a58e960020dd56eb5ee58d6099877b57db29b764bc03fce972fd135a766fd279

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 1.3MB
Sample260803-cmp8dawflh
SHA256 a58e960020dd56eb5ee58d6099877b57db29b764bc03fce972fd135a766fd279
MD5 cb89efe42ee17d7d6e81ae2749f5ee85
SHA1 d883b2d0488ef391a0dbec177f7063764e89fdc5
SHA512 5ea152b8028e44c8383926a80a42f21d8d04263ef185a514a5453e81a5054b43f4bd12cb1d8883288a05d7aaed707012b9264fe8213ad5e87aa40bba0b571de1
SSDEEP 24576:4+8TJ3p8epZzS3z13Pem1n9Xozsr8zbhN6GwXOGIh4:KOemBmmXXozsr8zlLwJIh
TLSH
T1F655AD646A0409BCEBF1B638DBDA421193A13D52037655CF13D47F8A3E37ED2AE7A211
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4196	elevation_service.exe
5268	elevation_service.exe
4676	maintenanceservice.exe
4316	OSE.EXE
2600	PerceptionSimulationService.exe
3948	perfhost.exe
5008	ReFsDedupSvc.exe
3196	SensorDataService.exe
3536	ssh-agent.exe
5564	AgentService.exe
4376	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fe27d38e8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f642a82ed22dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043089d83ed22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ddf9a381ed22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002387f1bfed22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009c506c0ed22dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4196	elevation_service.exe
4196	elevation_service.exe
4196	elevation_service.exe
4196	elevation_service.exe
4196	elevation_service.exe
4196	elevation_service.exe
4196	elevation_service.exe
5268	elevation_service.exe
5268	elevation_service.exe
5268	elevation_service.exe
5268	elevation_service.exe
5268	elevation_service.exe
5268	elevation_service.exe
5268	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3516	2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	5564	AgentService.exe
Token: 33	4376	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeBackupPrivilege	5008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5008	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4196	elevation_service.exe
Token: SeDebugPrivilege	5268	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1168	4376	SearchIndexer.exe	100
PID 4376 wrote to memory of 5400	4376	SearchIndexer.exe	101
PID 4376 wrote to memory of 6060	4376	SearchIndexer.exe	102
PID 4376 wrote to memory of 5588	4376	SearchIndexer.exe	103
PID 4376 wrote to memory of 1752	4376	SearchIndexer.exe	107
PID 4376 wrote to memory of 1420	4376	SearchIndexer.exe	108
PID 4376 wrote to memory of 5948	4376	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_cb89efe42ee17d7d6e81ae2749f5ee85_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5268

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4676

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4316

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2600

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3948

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3196

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3536

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5564

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1168
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5588
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1752
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 17c35571e4600618114b4e73a01b6901ee4ac36f032369df0f9013036104b6f5
MD5 54d99714b86d59f96f58b813f0c54827
SHA1 861c1b2a132c92a8ab8c2e40221d1d9c8c6a7436
SHA512 df989d0f54cff2f10b682429006f00c58501c8c0dbc8a8223b008368d42173cb67996b28c6bcec42ce78f4f379e2eb63fa95afc363fe8bdda437e6751e9fdfe6
SSDEEP 49152:Bb+632BuPkFKRrdE6ohrstBhuXjfS4LWxn+Xozsr8zlLwJIh:H3q60jBbwFRKIh
TLSH
T1A6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 36717574baf2e0fbd80979567786c0e214c3cb5a156ff37886c783d85f10d059
MD5 6a2983357023b2efef54edf21d270ee2
SHA1 0cd23b85f80ce70ec054e23597014a893c7786d4
SHA512 b872a5ac6c0ddcd64d020e163f2d3d1fd452c4313203c2ca9cf0becb831a4217f5847c81d17fa1230846cb2ce5a787df6c9affd43ece7de7bda99874b278cfe1
SSDEEP 12288:D1XLsswWkxy2lRq2czA/ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:ZXYfDtczAN9Xozsr8zbhN6GwXOGIh4
TLSH
T1F7850129B7E008F9ED678239CCA28501EA73BC5547A0E7CB03B485655F336D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 c4157ae3fade14572f0ffc047de6faa186c5f355e7463446efb3139a52480edd
MD5 919caea5106015fec7c55ae5956ea80a
SHA1 751da9e1180ac0a182e8d4b2dc0d4e5e2d06f008
SHA512 dfe72a46bea59f5b74f35aa068e3b219ea40d8095367b750e9135c728ad6c68dc5651938144ce16494137364eb1d639bd00c8d84558649b132134ca4cf3b6786
SSDEEP 24576:Q0Le5ji0hmx3rM89Xozsr8zbhN6GwXOGIh4:QPji0AhZXozsr8zlLwJIh
TLSH
T100A5AF26F6748331D073C0B9C5D2A68EED72308657308ACB4296D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fbf4c377b1dc85e8616b8f167b1c16663a34f40799beef9636d9f1614be41938
MD5 a5e85174f44051916160402b047ed4fa
SHA1 63f9d8c39d9df144f08d3716bc0b21aecd7dc776
SHA512 e9ebcaf0efdd33cf8dfb88cc1666a50b7647805e3a6d24e42ec90b9955cb2dfb38d63d30b8e6421195141bcc08af7112866ad310312c850814dd6b41ceb68dbc
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWr6q8wyuO9Xozsr8zbhN6GwXOGIh4:o/ezSC6vUzPviHjytXozsr8zlLwJIh
TLSH
T17C755C25F5788323D0B3D0BAC5D6BA99FE7230465B3089CB0246976C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c0e020afdbb430aff6afebaa16814602ffacf4cbe4c6d9a090168600b4efa882
MD5 5d74d72062f42dc5f26fa2395380ae12
SHA1 1598a4b8b8318c6ba0f481e8a3530830ba05832a
SHA512 7417d98a8e3fb6f0c9edbc776bbefabbd06846e3de9af1a00717fbfdeb87c89ed6b6b89f12ca5f7a4b50651cbf529d8837a5d6b476ee1f3a9be9f278eea55145
SSDEEP 24576:EVbqPb88hv/l+b59Xozsr8zbhN6GwXOGIh4:EVO88hXl+HXozsr8zlLwJIh
TLSH
T16455AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 622a3d757d96f8c40018f56d7d1ab87b96ccdf5c868d3dc5efe701d4323c8dbd
MD5 f97574cd9c5a4676b81cadb821700a26
SHA1 11403ea4290aff57be13b65c9f43649a35ea33bd
SHA512 0afcb4f47f40ec801ee10400defdfc04fa530dc5ac8bcd2a43ef19b9a03111be1343dbcaba64f0ca2f5b9c679ac2a1edd1a21d3858978c582f6b638f33e3f0c3
SSDEEP 12288:3RcksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:3RY9Xozsr8zbhN6GwXOGIh4
TLSH
T13B6523B7E691A442EF671F3139916AC4DAA3FD9E49C11B5112382186CC7E47AFE31332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 c8822cac24e63b8eebd085efa2d344fb699802ab06def579746ac007e29f7177
MD5 defa508e785abe2b51f158dadf0fa6c2
SHA1 aeb141924b9bf03132170bc645aadd3ca7349106
SHA512 5deed480dde79df3edece48087d482f24de26aceb05930ca2801503c1798fade8d439d34eb5983542879ea0f4e4510baed10bed85dc9475b1dff81a5d6ce7efb
SSDEEP 12288:2eBNUbTVO86UzksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:2JIUx9Xozsr8zbhN6GwXOGIh4
TLSH
T1B585DF7BEE28FCD2C27A8D785A918640D7B278704F52A3CBD174820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 32fabb83faaba23e7dffb22c788757ab957ca6b4477b8304d2e96465c373caa6
MD5 d42e32c9802bffaab38499b2099bd267
SHA1 6011a0d48594b8e3b850993a93faa270eccf73ba
SHA512 13167ccf6fcbb4a37415240268d15f01adedad37d9f4d85ab1e1a3504c3d019fd1e1151fe7ee0aadbed428fb0a5751f41d2b9ee6387852eaadaf3b116031909a
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THU:BQvGAdlCEL8c/RRNw5CcwFRKIh
TLSH
T1AD267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 03e2e9fdb83c9ed7469aed2daa8e8de08721d4a455ac5db9a562769542c6cc0d
MD5 9b32ea57f49aa2182e02ca73c1af43b6
SHA1 5531f3be2e05c0a7d978ab65b764107b4c57ad53
SHA512 aa29695bc95cbb1f4fb34e7b94b5781dbfdad322f0691a023f23e59007c328fb4563cef9261d44d0b56cad42ceaa7f2e93b78017ddc55004e4ae9d812d8056d6
SSDEEP 12288:LAwSfxL/2Dc3VDLLmt0LDQewsAjlksLmONw/CX7YNmysags3R3DGwv5NjOytLsXJ:04ewsAjD9Xozsr8zbhN6GwXOGIh4
TLSH
T1AB85E031FE74E032C7BB0DB21B26D716587DB9604B911AC3E3B8498E99341D22776B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 524554b52f22ae1c246aeffd901d541cbb1e437e8f382a32dfd8026a78f688e9
MD5 58759b94865af6faa36b431b345823e5
SHA1 ab9fd207360828e56f0893d1ab1421eaf2e267e7
SHA512 eabe38ad99a87e15d50d5016f52be5c79ae0dde2c91ec462b8051bfb0c7bc132688f9c298c2d17bb5350bfa5120b044db6be8fa5e0c336ca51599ae12598d9b9
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHeDKI:NUEtQevvqc2W1cpV2RI32eD
TLSH
T15E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 117070203326af96d6391cb9dcc57ae338041f8484300dfab68ad3e22f322290
MD5 5060267f6358ec3d680b8fc7f8207240
SHA1 9a2450eed893ad8260995969d7f82beb8db4832a
SHA512 04320b6439b3874e5e976bd22251eb04fc79ec1e53073b6c0a03d289e6f8ed4bf707d930859204e3593d18fb642f2c3636bdef5a8200945816ccdc1be2a3a6af
SSDEEP 49152:xCbRquA/m2yL5zifFiV+XenmE3/zJXozsr8zlLwJIh:+oqHVjnmQwFRKIh
TLSH
T1DBD58D1976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e73dd465dbce11fa07ef2cc1f8d16c0fe74523ab58f6aa5b79cf71815d5a873b
MD5 b918637b63dce843c96e9ff0b3428363
SHA1 95eb2a5867791a14c62ff5c3dd98ab0bac5e48c3
SHA512 4235c39543b6e4237c2a60d20d3bed1fe50deb1c95084457ecb4d045ed827913679b3022629e0ca1524ebdb4c380e822a3fe36cd883ab7bd61af551466693c9e
SSDEEP 24576:/AhGL2IFoiwtA5l7S53C9Xozsr8zbhN6GwXOGIh4:/AM1Foiq5AXozsr8zlLwJIh
TLSH
T171359D81E7F955D4F5B3AA7899B69570EA76BCAA5E31C20F2160C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 71b2e89d39ce507c46ec5ed59317547f8350040a212d4bcdaf34234d198c5b52
MD5 4b09652053b46165024c76193be36274
SHA1 977423f464b52ade51a695fb2aaf71c0b60ec323
SHA512 23da84afdafd0565756a91dcbb0201cbb8875a86be87653fd6b4c84e01378eaa749d15b4e69748b6c0be29ad53f25274de42e2e264aa4476487a079f152ad311
SSDEEP 12288:1mw5HEjsChNkBFgl0WDm+CaksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEi:wwuVOW39Xozsr8zbhN6GwXOGIh4
TLSH
T19B85F14676A41CF9EAA786398587C535E7F3BC062A21DB1F1370C25B9F37221BD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 e9a96a0ef502a00f15ed8e95f2a2790d27e228968069c9eb872a555bae08a73e
MD5 7f9218ab3f5765b2e2938910c5689ad8
SHA1 1581246210a0a09ca3b62a838356633f4d477a92
SHA512 e2bec83e0d6be660bb13cab20471179db770afad720caf6102868be3b297be49610590b6522c0400e75581b6ce66282061b095343f6da5ec92b6f76d2a9f5da2
SSDEEP 12288:OZZ1Iy1ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:AZuU9Xozsr8zbhN6GwXOGIh4
TLSH
T15D7512AB73E030F6E6A3473998E15A44D7B3B856577203CF1238025A5E37AD66E35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d46c1a9c0dacdd7d20e80a765e04e46431cd8dacd8032246a2ddaa4c36e5fe97
MD5 9f226201118f15d2b28d18a45c1de8b7
SHA1 35b6ce55152093a88a48293e7254dc49ca882699
SHA512 86e15e3dd7217da45099de2e4fde9fbd80b52588747539ddbae9c71af6f123c6930671b16ea5592d806ba04cf5178d3adf278b0c7c89d715287bf87ca8861274
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uw:6QRQyi36YOcPhLvw2gAf+PN3HwFRKIh
TLSH
T1DC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 380134b6f9b3a987bcd3c6796202e2bcc37ece3020e8c677dd35ba8c6cb156e4
MD5 f81b49702050a6dfbef09d964d47604a
SHA1 5eb93579021dcb3993039119626719ad41d33ca1
SHA512 ee68e9971c0c6d80c53493140639569441e351f08cc752eab22183498bd8093261b6589913e55f77374b58024afd00fb3250ce520283c0472e72150cce85cef2
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uw:hQRQyi36YOcPhLvw2gAf+PN3HwFRKIh
TLSH
T19B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f8a3d705660e665165e5e0b1f91506d8f1730fe7e40aaec2b78caedb5fac35b0
MD5 28c9d38f3f1823b352d6c918e35fba33
SHA1 08b1ee41596ef0a81ae3d8636c8dba7b2184e44b
SHA512 496163ae81864d0eb6cd14f2a034e22b257682fc04cc00f8abc995a5ce0d5aecda3fd16328c1db8e7241cbb7c8c85effce50d59aa8e839288ab76f49a0838dd7
SSDEEP 49152:p68Qg55nhceWu7PNU3/ZXozsr8zlLwJIh:3thLRc/NwFRKIh
TLSH
T120B55933B2F200A9C44DE1769F4A872196D27C758FE1E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fd987fcdef3bb403f661b483b53c1104e3cad13d437ef58a1af791e6c49d35e1
MD5 a63866a3ccd5b0bb0e389cb8cd017431
SHA1 eaca86ae74b63a53345e405d074a081899724382
SHA512 4fd1cd66601563b24d65e5602a8e139dc3bf3f2189ed1adda02bc919b0f824e4a3b62dca763f4eccd20b1331f51c1db20bcb070fd225cf0b9d555e0937f8f2d6
SSDEEP 49152:d3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99u:My5112gYy5azzVva69nLKnhZOwFRKIh
TLSH
T1F5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2065a0f73fc33fccd0a0b3801dbcd9a3607a953264f98b315cb3d83bb7a28f91
MD5 489b7c74303c490e6c7a07a3d22db2aa
SHA1 0d6114b03243d59b1dae6785a553b2662da2326d
SHA512 6585d38648b0d0f84e16d962f31d1d68c9862c150486c3925d02a329eef5274fd24993bff78eee065838d7d8aaa94c81ea88214e6cb70d2a0dc2072021c08c3d
SSDEEP 49152:1B+taZ3usBWOBr4tEG20bqx0z+n217aau1glfXozsr8zlLwJIh:7u6JmUxd2dfwFRKIh
TLSH
T1A4D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 64f5bae578a4d418b6ee9e0941bdbbc41171b10ded8afff35cdc4cb9d5c2a371
MD5 a02785fb4f9c63b6d3d64e1639747118
SHA1 f8ccf266a46db4f4d574b638db04bf598779a6c5
SHA512 b308e65f4e290a8b575e6da96a35934fd79b0f6abb7e2e26388088d3ee8bc0fc4f51999d783ca3f7ff93faf8ca63ab2d625b30bb4af776169fda4d5141b5c119
SSDEEP 49152:B1hpsNoJpF1A6BU44CwH7R4xDXozsr8zlLwJIh:BmifPkRQwFRKIh
TLSH
T171B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0f2b81d6fa1e118cb3caffd989d70f0ac48dc8ef7437b39f85e5ddb01366bcd4
MD5 eb888527ce6e430bd24fe654587673c3
SHA1 6f1464398f9d60372dc4c3a3e994334b48fced81
SHA512 47d8ad48f3eb6caaa381defd1477d250e922e08fb9d6e9b02c8d53b5e918b71bd004a99872bf4b0884a15f98c5059e9dda7008ede34005eaf8e9e198bf4aedda
SSDEEP 49152:nSuZQIY0Be2KNRVtOnks6NMHqOXozsr8zlLwJIh:95dKvi61qwFRKIh
TLSH
T1F5C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3448175b34a6a97ac0b5b517248b588c763f070e49056e543cd8966ab4d5683a
MD5 62e3f1c82f4d564e43ba2e54adbd11cc
SHA1 30bd98828d699d960d837bedbebfb1aecb10c0dc
SHA512 7c12f318cb479b93806e7c1334802f4b1dc487dc79542a2ea9af46a9d540d4f4a4a2dc96924a306325ef31a08fee169fb5b5e0ec5138605463cfdab71e7d4cea
SSDEEP 49152:ghtSn8EApI0figXgiDn0AP5wvXozsr8zlLwJIh:xX2iyphkwFRKIh
TLSH
T16795BE13F2D900E8D05ED175C7468632EA62BC160B35AAEF0A50B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 7cefbb0eafbe260ec34d4e51b98f6ed70b4a9da7699cc5c9c85af8cc40dae7e6
MD5 47ed461d8fd6ff9b36fdea64042780d7
SHA1 9392682ea3ef318849b4357a46e1d2a4d5f43929
SHA512 fb53fd6e4066a34cc68610c68a30db54abc5541da1033a4060d1ed549ece5b4bac368285b0e6851bbcc04e7fbc301293cf77df3e0819c53030146ee1c247469a
SSDEEP 12288:vkksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:vQ9Xozsr8zbhN6GwXOGIh4
TLSH
T17C6523B7F992A442EB575F31298116C4CAA7BD9FA9C20791333D1042DD7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 dd54aec0e02e0de235edf924f5885dd12c77c77722cb9f18ebd1dbf9a658400c
MD5 af54ed04425f3d93db4c5416805904c2
SHA1 9e094c3714b49d97f9262d4d642346e4eb7ef850
SHA512 366b24855e6b46dbc32a3a7f0dfe0d4e016bbed346ebfd05a55e469e3e62e3d5ff8a849aff4398a160cea0563fdbbe257278aaa6c8a5ec459720b76391a208e6
SSDEEP 12288:rhksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:r/9Xozsr8zbhN6GwXOGIh4
TLSH
T1066523B7F992A443EB575B32298116C4CEA7BD9FA9C20791333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 8d6ebfdf7532853ebd1bb1f268a8b97360844b79a48b1f328de3663f70b61dd6
MD5 eaf8a8a8bf873c33c44a31c76100f65e
SHA1 8913f7c220360e9781ac6c6a4bba1181f094fa6d
SHA512 838e80a4c1384aa68097e8b7812ac6c30c73e5f44d5ba6a05e4797399b91e37e25fa6b4fe26dce50945ef24386c0fbd1bfb706f6aa7c38e5b62894ed435c0aef
SSDEEP 12288:TbksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Tp9Xozsr8zbhN6GwXOGIh4
TLSH
T1346523B7F9A2A442EB575F32298116C4CDA7BD9FA9C21791323D1042DC7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 2f19817b11e13a63aaab4811827a807c8b5fedfad4e502f98ace956e5a539b27
MD5 6793958ae19c779c6d4d90dc268acb3b
SHA1 a61cc8fdee2e4313102f4d542ad7d52d5ead5b13
SHA512 02fdbf225b70dd9ecb26cbb5f080ea32337756b99f48941996af6feaa3dcb251b5221e720e95ac36bebc2b5325f068d8284885d5478065c62a493890f4c23102
SSDEEP 12288:uVuksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:D9Xozsr8zbhN6GwXOGIh4
TLSH
T1AA6523A7F7A550C2EE639B3198915680DAF3FC9E9B5217DB233800468D76679BE30331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 8694fb9f9c481e0613b63b7cc1e8f5d75267adfd2128db198ddd41e388f453b6
MD5 f4c7190d20c0444661b76813ed74cfd6
SHA1 7828d0b2d02b8b12716137b3fa907520c19bbb7b
SHA512 a31e8383135cc7fa79561525ccdf60ac4e2346e59c6034b012f1a04dbcc6e0a333a46598175ae0873223b617b89d9d3bee83dacea85406e6fb9527579dfafa13
SSDEEP 12288:0mksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:0K9Xozsr8zbhN6GwXOGIh4
TLSH
T1226523B7F9A2A442EB575B32298116C4CDA7BD9FA9C21791333D1042DD7A83A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 f3d1a42515947e8a8ea6fd0693a298f1c3908cad8a7bd51c608aa17533699626
MD5 0b8127378228f4d42c5fce7ed18eb854
SHA1 13f7485ca62e39b46e62aace23b9b54695466882
SHA512 8698d3233520c964d1165be240ed9881ad86ffd0788549808bff7cca0359df6881874abcf98284f9f8684514b4fef2f107b9b72bd827ae26f685a9091ad6f026
SSDEEP 12288:qtksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:qb9Xozsr8zbhN6GwXOGIh4
TLSH
T18A6523B7F9A2A443EB575B31298116C4CAA7BD9FA9C21791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 55165da3ff51cd980f10f2895956eab10b19058e0182db7a1b595cbddd13e58e
MD5 a2e5bc6843ba428f018117677a6ee462
SHA1 4757c942c18b4cefdbab098251df75ba02e8b77d
SHA512 2bc49327b264c6ca616ce70e52e9958e98104959781c91b570ec962a02f53b3ea8081182b028d98357a95d82a353b8b1ebc0c3af9c160464e8d8cc955a5a1b3e
SSDEEP 12288:YZksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Yn9Xozsr8zbhN6GwXOGIh4
TLSH
T1636523B7F992A443EB575B3129805AC4CEA7BD9FA9C21791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 a8bb4f36859b353c9400d18b5cfb5e4314b3f43c08610a5f97d5d31f5482a3b5
MD5 ce5e20f9ba2e55ffc83fd00141a816e8
SHA1 4ca46ba49d25e0f8fa8ec06ce57f5a32a837abd3
SHA512 ed50f321d83862cc0301ef0bb2666fe4b1d4e5e5599e7c69a6ee1117ad0a5135f9dde1f675cfe4ef8f29da328d1fa27bbf92b54c08e155898211a903dda34a06
SSDEEP 12288:5iZwbWzzFEoS2cPvyBksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:8ZMWzFVSOf9Xozsr8zbhN6GwXOGIh4
TLSH
T1698501A6B39018F4ED67823EC9518905D6B2BC5A0BA0C75F13B832675F333A11D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 9a414f3fed960eff055c777e346c6fb9abc1763c50ee200217295fd74d6fa78a
MD5 3d0e9dd871a839880866c7b04f05e6cd
SHA1 63a52d9775ecf7113235e07b76b3c28fa05c40f8
SHA512 31f43c8d175414b44bbc081262cb104b8cfdb974c7c1dd745777ed5c076564388b5564b78782c27f282f73afa17f5ab92f8fd951831be6672d221b62e32146f5
SSDEEP 12288:4IksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:4k9Xozsr8zbhN6GwXOGIh4
TLSH
T1B06523B7F992A442EB571B3129811AC4CDA7BD9FA9C21791333D1046DD7A83A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 8fc8e7e73e0a9b1edd20c2202e02ff45ea401a927dca5bd9c7a107c5a1623b5e
MD5 ba4b6833ae56b8144bf2e2edafeda764
SHA1 a4a454f2d94f76929baa37c30c298aff9ed7a236
SHA512 bdf2cfa3edca44b456525497a317ad9aa32ad74aca1dffd96b38d56405291a10242cceee428e59c4f853da34947869fe28b6066f7cf43f7d92aea4f3b41bea50
SSDEEP 12288:9sksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:9o9Xozsr8zbhN6GwXOGIh4
TLSH
T11C6523B7F992A442EB575B3129811AC4CEA7FD9FA9C21791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 45cfc86af88e156ff4b16978117bb2a9820726d1c575f60fb8cf26434bf845ba
MD5 5d01f4b4a5e19a0547f0d8f6caa85909
SHA1 38e72a3a040c7449425b0d7224b9f3c63d80e48c
SHA512 8b5a92906dcaa89e5086769169f6e753f56641109c68398b3d41ff2351343d76fa168c25165efb65687e62ad2475d8df32e196b4de35d7601fe04c183969af7e
SSDEEP 12288:lyPz5L81ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:szyT9Xozsr8zbhN6GwXOGIh4
TLSH
T12A751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 4b2f88981f77b90c0bf72a883d2f4edc9cedae1ddcffe6ffe28110a954379b7c
MD5 8e4953ec986e7fb167c940abfa880034
SHA1 7918fb5ea664d06adace010192ac9adb6dc90fc5
SHA512 ed7965e0570ee91ab01c88d848aeb4a4673b7607090db5c54424b550b226ebca17aaa6485252b2c6a2ab8694ed8033b5a18299768a0bd68002caaca2a8a510f7
SSDEEP 12288:XIksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Xk9Xozsr8zbhN6GwXOGIh4
TLSH
T1C66523B7F9A2A442EB571B3129811AC4CDA7BD9FA9C217D1323D1042DD7A83A7E31335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 a95aa2f936b322e12df517f5d8f8e4134bab362fe1d905a1c6df58145cba2aa7
MD5 ad70a193780f0a990ad493749421b031
SHA1 6053e04e2544dddc6522a7bdbafb6810f707c185
SHA512 a1b4eabe1a9dae976fdeb2d8c0f2d11552d85c1c0be2406f3f263e6886aa1cb00417defa0dbd9d88ab9b8df6ae2811c7d663523c4840c337a2f5fc790684224d
SSDEEP 12288:IIksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Ik9Xozsr8zbhN6GwXOGIh4
TLSH
T1756523B7F9A2A442EB571F3129811AC4CDA7BD9FA9C21791323D1046DD7A83A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 caa8a77256238292c0a389be39671ce201cb784774519cecd6bd814ec11401ed
MD5 59f7deb4899272bb4be25a6ea6fe4dfa
SHA1 c03ea8c365f0c6e8452c6a08567b5a57c95e0d3d
SHA512 5deff5d207614eb1370d8369fffe8fed5ea0b9a6ea793a70fa2afc4a1675f9f1825fad505be811f5c30699f5ba7e2e66b765ef7b8345e4b67af8e2b25f544299
SSDEEP 12288:9yPz5L81ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:0zyT9Xozsr8zbhN6GwXOGIh4
TLSH
T15C751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 1a1b241149bab3d1af04298951bbc781346c49bf7806b51c09cf34b60c967742
MD5 688655630b3d5d02f364eebc9262c076
SHA1 2421d379198cd62fb1e80a310d8edec333672740
SHA512 85a5222826fe5fed68079845a603dba1b4d0a984afe1956df12b139e4e7c050cfecef6c6edc1079625922eef8a92b1c52a5573d92e0d8d5e43865dc77bdd05cf
SSDEEP 24576:dTHaLl3z0zDZ9Xozsr8zbhN6GwXOGIh4:dT6LljsXozsr8zlLwJIh
TLSH
T1358501A5B39018F4ED67823EC8518945D6B2BC5A0BA0C75F13B832675F333A12D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 6c19e69669472afaac2deb81eef3edd74dd27c0e122edbe4bba60bea8739d82b
MD5 5407d00885c545cdeab3def7c8ca0221
SHA1 8edf2e413d891561e5cf01dfcfc7f808eda46416
SHA512 981824f3c45e5dc62b6b921d913c8603b60cc0819d606fcec270e467c17d5d30766300712b5f6bdf873461938eb3892bbb7a8ee43c10baec6cacab1bf6c540b6
SSDEEP 24576:T3Ld9CHKy7GZl9Xozsr8zbhN6GwXOGIh4:zLd9CHKyahXozsr8zlLwJIh
TLSH
T1BB95CF91F3E410E4F1B79A358D725511DAB67C9A1B61CE8F03A8251A1F33AE19D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 86908004d09320dbbfdf13f80196aefa8744f30dc0abb8f4aae16d5896fe4970
MD5 c86fcb24d9772262929f06a47b7ac1b9
SHA1 58c4a8e4113a5ea96320b869d20e8ef5692d4597
SHA512 85923f5c8b9a058c7a922e38ecc5255cccc1369174d29e1b589f9fa5860477955cd2b0997affdc2abb9159ab2f83343e629e5113846e4ba963a2b101201ce7da
SSDEEP 12288:U7ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:UJ9Xozsr8zbhN6GwXOGIh4
TLSH
T1136523B7F9A2A442EB575F32298116C4CDA7BD9FA9C21791323D1042DD7A83A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 5cfcb1b96885249d05ed45f7c97c9643423b0fbf8ba92ae85a47d6be2e07de25
MD5 223ed7fec1fd25aaafe283dd9f37d467
SHA1 fd38c7f9942e707ecf1792b5f645839b199b6320
SHA512 9737ade493abb89975c7cac7c23eb62fa6723c038910ee5853f8d0c48027ef146f39eb1c970495f9e44fb5d6f040db8c0336a91d13ae34616fc9435ea59aa685
SSDEEP 12288:3VksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:3z9Xozsr8zbhN6GwXOGIh4
TLSH
T1CA6523B7F9A1A443EB575B3229811AC4CEA7BD9F99820791333D1042DD7E83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 34a3af31a27bbaf616c758e1d1d6c93ba36cfa5efb4be3c6465f1b99b6fdedb8
MD5 dfb77b619c07c747601c0b8414aa26d3
SHA1 ba7a64ff74e92e64341178c14cceca853a691727
SHA512 5fd4eb6137b5baee310b1a6709ec15e31d0914bbbea6aa85053639a9f0f62a909c6719196fac90fee5b9f01ed23b98510182b6c245a2a8532966b9d3e9c29498
SSDEEP 12288:6yksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:6W9Xozsr8zbhN6GwXOGIh4
TLSH
T10A6523B7F9A2A442EB575B3129811AC4CDA7BD9FA9C21791323D1042DD7A83A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 76264529719ee1227ff593e66557e0505cf0024f682fb05be17f857dc1e96097
MD5 c1299d86ce3a34d8d4befc914982cfc6
SHA1 09b363fbc3cbdfb8010793f4c04223ce3e15f56b
SHA512 efa1757580edfc4c1f49f84cae5fe97a4bc3597b9997ca5b7e9b8f0bdec2bf83122017b7084190b73f6642ea71389ad948593858ea5db472a4f6392fc832e787
SSDEEP 12288:hIksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:hk9Xozsr8zbhN6GwXOGIh4
TLSH
T1656523B7F992A442EB571F3229811AC4CDA7BD9FA9C21791323D1046DD7A83A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 bdbae0c75b204dac76074b3747db24d9e691dc3df21fede230089263016645c0
MD5 11dff3598f10727326de5ce1b4877de7
SHA1 3362d677965b9c21edfa6b7d88c9e4d348ee4814
SHA512 57b86438c7da6f909009f72ccc5016beabaad0aa27bdba95e26ab3dc56306799031fc29fddc870700a143a67272c78a27bc2f5ee9a4807639eb099fd89cfcd14
SSDEEP 12288:H7ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:HJ9Xozsr8zbhN6GwXOGIh4
TLSH
T1546523B7F9A2A442EB571F32298116C4CDA7BD9FA9C21791333D1042DC7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 3248a47e32b51a4eb209b0a19c305ab382d2b7d215b4602adc22637e84c5f2ff
MD5 d15bf920e203d89cb1823e53245bfd4b
SHA1 39e69479a715b222ff5e65e39efe41db0e34d609
SHA512 32fc7a873b32d457ec0064acb71fce556f1cd8c46635a3a4ac0001139f9d1c7db5f158ba6a9de4ee04fb4fbabf5f1dd93e9ba2a0fd428a22ead4014d5255125a
SSDEEP 12288:rAksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:rs9Xozsr8zbhN6GwXOGIh4
TLSH
T1E96523B7F9A26442EB575B3229811AC4CDA7BD9FA9C31791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 999f88859f00f07cb518bec718a372330910e1b1fe198f138037b07d4796f560
MD5 b4ab503bc68c2ea1b03c7131518009ac
SHA1 8f21d505fa24de3366e461f253abf087f13400c5
SHA512 035682be00e61d8af445126d73390f317c77d945c82ae3f1338586f2e700df9eeddd75ce23a4d19c821967f526eb89d94e87baf02afae9f5e7e542acc161f0a6
SSDEEP 12288:UmksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:UK9Xozsr8zbhN6GwXOGIh4
TLSH
T1706523B7F9A2A442EB575F3129811AC4CDA7BD9FA9C21791323D1042DD7A83A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 0a61c4282e71958251c14c3cf4524efa35453ca5b5e829c33ccdf501a0717526
MD5 14455901729811c56d68b324123e4095
SHA1 a3b4f5102cdf9fdf5fc228053d1293dfa2a6d8e7
SHA512 a274e888ca20e42dadb10cfe5ed26786a8acd4523db8a6223dd9090d693a66d15bf8b41935cdfd76fc03a4e34b883369da3c9ab3c9ce7e9463eef19db3137d39
SSDEEP 12288:ADksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:AB9Xozsr8zbhN6GwXOGIh4
TLSH
T1076523B7F992A442EB575B3229811AC4CDA7BD9FA9C31791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.5MB
SHA256 adcb29d6fca66a2d16f04a45e86409dab2ad760e5bc4894e06b50a71eb5ae0f3
MD5 1ea2c9c1b2fbc6eac572e147fccfe0f8
SHA1 c9cab08dede525826657c35cfaef958fbcf4bec5
SHA512 8c29f45654fc4a27371ca200ddf563f964a6880166e8f003314dd9ff5057f872900a6ac0c968d9b6ed7c0069943ce43b87dfea70f7cab4ad048331c2739a0111
SSDEEP 12288:6mksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:6K9Xozsr8zbhN6GwXOGIh4
TLSH
T1E66523B7F9A2A442EB575F3129811AC4CDA7BD9FA9C21791323D1042DD7A83A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 7c22bb03b2dcdf96c7bd492852c8e8de390412053c311acd8561233444611a50
MD5 cde2f3b198981096cb3273c1bff30ca2
SHA1 3c026f25658ac8ed2cc9fd0bda490c7a1dc57133
SHA512 f66e716cbd265c5281d62ac4c9a9432e0d541146079303b40628d268f647da297852eb14d9b0bba0b5a1b228739b78f9c67eae0808f04ba1526a3bd49e167375
SSDEEP 24576:mfwv7k9RX6wkyAI49Xozsr8zbhN6GwXOGIh4:5MnYIiXozsr8zlLwJIh
TLSH
T11795D02AEBD844E1E1B7923C99B3460AF6B178591B31C3CF125A536D0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 dcf2b34467d82f689616c25f640df16af1c0af3f1f6816992b2494d55952e8ca
MD5 60a3d1c836371708a286ff807c525637
SHA1 59a6c52a6a8884f2a16851a8f74e358bba86b22d
SHA512 4ea465e4c801abb5ec1a62104c1a119aaa3cf144deae116af41a452d1464ecbc4e3eb435408c807e2454b7354e06cc5cb1b0a16bb2a850a811a90c8659c00cd1
SSDEEP 49152:5YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0PXozsr8zlLwJs:HySzPnwFRKIh
TLSH
T12A066C97A16841D5C1B9C1B98B07CC1BFAB134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 eff0b1030f450cc24cec3a2c7d7b054aea4c4b847e66371e5f9f8b2c2048c0aa
MD5 05f2e6e50ba3b51a8a19345a15092538
SHA1 138361d2d2440093ecf2dcf7ac81d11040f720f9
SHA512 832c7d812bd115c2ad9958ae49a7bafb88ee6cc8c46051db42fb040c18c490176d3a26d1591d133d6159031420a62542c9c0be1562b8bf0f24a7f6d8253b9bf9
SSDEEP 24576:r47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYv9Xozsr8zbhN6GwXOGIh4:r47JUQj4irIhCnDHUPfF/fXozsr8zlLT
TLSH
T1EE65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 de683f44f476ac99a9b93fd4c7fb173c94564e9e10c930373d8ab72127e8d5b6
MD5 1a9ccb0fe0833ed897ee85f7bf56d15f
SHA1 aabcb585390b2d90c3141116e7e4f3da2864a4c3
SHA512 92c39a74714b923570b1f63fe038f795c1a0f7db7fb98e65a72cc3ea905aaf08749e2cb00b04bbfcb03cf65f8ef6d7ee756a1209f9346b5030646e25e9a88586
SSDEEP 12288:0Qsf4ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:OU9Xozsr8zbhN6GwXOGIh4
TLSH
T17875F15AE29411D5D16F6235CB414A40F7737C6A87E193CB22E0F03E0F7A6A4AEE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1000KB
SHA256 6d06f6be4e14aa97cd3b86bb5dffd92841df31a325531431329839e2584b2eb4
MD5 af7671f2f4cf04e074f11c382afeb42f
SHA1 1809caad35c62ea953ddbc6ad7b4412ab45e0f47
SHA512 b815ea27d90e196054e30d25936b6e85fcdd92667ef5bdfb2733c4fee422876e1b4f471c70c80ea2502318ed12b084f9775be802b41566121de83e32f18d2e3b
SSDEEP 12288:P40sU3fql3HKWzTYA/4F85gI+UrvRMLAUwLNQlPKL:P4JUPQz3Yo4KeT8vRM9QWi
TLSH
T1A62518007667C74FC66990321E32D1CCABB07D51EE456F0773C88B3F9576A59BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 114bba5b20621d2686600035f7293683ef2066c65f627d529603f7cc2ddaa233
MD5 b12f97e192c3b07048cb059100fde619
SHA1 0d5cb09581086a7a976d2d6b957d7d3ce894d75b
SHA512 fdcf5f7340f51fd5762fe6398b128bf2e28e5b31115ff2c0997e4d5b7efb09f8de81ffdfc7681b75e63b34f97c8f37329aaf426558e258d77839663bab9775d7
SSDEEP 12288:cbrw/MlMqMLY6tVJCmB14AhjtuU/MCXFCQBN2:cbrw/6Fsd/JMAhjtuU/MCXFCE2
TLSH
T14E55D8405537A28FD1BB6032072A5B4CBB64EC16B7496F23B3C8453AD86BB15A1F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 196f74093c6dbee6541984b87a01216873eca69319b7d9800e91b5c47cccb77a
MD5 6944c9c08750eb2e91f8384286708483
SHA1 3af43b6c301cd1362fc3d2b495aedf53f6e50bb0
SHA512 2b4e4e77cde58bb219fde92f9ef95943c6e04776c2549559ab9efe6849809245dfe2cff9567bf21c1a0eace5e7e07d5a75e49de3d638fe1c16dd634f66b19d66
SSDEEP 12288:Md7wksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:8c9Xozsr8zbhN6GwXOGIh4
TLSH
T1E26523B7F795A802FA771B30289556549A5BFD9E4F8107C3322C1186DC7A8E6BE30336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 45ba8c61e18008f2a66352bb6c080c963d3a4df851d1e3d98963b8157f7597a8
MD5 48cd6415893717a8e6208ab69f8c08cf
SHA1 7330bb8255fc6fbef4b2cc19aea4ce8923f84880
SHA512 c885819357ef1481f79a0a9242addf64ff5cdf35675914f89fd9f7ea6305128804ec61beba58d48e02b51d2f1ecfa5545b7a2f02b5a67312f3a8ba3adc3c602a
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYO9Xozsr8zbhN6GwXOGIh4:ogb4mBIBhGF1Xozsr8zlLwJIh
TLSH
T14065AE1E22EC02F5E1FAD2B89DA64417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 55b0ada457416a9288962b74422a80cf0e16e03d41a3ed341ff9ef0a265bf939
MD5 891ac0576cd31abd97fe4e904d2387b5
SHA1 d8be1349de9bf35d2ae30683260980b31e38bd1e
SHA512 58250457a311e3da27252859d0ed8b8792cb1b3a9106c8f45d5ff4bf6b791496bc4a3ba86a4a10e6d19bd1c787ca4bf5de7c96c4ed34ccfdfd5876e11738140b
SSDEEP 24576:GG88u8FpJqH1czria7/mf9Xozsr8zbhN6GwXOGIh4:N7ZFPqV7a7/EXozsr8zlLwJIh
TLSH
T199A5F166B7E101F1D477D13889824663F6B2B8250364EFDF07AC8A511F23AE55B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 f70d78c02b5549e2cd869773a2184b9e483aab99f02d408ddfa2583997d410bd
MD5 cdf49357ba20dd8a26efd7b39fe9dc02
SHA1 87a4a33fd312aebaeb2bc34f8bb812d05e8b3ce8
SHA512 f5fb1e49ac13010b21f3b1fdc1c297c67a598d1fa8dcb4d50607c24726a731e4899b696c09fea4c59e3e8ea153a8790a1f50d14ab1bd001a5bcf163ce5815355
SSDEEP 12288:rHvUrBFrEjwaQ9ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:rPUr+NQr9Xozsr8zbhN6GwXOGIh4
TLSH
T17E85F26F72E918E5E677A13D89824709E772B866071293CF02A0417E4E77DE8BD3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d68ac01c888942985a532eb0d23ed4c51f68955335b004d6f1a875fba836ad4d
MD5 221a9bf686070b0d959ee65723125ba0
SHA1 373e6acbac4fca90d875b2cd409ceb5fd750d5bf
SHA512 586aa1dabe0a9f5ce93f38d4a020b38f8027b3fd60d06dc8103f9f59e2dc8e107440ea7e03e80e9ecafc7d3a303f09d44329213b280e3af4c01e159c5bc3059c
SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRXozsr8zlLwJIh:zG05lO43bWwFRKIh
TLSH
T1ABD5CF6E62EC11F9D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b93e0104fbbab1e0f0c3df2e10129b09e179292acb102941d92c5bcf5bad546f
MD5 a9562c659bccb244c13de9573ce16f59
SHA1 e499826b12b0b93192bdde70206106a78e5c852a
SHA512 26824bd596a5ae1dd4d2e427d6dcd6b30b6703195fb292c51e94d9fd2f0f5c2c11eaba35f0f172713deb4cec9c386066f5d5dd3ccbd641a58b73bbaf469dfdd5
SSDEEP 24576:cfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnt9Xozsr8zbhN6GwXOGIh4:Ea5POZ39Jt2pasx2+mZXozsr8zlLwJIh
TLSH
T1CC65BF5EA6FC00D5D579D17DC583461AE5B2342653329BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7030abd6887054fad248bf3d93ea14afaae90f43a801c993e4ed2215d30b971f
MD5 d58025fe5ef48c7eea3c4ffd406d7e74
SHA1 cb87993a0dd66d17528a93941bc661c0a830071b
SHA512 0add9b8da4ac8d7b9f3c1568a5ab989376f2de90c5e5329bc96d7a8fa52c01c5cc2ad9ee91d636097ccf871d0360b0bb018f881543727647906d550144744b50
SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7FkX9Xozsr8zbhN6GwXOGIh4:rNc/zEOVHFkXozsr8zlLwJIh
TLSH
T103858C2623E901E4F5BBE1BE89779546FA717865533086CF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8023965dad17ae541e2b5e4ff8f1bed3ac0972e83e1e90712f8474913390fb7a
MD5 f93ffbd269698eb22b475b2b5347382f
SHA1 72ccc9fb06c730327ec800777ad16adc2456a8fc
SHA512 2b6762ef02315e36b57ff23f5a84270b8f829f355f1cc6a02efa3864f16ddc8b676d46f9608d77aa576dbfbc2ce80f16dc2bbb0b2c524ac64dadc6ed44e547a7
SSDEEP 24576:StkNvNnaFeYhJNtmZBmB9Xozsr8zbhN6GwXOGIh4:StMwBtOmzXozsr8zlLwJIh
TLSH
T17355AF6EBAF845E4D1FEC6B48D238512EA727861073253CB5290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 51a1bff9bec5233a55fbe3fb04b70deadba244e73f800c1ec2916208451e1bed
MD5 8572c892a3ddd5698b06954c2ee824c7
SHA1 132534e65a8913cee756b81c5b9b5357915eb84a
SHA512 cca0fc98de22071f6a15a9dc8c5361e7dcffcad66366fa3043c7489e662a396513af3e1b4a1d0d776bf3fd7d6ce2e6493a3a912deba765325ef1388ef3c40e5e
SSDEEP 24576:HD3FHshBIYQgAw9Xozsr8zbhN6GwXOGIh4:HDVHeBIAAKXozsr8zlLwJIh
TLSH
T1FD95E17EE69C04E4E57BC27CDA534A06E77238AD032256CB029481B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2600-293-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2600-74-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2600-66-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2600-68-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/3196-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3196-102-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3196-320-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3196-108-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3196-330-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3196-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3516-310-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/3516-316-0x0000000140000000-0x0000000140286000-memory.dmp

Download

memory/3516-0-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/3516-9-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/3516-8-0x0000000140000000-0x0000000140286000-memory.dmp

Download

memory/3536-121-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3536-115-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3536-322-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3536-113-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3948-308-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/3948-78-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/3948-84-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/3948-79-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/4196-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4196-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4196-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4196-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4196-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4316-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4316-62-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4316-55-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/4316-277-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/4376-369-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4376-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4376-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4376-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4676-39-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/4676-47-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4676-51-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4676-46-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4676-40-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4676-53-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/5008-96-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5008-381-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5008-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5008-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5008-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5008-90-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5268-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5268-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5268-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5268-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5268-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5564-136-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5564-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5564-134-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5564-128-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5564-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5588-372-0x0000020F0E830000-0x0000020F0E9FA000-memory.dmp

Download

memory/5588-398-0x0000020F0E830000-0x0000020F0E9FA000-memory.dmp

Download