a228496685f8e12e9b
SHA1 f59d73fcd33672d2d1f7107aa7afbb6f4b627156
SHA512 ba32e715889b04d4f4d05b90eb54fe9781da4c7568783e79ad8a265b05b4c97c66f2051c7d35bfca78c42dc58dc3f5506c0f4e12533dd2a5b05d438a233b356e
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHgsn:QUEtQevvqc2W1cpV2tI32X
TLSH
T131474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 548f891c954fa909dc59a42210fe01b11d4f0fc839d3d7ed5d5c4afc06f8accc
MD5 e2db94b18f9ca384e1c072f81939bb6b
SHA1 7ef967e746245d19461ad39b002297cde7dc0dcd
SHA512 b4d2f65e8be6f33c10463052eabe4da7bfccfa358e8b9814d27fc56a1592538824c8c101eb19aab2b030fb6eab1884d4152b565b52516f774311217878eb8c11
SSDEEP 49152:kCbRquA/m2yL5zTfFiV+XenmE3/zLssoGL:toquVjnmlsoG
TLSH
T196D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c6f60dc17545b6f6a544256f75d55437a32ac527b2bbf6dac9769ee3628157d8
MD5 7acd7cfd7c1f09a2de5c4fd5465078ee
SHA1 f29174278cd02d4b831965e06e8a05578059377f
SHA512 8e5bdaa2ef1656935fdfe583f067ceb67719dd82178582d3f68077e6c56a30255df44f4d915cbd23d7a1c48ae39644fd76eaab7f9d922ab416a41e0c6e6f9b38
SSDEEP 24576:YAhGL3IFoiwtA5l7S53UL/ssBTiJQgnnGkh+:YAMUFoiq50ssoGL
TLSH
T1D9359D81EBF955D4F5B3AA7899B69170EA76BCA65E30C20F2150D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 33332a9bcacf0ea68c9d8600162f9cba887a6d1a097a1b1b71925e3b10e0a175
MD5 2a0f14858029f0159de4e1520d3cc2f2
SHA1 6cf24a7d40ac836f1d490e8089cc8e1e7359f0d1
SHA512 f4ceedf70d096ce97c5f03840a727d07e4ce295a7fcf3367b8f6fbbd9bbba592479cd324ab2740c345fbe262b2ee92877a860706a53cf0d2c044bc2e6487b557
SSDEEP 12288:Qmw5HEjsChNVBFgl0WDm+CYL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5J:Nwu4OWTL/ssBTiJQgnnGkh+
TLSH
T17865F14667E81CF9E96742398597C135F7B2BC022A64C71F1360C75BAF37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c87d3129c528f92a1c2d391c9e4fe0ae9a430ce8c88e6373aa61f639539c407f
MD5 63a5d35709820828bfff9a4d60e81a6a
SHA1 a028b0bbdcf77a6adc1f44aa72326ca1223baf8b
SHA512 b576e0868389f1e6673dff3c776c01f16d6c88d315f946e52cebb5e6b4b8a3f535c7f5915b5e2e42438826e5d5557f9c4f629c30f107dc93ba83d0e6acfc866e
SSDEEP 12288:reZ1IynL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:KZumL/ssBTiJQgnnGkh+
TLSH
T17055129A23E831F5E59B43358DE15605E7727C92237403CF226053AEAF33AD25C7A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b86eaf561862ad6ff2d43a09e5605a5d337976ff1ee655e9178ebb231d53054e
MD5 ad5396008d7526802cd5a6254eb81c13
SHA1 a24869fff3480d18549cd1bb7e1ff2cd3d06b2cb
SHA512 b9c3e4d4ff27a2683a65ddd878774ea7639096243d81e67838eaea1002ce834672ed54e8a308fff6e066c886d90a57895d6ac41b9f9576d89712533e162f3456
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uh:aQRQyi36YOcPbLvw2gAf+PN3+soG
TLSH
T18A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 def654a2bd573f191fcff96b31be8ded708ba1bfb5626f74749c1bb6f3f87480
MD5 8937b4bfe6cf9c4b6d848e75acfeca55
SHA1 837b0ddab207caff7394523686bd95641093d772
SHA512 cebe37114579045be419ba50c3f05f7af3b9762089bddfe15852a239e6e0d1dbd593e3483bee60705a42ac7ec6ad111be87e5104be0189a9235a84d63bbdc82d
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uh:QQRQyi36YOcPbLvw2gAf+PN3+soG
TLSH
T182667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 dadf5158227122fe27aa1a335207e1871081039af68fe96a73ba5160bb3316b2
MD5 414b24b24c4b2652e5d13e61903e2a00
SHA1 284d5f0155697eea1610cfb257591519158d3b5d
SHA512 f05be70c3761e92a80f1d580c5f51a5599f6eae45867382d967b78f9d256aa2ffeb37296d18ae418dd7eb16618543298739cf7788404783b12dd413cb7f8f93a
SSDEEP 24576:iwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL02L/ssBTiJQgnnGL:c68Qg55nhceWu7PNU3/7ssoGL
TLSH
T102B54933B2F600A9C44DD1769F4A972196D27C718FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 03815435bfe210a11bebe01427fff080c9ae6e928f8de395ab293210fbcba626
MD5 3a6d19de20df1121a31367a473ad9e66
SHA1 5948a6cae68036a5ffc055bc409e65d1a68bd944
SHA512 e814a22757afefcdaba30f9c70069e5ad4f5db42c2a3bd3a7d8055d03ee2eb55e73fed35f5ab8b4e02f945e15728eb7ee259fdd7af205fab475f07d421b0f67a
SSDEEP 49152:t3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99z:8y5112gYy5azzVvt69nLKnhZHsoG
TLSH
T122167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d6f074695a24277bcf265d11b7cfd03452aba6e7b4b22e787c0767edc6a91597
MD5 bae3115db647cec34abfe3ec9e9d9b6e
SHA1 ff87092fdb1814696280952ea5eaefd4e5c4d5e4
SHA512 074db6c227977c597072c2c48302158598800556a03c0e8a5c0a6caacb84cb7d157cd7449c6ee50b36f7d1fdfe7209f40182c52871caebdd5cefa20141842716
SSDEEP 49152:aB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glNssoGL:Iu6Jmdxd2d2soG
TLSH
T1B4D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 00d113c56ed4dc1f13678f20bf3c2e6e6ac6adca41d082a94ba5db59e1f505cb
MD5 437c4814cdd945c936510dba6c254cb4
SHA1 450bf8c70cde740659da37b20a64439cd7add51b
SHA512 520aca7a7bd1fae914a1edd15eb1a3aa047599ce311aa5baa54e69fe62f220c73da8aa68ef14d184578c70a728a7e544467e9cbb8f75a2459204411b1c74608d
SSDEEP 24576:Bhv8E1hps0+ogd2z615uCMVF1Agz6gUQ1zNOgLLwH7ReaQXx3dL/ssBTiJQgnnGL:z1hpsNoJpF1A63U44CwH7R4xBssoGL
TLSH
T11BB5AE13F2D901E8D05EC17887569232EA62BC460B34B6DF0A90B7961F7BAE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 464b4f1d3b7b0c956e18f6ec31a530a5ec0452483ce4ea4cccab4dce8741b067
MD5 357bd3532518f72b5ba6055ce5bf994b
SHA1 804210bf68582643e74e20d638e1b353fbb7c8d8
SHA512 624deeebef9eb9e5ee783b30d613d7113a37da222113a2e64d6a6ee2e86a3aa0266c87182b0dd7815ea68b17ed100697235d9d693f01a3b08e0ffab82d65b035
SSDEEP 24576:O4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6vR04FxGgVG2Onks6xt4bSMHnqmL/ssBTd:SSuZQIY0Be2KcRVtOnks6NMHqmssoGL
TLSH
T138C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b03cdef3adc08be3ccebc0d1b16ef9929342e1a38253de9b3ff744e32215192d
MD5 6b68785c775005df3910b942363fbb4f
SHA1 36fade523d90e3b168f9b9dac23cb676f762e612
SHA512 8bd654dfbb04f206e705ac0a39dbdc22a55de863f9e3180bd71bf5e78e6ab7fa947a4ff311d3fff932408676e565dcad1b1cfeb9b601ae68e25c4caecc0d8639
SSDEEP 24576:thiavrPSLT8EARn+FgyUgd0fJY6B3i3iy9CTn0AP5+2QLdL/ssBTiJQgnnGkh+:thtSn8EApI0fig3giDn0AP5w9ssoGL
TLSH
T13595BE13F2D901E8D05ED174C7568632EA62BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e9323e5e7e1c78da784c18075a5ecd3b9eb4a49bc6f32bf648c509467de7f5cf
MD5 ffc982c44bc0f3736f2b59e7ed8504b8
SHA1 1ac1c0c5c46daae8ddf3c8c1a35f73eaadbc535c
SHA512 20ff1b096baa8e29eae296ea0bab8d5b9b874226b3674bcac1f53b4647380989ecbffed8d3d54f00e4496971b96fb8a23295f0f0602653162c65593d6924d7e3
SSDEEP 12288:vKL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:vKL/ssBTiJQgnnGkh+
TLSH
T1C8552366C6DD62E1E94F03724DA2A258E5157ED374C800913280326EFE779A3ACC769E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 109d56c3f7d70dccbfc065281cbf2d97729484e456a66751348ab7346fa7ac6d
MD5 9620065b2be38d608e7cc60046e25a57
SHA1 790ff45cf91bea5eedd34b7c0ce25f5e10718934
SHA512 6379f220c97d232c21e3e4dee15d9b62f0f75ae5f70b8dc68f70017fa41dad0e2944888160b9989ffb6bd87b649e94342a4879f73530ffb3a5bd29e44951c06f
SSDEEP 12288:1rL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:1rL/ssBTiJQgnnGkh+
TLSH
T114552366C6DD62F1E94F03720DA6A258E5157ED374C800913280326FFE769A3ACC769F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6c4613c67734c4fb9d4c9ebfb21e6df9da80216beb1921df5739afd67129f256
MD5 7a70ce79e9f0606e3eaf6af04355ee5e
SHA1 8284b75c781262be3318b22df7bd31e5d03e7ed0
SHA512 7f16837bd5b9dfba85f5233c637a63f0ba814ae98b9c42faf5a0438dde0afc7c1744aca7ce7d12fdbb11196b568d045258f7074918b2f6e75e54e60d8d13ca0d
SSDEEP 12288:HVL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:HVL/ssBTiJQgnnGkh+
TLSH
T1F1552366C6DE62E1E94F07720DA6A258E5157EC374C800913680326EFD379A3ACC769F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 9768dd97e8b9e9e2d10915c220177f06230ba42d7aa1a573801294f2d3e2d6e2
MD5 99ec431e800cbed577039a163fdab31c
SHA1 98faa29a39d9905bb2d83223f68af0abeab43cbb
SHA512 f409ef634a40512688422111e22ce462cca81c6baa3202c2fa9eecba7cab0333dc28892ac6e6178e49d8700a9206f4d2edc9189a44ccd82a2acac177b85e515d
SSDEEP 12288:zV0L/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:uL/ssBTiJQgnnGkh+
TLSH
T14D55235647ED21E0EC5F83318CB29114E671BDD3B56401DB3240126FAE327D2ACE6B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 62dc83ae577b51d7150036bf51a85d5778a2cb5242ff0e8224b2f50dc8a1df18
MD5 89ee8a1276f8c2e21a8bb0314c0ad450
SHA1 ba4bde2b526b64401f6d4bbdff1c477ede31b84b
SHA512 87e4c37a76e549b4a55391af21017b673606d6fc765a04260f015e73f755becd95879f19435ebf5ba25c23bc38f080d91949514467b8ef7474a884464c77d69e
SSDEEP 12288:6sL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:6sL/ssBTiJQgnnGkh+
TLSH
T15D552366C6DD62E1E94F03724DA2A258E5157ED374C800913280336EFD779A3ACC759F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c3fe527818389afaf7f8364143bcbdd7f828aa08bae9cea9dea74a858d40d4f5
MD5 8d1972b988c255a05b9f893d8cbab597
SHA1 de29190bd22492b7fc8e3586ccaedfd506c301d7
SHA512 46a15911576666ffc3d574409a09909c9ae64b116597640c194c57da045e115992a4012f0856b6db2a36fe05e867834bc1d3070d4b3be30055fad2aef7f1a229
SSDEEP 12288:xfL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:xfL/ssBTiJQgnnGkh+
TLSH
T11C552366C6DD62F1E94F03724DA2A258E5157ED374C800913280326FFE769A3ACC769F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f6346a348dba3b32d279f671a990458d01db2ef110d9b325a40e92088a167f2a
MD5 76d53f99c8c6c810bc4d19f5f39c9d87
SHA1 c10251de6108733933b771f934f79973b09f7cb2
SHA512 97712a615e087c9985f9acc0ce9e2ca1eaeb46f1744fee7b8cca4d627b771d5bd7fc0d50a907817db352b464628a1b452992394413a93fcb0c9f55e8bd83a5bd
SSDEEP 12288:KjL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:KjL/ssBTiJQgnnGkh+
TLSH
T1E1552366C6DD62E1E94F03720DA2A258D5157ED374C800913680326FFA779A3ACC7A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 88c68996842150ad7d6f2efa42ba2fe9c0e985a8f958d70e7ece3f795bbd2bbb
MD5 064e87922f50fff7df9ddf592bfe2b67
SHA1 ae5df4c3d4322b27189baac0e69488529609b4f8
SHA512 37de720f76a93760aa2b7f5687d8d8deea8b324e092c0083e1a878727a97692b0fc7534e42db7d46aabeef1a85fdba628daa0cd1af126a8c99badf36da07ed76
SSDEEP 12288:iiZwbVzzFEoS2cPvyLL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:FZMRzFVSOLL/ssBTiJQgnnGkh+
TLSH
T1187502A5B39018F4EC67823ECD658905D6B27C560AA0C65F13E4366B5F333A11C3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c084908887c6415d387fbf5ce375230396a08b16100c6bd110dd7a1f4cc33276
MD5 d97e349ec0181ea1ea05f58a1f28a839
SHA1 4a579592e06c9aa2ae91628ca18a87e429b7a6d9
SHA512 3c479b82ca442caf670091627f4f82ebcc3c756f4a7772566b731f1b55a81cab8f0868e2ee3368082e55d3dd24b9b64a241a1f54bcc783ea78cb7e030f98e0b7
SSDEEP 12288:oWL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:oWL/ssBTiJQgnnGkh+
TLSH
T13E5523A6C6DD62E1E94F03720DA6A258D9157ED374C800913680336EFD379A3ACC759F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d13f8357c849409a3cdbc21affa25b621fc8599e693b093c64ea231d932bfad8
MD5 a6dca6976be811b6691a517a5b8d7132
SHA1 7c763206d59224eb7301cc8a48e2640a94e3288e
SHA512 a9cf37fcf9a541b0fffbd5c1bf22082d552fcee6834bdac424d5cba2afc81b5ba1273ce146e757e85bb310817b3539e708e3afe841623e307686f56ea8443fa8
SSDEEP 12288:GSL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:GSL/ssBTiJQgnnGkh+
TLSH
T189552366C6DD62F1E94F03720DA6A258D9157ED374C800913680336EFE369A3ACC769F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 42c655f27922d90499406298aae82cec822ed98f0c1b35d69935b484cd0ea163
MD5 e6a01df8ae81024e2abffdf41ca63c39
SHA1 0c0f581e1ad9517d37b4278ea259d8a7d8c39afb
SHA512 5302e3741c0813e6bfdbae52034f652351705bc0b82a43738c42d9bd010cd7a56f62dee21d647c7c1f55eb23e092b791faa98cb42fe6e9cf541dcc58667372f8
SSDEEP 12288:UyPz5L8nL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:NzynL/ssBTiJQgnnGkh+
TLSH
T1A965125763A530F4D52B433588A21A05F772BC7217644AAF23A0037B6F336E1AD7BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 14a4a469f75a78457988479be6abc4e3a5582e16ee67ca73737e0cd2e869ea81
MD5 c5723ba7a0334f62866a011c23d0876d
SHA1 3589031d10c411795b02dcc7e395a8f0eecdb1e2
SHA512 ffa525bc6628f41f80abee541e36848a3ed589501ff6abbcf4e8589c4b6d1065086b1efce46a56d6023d5014902d34c966cb151141c8a00c2af29f5da376da51
SSDEEP 12288:dWL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:dWL/ssBTiJQgnnGkh+
TLSH
T1B555236AC6DD62F1E94F03720DA6A258D9157ED374C800913680326EFE379A3ACC759F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 81b7c0b4baebf44e5a3bb08a9d0551c8b9bcf6f90bbd964c4c53a5f3c119cdf5
MD5 555c8f11d11ac9b38515fd8c18687e75
SHA1 815cb7e8b27ddc92cb2a8fe530ae9ba72007b665
SHA512 affbd314b0b06cd0369b6ac7c159eb369fc9d5e1a575bf444421f7a91b671ab9acee212c559fcdc363a5dfc19f9696964e2a0be576cdf66c6618039693031f2c
SSDEEP 12288:9WL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:9WL/ssBTiJQgnnGkh+
TLSH
T172552366C6DD62F1E94F03720DA6A258D9157ED374C800913680336EFE379A3ACC759E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 574f7f955f2a995f7ef4ce946c17dcadfe769b9c2d4b8f58d585baae921e31a5
MD5 e02dc9c95f2e353df167a208130b43bd
SHA1 1563e29a0054428687ce0a0823573e3de0a57ad3
SHA512 8874e6a334e875402aed8543f051693891829b38277fc32fc703a5c68ce8641b5e7596a068bbe5ad079dd94515949cdcdcb95ecb296a4e767b3cf28e83b52fec
SSDEEP 12288:pyPz5L8nL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:IzynL/ssBTiJQgnnGkh+
TLSH
T17165125763A530F4D52B433588A21A05F772BC7217644AAF23A0037B6F336E1AD7BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 fe9871321bd95c0732af84fb7799c943b034c2c462f53758e0126c32cd1ceeb5
MD5 5a242712ea4da27a3b7046ffa31343f8
SHA1 3457af423d78132fcfc50634e6a0d01cead1cfc8
SHA512 780a5122d2e65b9a027761b3a411836c89c81619f84e5d5578741f082fcc44cf008f0ac30bf73275e7945ba1bb81bc146eea4cf4368ca8b534b8f32e2f0e3192
SSDEEP 12288:qCd9CWYoaLHF3z0z04PDvhlL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5J:bTDaLl3z0zDlL/ssBTiJQgnnGkh+
TLSH
T1017502A5B39018F4EC67423ACC668906D6B27C5607B0C65F13E4376B5F333A15C2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 0d30b3bfd3b363fb9b4a474f245f5830af9ce8170e586d4d2e3e6dd72f57729b
MD5 beb7a9a5b1c6e95b3f82fcf792dffb36
SHA1 c906efb3d50071ac7662809305d5b93f146b517d
SHA512 851f9430cc8f3a136aae8382b87d257b2a8e13a78f1c370eb7e2cd462a48832f89307c981c280ebec56227875e99f4a6f564d341b7f5553bd4f7ee627530e083
SSDEEP 12288:6i4e7KRdTfgwCHKy7GLbbdIvQL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG6:63vd9CHKy7GZ5L/ssBTiJQgnnGkh+
TLSH
T10585CF90F3E810E4F0B78A358D769511DA767C9A1B71CA8F13A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 624201c0b0d3489df1b4af4bca2bb9ab8623d574071fd645a4a8a94e9888f6cd
MD5 5642ab40df9e8e0efb046a6d9594ff79
SHA1 892b6fd6cd7c6f470dc2d3084d23f91ba415a2eb
SHA512 006771ceb61767bb3603d6d7d5081c7316e62182df7f987da58a9377fff0f1e89e58c5cce33efc00ced50726678c8a1cef4adf1639e005bc2e94153ece114a7f
SSDEEP 12288:q1L/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:q1L/ssBTiJQgnnGkh+
TLSH
T133552366C6DD62F1E94F03720DA6A258E5157ED374C800913280326EFE779A3ACC769F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9d6e59463751e74bd678e5ce08be710ad70531b019b91f895f2c5b9c4c0f5886
MD5 d171106b8630972547e7c27572115619
SHA1 dc14ddc94b3c1492dda2dbf31e57594dec30b0f5
SHA512 5660bb67c13b28a7ce28ece1069f332e98862da0cf9556aa9817400e886e3e79a23e09aa667735d6aae72f01541d67a7b2d813faee4ea9a3aeba6dbe2ec1c505
SSDEEP 12288:eHL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:eHL/ssBTiJQgnnGkh+
TLSH
T19955236686DD62F1E94F03720DE6A218E5157ED374D800913280326FFE769A3ACC765F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 cc7251bf73fccc967ef92b0f67009f9765b5b8a0471744b3972ba5e3e49d517f
MD5 34150eab51f21c1352617eddfd85068f
SHA1 bdf58ad2fdd259be326f52c77e50d2ccdfd1b7af
SHA512 2b1a6e3c13808c7d18567c816f9d478d9af8936aea16477e086231f071cd42073e99193748b560ade2e62540034358dc72a8ba8657d565e6b1a0486a53696b4a
SSDEEP 12288:wQL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:wQL/ssBTiJQgnnGkh+
TLSH
T1975523A6C6DD62E1E94F03720DA6A258D9157EC374C800913280336EFE779A3ACC759F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d60beb7f97780b7299826876d900e142d87e2f806e4c458fa2ad6185d4859ac0
MD5 61ec4bd75c91b5df23bd58c611999b5c
SHA1 81dad8b02d3f0318217d58e691586b55c78aeb25
SHA512 567d499ac1fb0557b0c349f654d358f67d75815b6b8ce60596dfd7a209ac1cf41dd779f45452037de15a56e8cf32e6957868d858abccf57b6cb2e5e4fe855cb4
SSDEEP 12288:LWL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:LWL/ssBTiJQgnnGkh+
TLSH
T101552366C6DD62F1E94F03720DA6A258D9157ED374C800913680326EFE379A3ACC769E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b6907b0acafc8c1b19f072375aea9eb0383cc5f1faa2d710819e77257c9c8acc
MD5 a40a054dec0736c585ed1dd6e2cd4bd5
SHA1 1d395510dee3e05d020694966bb5a43c14d925aa
SHA512 c07598926b067af4e212e012f5fc1d23f4abe74a38ebe174a3a7c75b12c659be0715ee56c8929b482b979a201471c621cc841820338145a2846009bd83c04ac7
SSDEEP 12288:31L/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:31L/ssBTiJQgnnGkh+
TLSH
T1F3552366C6DD62F1E94F03720DA2A258E5157ED374C800913680326EFE379A3ACC769F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 ec31781fda7edec52b20e1a819cb24577dbf008986c449066117a6538c795cf9
MD5 c399679eca0dcf35421bf9fdc58c35ec
SHA1 8f31778baeb4979048bd490191644260c715d8f4
SHA512 d78eaf93b20643053c25f9fb5a5d4f2ffd20d0a1314f4b958e1d7e51883eb358a9401b5a967203d183876ef0b4e64ee6f573a33a0070837fdd137868ca986c50
SSDEEP 12288:SOL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:SOL/ssBTiJQgnnGkh+
TLSH
T1BA552366CADD22E1E94F03724DE6A258D9157ED374C800913680336EFE369A3ACC755F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 86668082e9cff748baf373237326640eb62937d47f17d8fc2155f1d04ed6231d
MD5 d3ef319eca53ddd2aa6f2748030046e2
SHA1 40ae473cb4ee0f9cfc43e00d9d66d52a967d4681
SHA512 06fc142a09338275540e9aa101a9a773eea4c30f8fa89aa2c4fa150079164d122d75bc15970c8ccfa1809ae9ac16fdede565e127f0beb018a4976b5bee7a738a
SSDEEP 12288:gsL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:gsL/ssBTiJQgnnGkh+
TLSH
T107552366C6DD62F1E94F03724DA2A258E9157ED374C800913280326EFD779A3ACC769F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 2ef1b0b0d3e3c69f0113ef4acf621718985b9a0db7898fe72e2d1fc7f8136334
MD5 a7fa23cbee9b078f3e52dcf79befdf1f
SHA1 4f64068ef30ce18dce0d6eac1cf5fdbcc4aab202
SHA512 2d94fb143712ea6ee0d8b0b39e778b90ce06d8a2415575f7751bc58f324b6f16041337a7e7f7cd38b2363db5ed5806b957a75f907255a298eaa4b60b25cd6e40
SSDEEP 24576:HfwvUk9RX6wkyAICL/ssBTiJQgnnGkh+:VMnYIKssoGL
TLSH
T11085D029EBDC44E1E1B7823C89B7460AF6B178591B31C2CF129953AE0E37ED45D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cce84ccad7d062a97553820ea0e04cde2354bd16a3778a9f6e134deb068cbc2d
MD5 a93c3c95583d153e1a1c5456f38b0428
SHA1 f6709a8f707109b46e95d2fe9e03b5a75f032312
SHA512 04680bb6bee585e16ed3632cd4431421a2d9b7d95ff637aa0ee21ef027b3c90038e9f819c956dd3c1b0a571298d3648a11d77f8dd4219e5d70ea4ef8553762a7
SSDEEP 49152:1YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0dssoGL:4ySzPesoG
TLSH
T11B066C96A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7a12240dab6670d14092c866b9534f38ecd79a276b52773b7b55edef8a4a5efd
MD5 57ada4150a1b41358aed625b9b7613cd
SHA1 a64ed0f4c1cce5a34070b50bf8e11cb841af1fbe
SHA512 619ab2b1caa363ba36068e1d93eaafb5214ea910a150ffb5ae67d0dfe5e54cb76444b0d3dc3c5610fcd27101459bc57c3c24c9490409d57b408f05d69e8ff2cb
SSDEEP 24576:z47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY7L/ssBTiJQgnnGkh+:z47JUQjTirIhCnDHUPfF/NssoGL
TLSH
T1AE65AE1EA3EC01E5E1BA827885554A5AEA71782E1F31CACF2270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 2c311d3e89f3df8ae6fa5994dfb398f1152dbf73ab27da71eaaab3f9d509215d
MD5 3c961f4aa3ae736968586f5c4928413d
SHA1 1ed671f53e0b1d876c366e67adca72c7df814dd7
SHA512 0dab656541dab00db240674e92f5d47caa421310151a143842e401d319816f8617db09b03762799208ed5d5fe1878a818e3d673d6e6a2b7cee8cdcb43db7164d
SSDEEP 12288:5bsfmL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:UmL/ssBTiJQgnnGkh+
TLSH
T16E65015AD29812E4D06E5235CB965640F3337C6297E093CB23C0F67E1F36691ACEAB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 83d40f9e255e2da0a985bc0a2c92ec4fbf1b06e2e43ee275f4a5173f0c636faf
MD5 eb521c001ab20ca8c112bf105047f18f
SHA1 363c6a5b8e4f7527e56e68891a2eac9717f08543
SHA512 3ef3caeb39c2d3c363b6801e1950ef500cdf9e90b3dcda1686e9bda14beded33c21ff0d2b7af0c1531a2482e55304e1c8d04ea9cd593fb6f35236cd6e848523f
SSDEEP 12288:2okjU3fEih7IZHSjrzRkW0gn7zmKhXQsR+aREPDS97niUo:2oCUPEhHSV0g7acHRbqPu9o
TLSH
T1C7452850766BC75FC6A940325E72D2CCA7703D11EE456F0773C88B3F8576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 567983ca32b8978e4d90ff36a92d7c3dffdb7fd13d6d4ecce22d560bad51e3c5
MD5 f896f101f1c5dfad491e59155fc3276e
SHA1 f3e7ba90f1f3ff593cfc1c711ecac772f28f67f0
SHA512 ed77c976c8fc5bacb2f7b98717cf9f42b93d50d50dab098b1739c8493ecc6a87298a36db1466756f1f1280ac96a11241fd160a83e0891371ac8bee9843d74719
SSDEEP 12288:ayI15nCMy0x3rTHmdLDFH6G1u6i0VuqMaYwx+WBYUV+V3NhsuRshgUm6VC2Hptsd:aybMtoDZTf0gVPmt
TLSH
T19775FA816137A3CFD1FB607203265B8CA768EC06B7496F2673D8053AD866725A0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c80f8ac59f13e1bc0886f460ac6857496c117c276d1bc74d00111f54d8b2d48b
MD5 b0218f76b9d263f3574642817c12d52d
SHA1 807c668b0020691d62524057b701a5b872865074
SHA512 9f4f16f9e6f8e091e6febb964937f477a5a78e7f877ec7a9ae1615487743f5f4940d797b05e88e63e34652a35969f7dc8c784d4ad497d2ef4d35537e9301c280
SSDEEP 12288:207eL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:PeL/ssBTiJQgnnGkh+
TLSH
T1A2552366C7DD66A1F96F037108A69124A619BED26B8400D3714033AEF9329D3ACF774F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cf4b446690ca020d71020de21e887053d300a9a0162920f3fc4f997c0d854488
MD5 bcc03794644dd53854611c957a05ebad
SHA1 29d42417fc9687ce65a8047f00dc831d58a068ff
SHA512 2641aa0c691accb4d89b557c1ae3bcde0b3c541d4eee0071ff330bba951067d6af6e7104865d4e8c279b7a90589e7d13f3feb1f517401de0b90e72ce58f24446
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bY4L/ssBTiJQgnnGkh+:Tgb4mBIBhGF3ssoGL
TLSH
T116659E1E22EC02F5E0FAD2B88DAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 56c2926a510c6730d49c6c307d8a606cc6fc0243bcec89b95261f09cf6627e23
MD5 2bfac95524ab6c19b9876accbbbe3f91
SHA1 c1522c9abd2d563e9eab2c69903d36f179ed5d01
SHA512 12b24b9463069d01718f69d73b61d766dd76ff1aa9ba76b62ff6bbb81ae124201eb032e95cb984ac3782af1fce2409cc70e4a8615249e2d0c458468c4ab44d55
SSDEEP 24576:iG88u8FpJqH1bzria7/mLL/ssBTiJQgnnGkh+:57ZFPqVea7/YssoGL
TLSH
T17E85F16567E501F0D47BD13889824663F6B2B8211364EBDF07A88B561F23AE14F7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 eb2cc444e786295150d7cdae4e5669aa3f0fac59d1935c2d030cc5b39a9f84e0
MD5 48c8a7ae0a65e19cade0447a64dafad9
SHA1 e059e76106174ea9d0725888ca9e78c7f1f4dfc2
SHA512 86506a98a372f3577f9cc5ca5f7b3f01487f7f1bbd5c4d9a75ea2ce8f727d623cf55d8f6dbbcc9db496590f9ab8cb2b8386db1d36a6a0aca256b70ead6adfe2f
SSDEEP 12288:SHvUrBFrEjwaQPL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOKG+5mY:SPUr+NQPL/ssBTiJQgnnGkh+
TLSH
T1B765E12F62ED18E5E67A917D89828709F771B862131191CF02D0817E5E37EE8BC3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7ca1218eff88f0c613aaeb9ee169a0b426454a9bb8275fd5403a8238866f6877
MD5 8161c9e5a418f938d927540252e53b55
SHA1 dcfbcd13b436f02a3d49bcf032298e708e2566c0
SHA512 04f58b452f3cb736a7116accc59e41d45e18638bf0fc78fa9cfe0084958f8addc17b5ef50de5107842050419a3c0a50d09df040800e621d84423c7fb098629d1
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjssoGL:JG05lO43bvsoG
TLSH
T17AD5CF6E62EC11F9D1BBC17CD9C6460BEBB23815033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f702034597afdeef02a661815e6bd4010f9d5509ae6c438590364713acdf1413
MD5 78fe964eb739c8f3818a731e43389dc3
SHA1 a7cd86d572b9886a50ac13cf9ff1627bd3a3b080
SHA512 0ab79c4898b848c45b7eb0e03035c0d8518e3a2211fc5ec9897870e058a79d9f1bfa6575deca9953b7ea199160e04bd4084bc865770ef346f5bed5d0702b4a51
SSDEEP 24576:Ifa5POZ3dpuWVM50JicR2hG0lasx2+47eidnRL/ssBTiJQgnnGkh+:wa5POZ3BJt2pasx2+m7ssoGL
TLSH
T1C565BF5EA7FC01D5E5B9D17DC583861AF5B1342213319ACB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8da106db6260d033c6234bd845049e8123d0eacd7f6d770032653d28599266f1
MD5 6edde930517d977188cf9637bdfe24d4
SHA1 5bb68fc8ded2282410e862a0a436a0e3549e619b
SHA512 ec510f190ec832dddc248427f209aaeba9d62dd341e6aa7d436d2d932ec357a22e4f87282b5f440fd70f267e7bf9078a503dd9ff01542282fd0f60a48fd14ac8
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkzL/ssBTiJQgnnGkh+:SNc/zEOVHF4ssoGL
TLSH
T137857B2623E901E4E5BBE1BE89779546FA71786513348ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 92b84edb61dadfde39c6643ee7fe2864901881261ddaa48a7295a404be8e70fa
MD5 7e436baf3b1b17e2b520a627eb6e21f6
SHA1 0616630ce125675f025771d2bc5b435ee38f5ec0
SHA512 4d969b8c65096de3f0997ea5563ae8509732309cbcb1cb92123a790597cb5b47a37bb8a2ec38f5f265120416114274ee688f8de636a294d522b2f02a42e271b8
SSDEEP 24576:hTkNvNnaFeYhJNtmZBm9L/ssBTiJQgnnGkh+:hTMwBtOmRssoGL
TLSH
T1C455BF6EBAF806E4D1FEC6B58D238512E6727861073252CB5390C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b6baa76b439e83fa7e0f667e90846b2a20c12ede14b45796ca94c4ed17cf296d
MD5 c1f3655d6776d24f5925afa06443300a
SHA1 01ba01f36ee2ba8aedf02c6e16fc05b56696f19e
SHA512 e776c35d938b56c3513991de097ad894349ac5e88deb1be7c56fba0cdc34233aa2d31b2fad253ba2252bac8d78ed1767fe08a8278541c7f5ec4614a7b6208ccf
SSDEEP 12288:RQcMxWDXN1Dp/fshBItT1IQgAqL/ssEOT9EhnJQB6fugoZrk9RAIx+EdckIttOK7:tD3FHshBIYQgAqL/ssBTiJQgnnGkh+
TLSH
T13175E17EE79C04E4E57BC27C8A638606E77138A9032155DB12D081BA5F6BEE47D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/908-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/908-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/908-89-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/908-82-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/908-322-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/908-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1780-81-0x0000000140000000-0x0000000140132000-memory.dmp

Download

memory/1780-1-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/1780-7-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/1780-0-0x0000000140000000-0x0000000140132000-memory.dmp

Download

memory/1780-8-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/2820-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2820-303-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2848-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2848-307-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2848-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2848-95-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2848-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2848-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2860-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2860-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2860-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2860-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2972-66-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2972-74-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2972-68-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2972-289-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4116-50-0x0000000001EB0000-0x0000000001F10000-memory.dmp

Download

memory/4116-47-0x0000000001EB0000-0x0000000001F10000-memory.dmp

Download

memory/4116-40-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4116-41-0x0000000001EB0000-0x0000000001F10000-memory.dmp

Download

memory/4116-53-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4272-108-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4272-115-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4272-306-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4272-114-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4316-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4316-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4316-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4316-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4736-23-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4736-16-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4736-22-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4736-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4736-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5032-271-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5032-55-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5032-62-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5032-56-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5936-120-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5936-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5936-129-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5936-126-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5936-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download