54bd865b0c5478c32c66164f485fe62854b83ce849b84a40477ccb50c8ad2ee0

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Size 6.0MB
Sample260804-jj73cazsct
SHA256 54bd865b0c5478c32c66164f485fe62854b83ce849b84a40477ccb50c8ad2ee0
MD5 3794d55e2cf0c9bf8f431c48192d714c
SHA1 42577e9ea2af784694371cd516bbcc2a4cb8fdc5
SHA512 506e2a839b75942495e9948ff8da5d46e6e311bf260ce25f78740df4346a37cc5d58436c3405889b2540afa37e8948d273b72b5bd8f16b988d67c61dde5315a6
SSDEEP 98304:5l+0x9FjO509xZqNcxfH64NWg/29z4VkslgJTIZ5Bgp:Xhx9M509XqNcxfH64Ix9zMksT6p
TLSH
T17856AE56A6A450ECD5B7C178CA468617E7F2BC0513719BCF06A0A67A1F33AE12F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6036	elevation_service.exe
1984	elevation_service.exe
1936	maintenanceservice.exe
3648	OSE.EXE
1988	PerceptionSimulationService.exe
4108	perfhost.exe
2800	ReFsDedupSvc.exe
2588	SensorDataService.exe
3908	ssh-agent.exe
1408	AgentService.exe
3452	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f8b6d8ab83806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050f187efe423dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ebbf5531e523dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bed60af0e423dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ebd6ab31e523dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
1984	elevation_service.exe
1984	elevation_service.exe
1984	elevation_service.exe
1984	elevation_service.exe
1984	elevation_service.exe
1984	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeBackupPrivilege	2800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2800	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1408	AgentService.exe
Token: 33	3452	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeDebugPrivilege	4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	4520	2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	6036	elevation_service.exe
Token: SeDebugPrivilege	1984	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 3432	3452	SearchIndexer.exe	101
PID 3452 wrote to memory of 3188	3452	SearchIndexer.exe	102
PID 3452 wrote to memory of 2368	3452	SearchIndexer.exe	103
PID 3452 wrote to memory of 1132	3452	SearchIndexer.exe	104
PID 3452 wrote to memory of 4884	3452	SearchIndexer.exe	108
PID 3452 wrote to memory of 4100	3452	SearchIndexer.exe	109
PID 3452 wrote to memory of 2344	3452	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_3794d55e2cf0c9bf8f431c48192d714c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1936

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3648

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1988

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4108

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2588

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3908

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3188
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2368
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4884
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 049018709c7d5d25099e66eaba21d45d76da180d329003cf379f94fa2dcd34e5
MD5 34fd30a42b875e32da6e931bd1f9fa15
SHA1 85cd8a20047a3c5fa8e08b9eff46f4a0f94c8999
SHA512 7436f24ff0fb45f3ba419b78f1124d04cc8d944d44d4f0c756694dce04e77ad05467645015719fefd9dff98c8065b176059512e947eb91ec82750e02b29724a2
SSDEEP 49152:Nb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnLb5+Pl6bJTIZ5jdgpF:T3q6mjBuslgJTIZ5Bgp
TLSH
T1C3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 535915edf8894e7357314e381bf4280ca36da7a108da496a2fa74d368cbb3abb
MD5 295b21c9340171cc7b97be435a26702c
SHA1 4bf6423e83b449061db80754ade10b23fd17a9bf
SHA512 d5a2086013c97e74c7686cfc8550be45470a706e6b0c5680b590e773fec4083bafac9c0f38fbfc5afd0c9c282a9333774c531237aeea9d92e9f37db046c4f30a
SSDEEP 24576:fXYfDtczAJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:qtc5b5+Pl6bJTIZ5jdgpD
TLSH
T19385F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 cc22f54b7b209da738066eb9d690fbacc2f5c89ace92ebd0e6cb1ddf7f1bc744
MD5 d50f957692b3d9c3be0714e7398ab972
SHA1 5bbcd3943ced4fd364bc1f3c95db1ca2ec70ed5d
SHA512 38c6c50029c754014e392ea4cac11a67187e3647987baec190d6ba91fabb183cd40fc8e10659b1ed03614fd9281cd434d2d9f31d462ca228212745d74d2a4e4f
SSDEEP 24576:l0Le5ji0hmxyrMUmb57GBiOl6a8JTth/RWZvR6wQQ92pN3j:lPji0AI+b5+Pl6bJTIZ5jdgp9
TLSH
T10795AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a0e91e285b83b456059def703d241dd2ef340665e8c1d60a908b6639dab130df
MD5 66b8c09416ffac604ae097180aba6fdd
SHA1 a3067f5a1773dd6693ef1f135732589c40eb3bd3
SHA512 1b258493885049b71aefd9084e7d9900a497ba1024bd775cf77652aebd4e31cb94dcb9429d9d7d3cf57c05da3be73d6ca8f7e9a35f730de88ae53369d1d1ff4b
SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWj6q8wyuGmb57GBiOl6a8JTth/RWZvR6wQQ92pN3m:L/ezSC6vUzPv+HjySb5+Pl6bJTIZ5jdh
TLSH
T1B1756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 db638fb97cff330c5ce1605bbf4f88bcbd03de436ff408a5ad55ed4469269d70
MD5 c5a5490e1a1fd07d69da9df44f7710dd
SHA1 f3232ecb6b802edb3c3aa0fd669f7e6c8ff31281
SHA512 7cab3e8643e85557be0203a444ed220148aaea04cb68b2c0ca5d953af6574938e581f9cee6e18be835ad7636fdf2ffeb44d8c9c0538c2ed5a2b1a55836482e19
SSDEEP 24576:pVbqPb88hv/l+BNmb57GBiOl6a8JTth/RWZvR6wQQ92pN34:pVO88hXl+eb5+Pl6bJTIZ5jdgpm
TLSH
T175559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 f9eacc64b4040d58f011cd968ecad5f2f0de8671dec21b489198c5c4d378c4c0
MD5 50464cbab5fa496fbce12f7e391961b1
SHA1 26afb85024ecaf17fa7b6f27f991b34d4f1a2a2a
SHA512 512664ee31891c55767c443201629d06e6dc1f00537e7f650a225a26a4654596443c75f57d1d06663a03f6369ad1040156a4402aacb767b2dbc8936a275b6fb7
SSDEEP 24576:6Fomb57GBiOl6a8JTth/RWZvR6wQQ92pN35:Wb5+Pl6bJTIZ5jdgpb
TLSH
T1B36523438B6A30C5E5AB1739D9CDDB00F879EF55CD866BB6C579282BF034349B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 11251fed33b313bec7e7c0267a8b17c9c55e1b19f4c93c64e9cc1c076c4fd3f7
MD5 732e222cff408f1b08b35cbb9065879e
SHA1 f8f0333a636ef4845a877bf36f6cc49b1f60e237
SHA512 009e1f5261e25f39241d301cc19a349a5124438ea57921c406958dfc2be95416d08c3303df10ced7ce97c56ef4443df61bdebf5d272c691259287fe1e163bbbc
SSDEEP 24576:MJIUlmb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:MJIUob5+Pl6bJTIZ5jdgpu
TLSH
T15C85CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8d35b6cec6035800bc5b0bd1c38c1b034ddbdd88839a64aba4302684a83cc705
MD5 b9a2f85b5d8484cf920835b60a2a06e9
SHA1 0d7cf62d7ee220a1f7a3ec25edae0e05cfcd68e4
SHA512 cdfe4f4d5d3d4850fce996ea7db55e9f3c3b562248a81ff553afded34bc1606ea8254ef2ca6f712ead2214f46d73135731c03a075f79ce1b40a6aeef7da61c9e
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THY:mQvGAdlCEL8c/WRNw5CFslgJTIZ5Bgp
TLSH
T1A1266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 9ec4a3507ee8f3bea4e58953b380e11ca4a4d75091b309471dd92af99e9418bc
MD5 22fb7b9350966d4d0a0367db69b41836
SHA1 bc60d062672485c5dad82317bb146e37c6bac227
SHA512 d3d12690a188f1e15ce902d310be0b9c2158b2574fdd45df5fd675014f32e54a4000c82c7a7219f6fcb48a4705ea36f9324f07730de1335483e0082f20db43b3
SSDEEP 24576:kOewsAjPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3M:HljOb5+Pl6bJTIZ5jdgpy
TLSH
T1DB85E031FE75E036C2BB0DB65B65C706647DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f17d3f5bf59d00cd38fd3da2544f105043583e96412b48e71df31bab598ea080
MD5 9cf3bb01eb7078eaff3ed683aa566cf2
SHA1 bfa53e5938823fbcfc3c3bcef904f02d87bf59d9
SHA512 b1b12f79f9a5c3e563558992b2a4b8bc4f683d68aab505834d98f0b989b3df1fa9d1a8d3fbe6454567a6ab682baea2cddeed66a88dd71cef683eef4517cf8f79
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHssT6p:pUEtQevvqc2W1cpV20I32ss
TLSH
T130474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 dfaa11782f96fd1c4126d3090e31c3f2a684bb9929922646b8355fa76f75e840
MD5 9459be9b88fa291fc655bde10e05441b
SHA1 2bf1cb79e5d77af95d226ec330de5746c30948bb
SHA512 06d34046f7f97bdbd6f8095beb2968c04981c8a70127a2a9cc3622db8b56996294ceb2c492fa05fb13e9616ccf998cfa0fde6a4fa7faa78ded1eafeb0c60e922
SSDEEP 49152:vCbRquA/m2yL5zQfFiV+XenmE3/zub5+Pl6bJTIZ5jdgpo:ooqtVjnmZslgJTIZ5Bgp
TLSH
T101D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 078fd11a574743726e75836c1e82f4ce2e0be4d79c270b7a071eabb2c4a268d6
MD5 d1896a64d2330069439d89252bea09e2
SHA1 51ff1a6f58ff438ce0f05fc341ce78e25591b1da
SHA512 ebae370401de31bf517f2aa1fb2944c150e0b2f035f05ba5500b786041d6d64e1975570b8a45b4c4517b2355fa372f24a7fe03f5e508ac816896b3ecd39bb4d4
SSDEEP 24576:nAhGL6IFoiwtA5l7S53imb57GBiOl6a8JTth/RWZvR6wQQ92pN3M:nAM5Foiq5db5+Pl6bJTIZ5jdgpm
TLSH
T1C0359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 4e131725124c4e009ca93439a43cd4464cb2b2056b1de6ece624ede64cb4c8d3
MD5 b011e8025d40a50ff08b94383f21abac
SHA1 32e2e14d589e9cdff5ae7a94ac03849bf3244480
SHA512 f8ee649ff9d9adcd33fd4322aa73b5371d325a430b63d76c91f77ec87768b23674aa0a74586fe9b44c7586e83b2002e6ea0d6035fe343b92cb2c72f2f8ca088c
SSDEEP 24576:UwuGOW7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3g:UwNOBb5+Pl6bJTIZ5jdgpS
TLSH
T14E75F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 3de9d007d35ff9862b0f0c3e3fd8a8f8124d5c2b05d12d3b4f76fdb44b92ad9c
MD5 9470a10da7ea524fcdc5ca0b50a330f3
SHA1 e17a63beb8d94b34d95a8ab287547dbc38546921
SHA512 92edddcb48b2532f7b9d6cdf581fa2a926c4ea2ba391e684129ee043329556f9b89c194a2c4ff9e65dacd5c1c7f84d100f573a7717bc74517382302816870472
SSDEEP 24576:AZuMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3L:5b5+Pl6bJTIZ5jdgp9
TLSH
T12065128627A830F9E0A7523DCCE58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bb2e347b6eed812dbe918f33f3281971525e4e9f144930a34076100c2f8451f2
MD5 4cb33c8d39743078fbe41d536c1c93e8
SHA1 a8dc4ff00d6e223625044a5fa07d931bd208bd02
SHA512 dc6f788d1e3cff52312b0e3e847977d66d56f28ad031a48d6e0886f57a5643bcd1ffb4fc22cb8616acae5f32359016095f6553d9daaf26b0245a4da6c09c345d
SSDEEP 98304:0QRQyi36YOcPDLvw2gAf+PN36slgJTIZ5Bgp:bQyiKanX+PNKsT6p
TLSH
T1B5666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 86c9f94a0ad78293540baaa754648f6fb11f5543fe0d352d4482b1588dc39e3c
MD5 7c04e0de16eaee9c808a6197b92fc405
SHA1 3130747d1b24ac37c21ff00dfd2d22afc769a6cf
SHA512 176f43eb512e967617961123fa4b75397dca425f716e28f9a0ab49021ad95bffe2f9ec8e4baf4bf8d2150a8c3026150fddcf36dccc77a88a5ddc07f39caf260f
SSDEEP 98304:RQRQyi36YOcPDLvw2gAf+PN36slgJTIZ5Bgp:IQyiKanX+PNKsT6p
TLSH
T1E3666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8b451d8275b5089f4e9881c443e56ecc7ff2ef501583d57b7a069a9c062763c8
MD5 ce28f674c3196ebe40b5768dadca0bae
SHA1 7d052fd663def6b20d33d7142b26136faf91cdf2
SHA512 bb6bcb259eb7f543af6cc4259b610d1b60109b877426bc78c2a0a6bac1a3efe956aadf05ce3ca5efe56e18f71c2e0479401976364a2317f95e8db8aa15ea920f
SSDEEP 49152:i68Qg55nhkeWu7PNU3/+b5+Pl6bJTIZ5jdgpZ:gthTRc/EslgJTIZ5Bgp
TLSH
T145B55A33B2F60099C44DE1769F4A872196E27C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1e6095656c33cafe2fcbe78456bfc7c2844bf883e169787feaa3dd35ec173ba0
MD5 afb61cd136d7da84bd3fd7dc27abb5d6
SHA1 627bd75ba53d4ffef38c2c22b8df82058a1f1e27
SHA512 e641084a86a0c025a3bd8430be21654fcc803839bd7f98b5ebba308213acc899e4beb1cc174f1b64948f480e4f8e111e9d676a668109a61688c9c04634fe7990
SSDEEP 98304:gy5112gYy5azzVvU69nLKnhZjslgJTIZ5Bgp:5LIHRWhRsT6p
TLSH
T15C167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f44f734d56cca38e472c2e27e9b98d12a01f7a9acda63992d33ca178eb97254d
MD5 d4c1c6cd6b10f96a2587eb88b404ec04
SHA1 e9d55760ffe11839c3f1697cce0db6276dcd472d
SHA512 fa3db3e9f6dedc9ed5783cc81f9706d05a45de10369475927fd1fbaf4ccb93dbdf38ad5ce8f626a0670a9cc62fe474644d27fe1addb016057f12282c5f951efc
SSDEEP 49152:+B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl0b5+Pl6bJTIZ5jdgpC:su6JmIxd2dislgJTIZ5Bgp
TLSH
T1E7D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a08c7523eb1c48307b04bd699b7bb48fbd14ba72bb04a79b083129693a280483
MD5 a4164c12fdd8aca59c3f256cef8e1dae
SHA1 8d100d91f64ee7b93749ec049cfbbe1991b4b032
SHA512 f47fe4643c0510d77f4dba5b4595b0f6aceadbb17eb4bc3525ff7ba289b873449c09482bcaccc6c584551397cc4a06cceefcfdab3f7616b8c53ae4faacdb3eb9
SSDEEP 49152:v1hpsNoJpF1A67U44CwH7R4xIb5+Pl6bJTIZ5jdgpa:vmifPqRZslgJTIZ5Bgp
TLSH
T16CB5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 edd9691c3475a633e357d748c68f7cd3e9d9983275bf4caa3dba6d669c813cea
MD5 44c9e10012cd40fe25ca518bb81e8f75
SHA1 fe54237624a46a64a9c9fc5dad3eccd909e35df2
SHA512 adeb9e40646e30803bf448991afc2cb79a1f7710c7d72f6ac48fa38f13562c2b82095ac2afa877d669780ec70dc830ec67a00865d7194bf477887d310560cbfa
SSDEEP 49152:RSuZQIY0Be2KkRVtOnks6NMHqbb5+Pl6bJTIZ5jdgpo:/5dKqi61vslgJTIZ5Bgp
TLSH
T154C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 baa6401947c2aae601d069133ed7249c83f1da4d79afff84ec0411696d42a26d
MD5 afe97262c2c0fffc20f490ba618b9b1a
SHA1 37625a0c0b8e8132e0e41325ff551d10a3d4ecdc
SHA512 0abf2c539268d04c4048a52b943db846560a80b193987cb77d48db06227750b0bbcc2c3549244dd022d2de4ae49e8ecebdab6f24a56da4e237807d68a826f0b3
SSDEEP 49152:nhtSn8EApI0figjgiDn0AP5wEb5+Pl6bJTIZ5jdgp3:2X2iWph9slgJTIZ5Bgp
TLSH
T1C995BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 677788033bd4199e90f53e26ec44d701f9f8a7587cbacd9f21ee210df9d2352e
MD5 25e9fb0087f6bd252c55b367a62c0d85
SHA1 ea498c2f987c3a207462e27b19601eb5789c989c
SHA512 5676b47db71a5caca7df9b3b1767ac8a9715fee5a119831ad1f8f90284d8a9fef8e818cbad7e0f0f0e24c68a0d88e1931556ae6215754167ef6306f213e6308a
SSDEEP 24576:EAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3c:Sb5+Pl6bJTIZ5jdgpG
TLSH
T1EE6523824D6B20C6E09B5779D9C9DB00F87DBF96DE8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 93dfcba57e41b684862b727db9d906f1c41e435f11ba30da6e58d475d9e27f6e
MD5 757625f2269214663853aa821c91a57b
SHA1 3159de76bb45b9defd3409c80f232d985330e5d4
SHA512 77dc5a5ee776b0f4565aaf3ecf20672ad5574beb0dbb3c3bead998f8bdb0942c3ae090fa69d23f0155892f01396f98ce9f999d21b38f2fecef5611762d3c2f7f
SSDEEP 24576:Rjmb57GBiOl6a8JTth/RWZvR6wQQ92pN31:8b5+Pl6bJTIZ5jdgpT
TLSH
T12B6523828E6B20C6E05B5779D9C9DB00F879AF57DE8727B6C67D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 cd468856b3bde594905beb882d81e7cf970ce4baca7c3442b45384cea0e0e0ce
MD5 9b41f867f4ea58433ef8695839f0c09b
SHA1 c1cd028c363d35b25444cb21c6cccfd99948eb24
SHA512 a979ab74f4fc710c5c293abfd168007b3bc960ba8eabf262714abe53fcdbf03030532a14fd487c6765c462a7e1998f02acbd68730d978d940460249c7ac3d851
SSDEEP 24576:A9mb57GBiOl6a8JTth/RWZvR6wQQ92pN31:Jb5+Pl6bJTIZ5jdgpT
TLSH
T1796523824D6B30C6E09B5779D9C9DB00F879AF97DD8727B6C67D042BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 dc3413f5ec45be37d9900cde3bcfc8ed1a532be3e32e59103b7afded79e6eb74
MD5 42d5c9ce431e8b3058bcf5e522d62e0f
SHA1 6bc86c09b4a70aab33c1e14cd15c90aa856aaee4
SHA512 f42df36bad63e1e39bb2771f4b217f402c728e5f32ceee6a2c5bab2fdde21b90cea6f56fc5921857a5e5decd6bcd4faaa05e2705bf780122fdc98bab063afe84
SSDEEP 24576:Pmb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:Ob5+Pl6bJTIZ5jdgpB
TLSH
T1566523424B6A20C5E4A79379C9D9D700F4B9BE96DF5267FFC675082BA9313883C3134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 b2ef89493214a5be735a5b35f33bbbb3fc2cff97948036e3b373312f1adbbc13
MD5 ea73caf8b2c7f86aac588a9c32208023
SHA1 5cc0185d46c65164cdc1edd776864d99cff045e1
SHA512 1ed3297fc2d71195e9e9335af351a7a752bf68b48c2bd03db5b9c95f23972ffca00bab9edd8cb06bb9c62c7d90870801be12738fae1d509f6d1c335a53112a66
SSDEEP 24576:Oqmb57GBiOl6a8JTth/RWZvR6wQQ92pN38:Ub5+Pl6bJTIZ5jdgp+
TLSH
T1176523828D6B20C6E09B5779D9C9DB00F87DAF97DD8727B6C67D042BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 487994f88cff04f7230b740240a15f95d19b5d95aae7f83fe77e0ec2f5610a2e
MD5 9b28d1be4a538ecae9786050d26fc0ff
SHA1 6a2b62e45cd48a49d1c64d4e541fef8930106faa
SHA512 f913a0c73d12abfdf8a58a1bc2f0eaf6619695861d710e7796d3c7e34902db003dffb345e17613872c196187f2c4f0fc259233ee7a2374f31af95a5ec5d738e4
SSDEEP 24576:enmb57GBiOl6a8JTth/RWZvR6wQQ92pN38:Tb5+Pl6bJTIZ5jdgp+
TLSH
T1DD6523828E6B20C6E05B5779D9C9DB00F879AF57DE8727B6C67D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 9bb72f960ed65dfe044b080455ecb3daa44795b775fb1eadb11bf4b8552c100a
MD5 9f65f6721e753252f8828348d095d0ff
SHA1 cc3d76ea23b180a1984ade22fb099050dfb198e4
SHA512 89b434e6826176ff2fdb56961836b5402fa835fbaf149f2fb2590b0f97f675b7a2181c7e4c5a210cdc1a2629b0adcaa03ec603edc7ee267978fbf17946d2b768
SSDEEP 24576:Zrmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:Mb5+Pl6bJTIZ5jdgpS
TLSH
T1BB6523868E6B20C6E05B5779D9C9DB00F879BF97DD8727B6C67D0427F130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 d27b9d7761be01d3d795305f885e1663a57373f50dd1ad3b41211999c461b8ed
MD5 7b342f76fa870c00c219084948c690a7
SHA1 ee852c9984b97a9fe39a9d5b186c394e9756acbe
SHA512 a7c38f2ecf3044bcf593eee9beaccc841016c0315c145c26518b110fbb7d5666f0483691b8800996f2fe7c803c08311cebb8d44b916bdbe640073812217335b0
SSDEEP 24576:fZMazFVSODmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:fZMazf2b5+Pl6bJTIZ5jdgpo
TLSH
T18C850295B36018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 e39c69cf2b94c6bd44e21018426e5eef862968cebb76849df8a60b6f1d8eec99
MD5 d17ddc44c5a3cc70439076526b755e1b
SHA1 994f908a0f507477b37da854c71195c19a96b43c
SHA512 e5339590b4c234f4f8d40e418a8410e47a7102a8dce67e01e6a750e50358ff704f2d32889a240fa28b60385366a629fc9990dcb68d82a9247c8b143e0b707dc5
SSDEEP 24576:Hcmb57GBiOl6a8JTth/RWZvR6wQQ92pN30:Lb5+Pl6bJTIZ5jdgpa
TLSH
T1656523868D6B20C6E09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 b12e9dbb45ee151e82f57f10b4cf785089c45ca96d72d8d164e77e36b6df4995
MD5 955739d60d91ba31afeadec46ebac84d
SHA1 6e4a5d5627fa073b3492f181cbba89669b4d8497
SHA512 65c22d736b7c2452ff975c5ed224d5652e270bca8f97a3475fa06b63d43627f6da33e2a833bdf8550285a44dde151ff3e403c5db7657f7ea152915d08eded11b
SSDEEP 24576:W4mb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:Wb5+Pl6bJTIZ5jdgpM
TLSH
T1D06523868D6B20C6E05B5779D9C9DB00F87DAF97DD8727B6C67D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 2ef443a0139335270ca4c0e5426a1ecb7c6a52c65079e47dbb95395c57df0201
MD5 477cd13c0d0a7d883c29021b68d7deca
SHA1 599b948d9ab1d56acdc79ad0f68ce53b67a4f9f5
SHA512 c1d00a17bbc16ea7489edfc968618217f22b7e91a082245156286a0d5436d9431bab2e27816fa201685a0b8fddb8f00bd9454f05952edabb774d8e1b5d44c851
SSDEEP 24576:Gzyfmb57GBiOl6a8JTth/RWZvR6wQQ92pN38:Ghb5+Pl6bJTIZ5jdgpC
TLSH
T18075024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 7ce2c71562be0688c94f4356d2c681f6b06ea119ff5179c950125cad62490a57
MD5 a95670bdbbaf3de28fbc14321d5ded62
SHA1 9821eafb5c81cdb4653569a093b5c9082898a5d1
SHA512 732f3e5c947062c725e90010dc13faab353ec0ad74afc328eaa84f82484bd888e9c0cf26adc274bdeda244f5173e4b7f37b1f2f6c916b6d39db5183cb9bd6b40
SSDEEP 24576:Bcmb57GBiOl6a8JTth/RWZvR6wQQ92pN3T:5b5+Pl6bJTIZ5jdgp5
TLSH
T1CF652387896B20C6E09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 9b71a248380f70d4ddb5eb188b726ecc8db14709c8ce966f808e4c1d7b6041dc
MD5 bbb201053c83d0fed511690175684fea
SHA1 587aed0e186813477f1a3aa50b07bb4befe6ad2c
SHA512 c47e3decc3b8a0226f76db9bb7761336ee8930736d9bc990500a36e5c3a85b1df17cc2d29fbc2fda31dccf3fda1adbb5f5e813b727dd81ea558c6086f8ea2169
SSDEEP 24576:3cmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:7b5+Pl6bJTIZ5jdgpz
TLSH
T1B66523868D6B20C6E09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 f48c93334fb0aab7df3788cda8138a97f91dfe4e9e1d2d15100f5a7f47ed74f8
MD5 1b7ac4f0ef0d09a1122179f2f83f3363
SHA1 bf946249a67cbb0a8758c04b082cf092305d7e13
SHA512 db16db57475157ccd001ea61e69e3868589c5915b50b85a7a58f19a2eeba1a667fafc366b2264bca21bdaf002c5a759e87a16516544003cd9b729055eae11f88
SSDEEP 24576:Azyfmb57GBiOl6a8JTth/RWZvR6wQQ92pN3f:Ahb5+Pl6bJTIZ5jdgpV
TLSH
T1AE75024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 2de07bea14b647b5fe4ec3d94bc08fbdea1e6dd8cae73bbd59731b6f09780508
MD5 6c4f29c29e9474623eb57aec4336825b
SHA1 1a8253b20684b1b68e51ffe11835cef09dc327c5
SHA512 e909c6e74bc2e5445e0ffa8862a2109d981c8f6453d100901b72fcab94fb43471eb2a033bd27245e337f8b9202f20b9a72a4c0eb9f46410f71346cb717cf30e1
SSDEEP 24576:IT/aLl3z0zDtmb57GBiOl6a8JTth/RWZvR6wQQ92pN3F:ITiLljJb5+Pl6bJTIZ5jdgpz
TLSH
T1F385F295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 98265d5b0269ca38ac5d080e82c842faecd66d296ef1d3c78563481c9128caa3
MD5 8e14b24ec1224cbb30d3be5bf6f791d8
SHA1 3b6d4806f49574ae8db34041ec81bab7c9841346
SHA512 f263e0b3580b283feda99dfd489b2bb0188ae786fb71a38615e5d5fd2d0bc3858698a14434c36fd5a4c78b8fe902447bde0da781577e1c316bc7b2bba3742a37
SSDEEP 24576:y3Ud9CHKy7GZBmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Q:UUd9CHKya2b5+Pl6bJTIZ5jdgpa
TLSH
T1A095CF90F3E410E8F0B79A35CDA68611D9B67C5A5B21DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 b8e6c6754ef8534c02b3c858d6d75039d24e3c80f44e60401fbdaa8550d712b6
MD5 d4b0106025cddf81bfb14f7a9c87fd25
SHA1 79babe2c6cd8190427c57a439f526cbc145f239e
SHA512 4849fddfdbe3bd07ace4b15add0aee0e44935b9a4ec09dc79d852e9663a6ff9b9e93f76e0aab7261732883d939e7096b6460e8882ef7fa8412f747796c4da5a7
SSDEEP 24576:edmb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:3b5+Pl6bJTIZ5jdgpm
TLSH
T1B96523828D6B20C6E09B5779D9C9DB00F879AF97DD8727B6C67D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 2f25352eb3e38a369617b99b6f1a36ea34a5032532920f8aea1e2f60a83563bd
MD5 25264bbb601dad48f26621b055864426
SHA1 bdd643c27226d608b72f2feb3db5717e44a697de
SHA512 4dadd40dfec30f30d49bed748df2d3b0867e3b872956354c5c39749cb39907a703962bde736bec6fed472aa916db44205f747c653a360657612ebec2d0c14143
SSDEEP 24576:t/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:sb5+Pl6bJTIZ5jdgpS
TLSH
T1046523824E6B20CAE05B5779D9C9DB00F87DBF56DD8727B6C67D0827F134789385220A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 6a6051f21f37bfdd22b85a1c070fceeb265a34585897914896eca3bc73529df9
MD5 72b71b771eef641bc688b36caf3a4f89
SHA1 14ca89162b21f59d9ea045208494552a97008fea
SHA512 1f8d0dd805a1f9a1ece2b725f03f6b160c9d3005ec9f174d1250f1258e6efc4c1107a160ebb16c40f43d0d40753158d85e5e2729dfd0a30b65e35598440859bc
SSDEEP 24576:mOmb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:ob5+Pl6bJTIZ5jdgpa
TLSH
T131652382496B20C6E09B5779D9C9DB00F879BF97DD8727B6C57E042BF134789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 0d594c31c7d9e722c343cfa80f2e8f56ed02cca40a0d7bd23bc7eb0b784f74cc
MD5 db11281831bbecf98a883ed11ff70e07
SHA1 d1042c21f573db18fbb797771c6c5a7371ffbb2f
SHA512 f95c4fbd20cd22b93c4b6fe4298e280b456b5826cc8c309ebbaebc344a579d2f512d0f6f1552c02cd508375a1bba49bf9b9ed34b63326529f44ca6826b709887
SSDEEP 24576:Rcmb57GBiOl6a8JTth/RWZvR6wQQ92pN3g:Jb5+Pl6bJTIZ5jdgpa
TLSH
T152652386896B20C6E09B5779D9C9DB00F87DBF97DD8727B6C57D042BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 569fe6d4eedc2c8c13520791cab9fba0390bd96ace8fc94980757fe01dec63f2
MD5 1695c7c9ccf0649395bb647525f75bcf
SHA1 360f90c3996f7b2e79d3af41091935fd777a5e0b
SHA512 b7abb3a8ac01d0f775864f4d97521897605b3b2a00cfafaca2b4ca390ed9bc549289136c2e77999a16f2df26a8d1943812bfc7922f96fbbe3eee90a10aefe091
SSDEEP 24576:tdmb57GBiOl6a8JTth/RWZvR6wQQ92pN38:Wb5+Pl6bJTIZ5jdgpe
TLSH
T1FF6523828D6B20C6E05B5779D9C9DB00F879AF97DD8727B6C67D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 859c4715c7c4b190f222192944e6fe7f03403537770fb0d7f000947e415bf13b
MD5 d3fd7c5fb85e3ef53e2e4910fc02c7d1
SHA1 f501f0d71318c40a85291827a35b2a6e31a04ba9
SHA512 32a8fd5f8b84aba06ff49c62359e93608fc15b2d797e8f3bcff038b4cebba1dd652b0765290f65bd9a589ddb666b3cafdb150a0e7fd1ea6ae00d200212170a41
SSDEEP 24576:/Emb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:bb5+Pl6bJTIZ5jdgp3
TLSH
T1AD6523864D6B20CAE05B5779D9C9DB00F87DAF96DD8727B6C67D082BF130789385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 c9554095ad768a4a5dd413c4f668a408e1020cf967a569872f3afc4a3e284538
MD5 1771f380780e828614dbc44d08757c5a
SHA1 bcb03d1bf7af89123a1a667dc0cce9e79346604c
SHA512 c4be715ada2825d75062428e1c0286f67e492bd2ab2aa4b359fd759a92cc61870e57b032a92a493943b9157672660954b80d6e47b72882e7630bdcb1d80eb778
SSDEEP 24576:Qqmb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:Sb5+Pl6bJTIZ5jdgp8
TLSH
T1C96523828D6B20C6E09B5779D9C9DB00F879AF97DD8727B6C67D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 6d57ec48150b6143b3aba61f4d27ab258a2f955ff0d20556f665c458f6d9c81e
MD5 eead90c119bbda05c4df59683d9ec767
SHA1 45a97d687a208fe054d1bd6fd12be48410ecde14
SHA512 71ae6b893ea3924f0862d915744465d22b85aaf54853cc718f757bfaba2696ea90921aed9de3a323d4cff959b2ed55295ac0063bc1614c763d38bff8a1fffdd3
SSDEEP 24576:w1mb57GBiOl6a8JTth/RWZvR6wQQ92pN3+:xb5+Pl6bJTIZ5jdgpg
TLSH
T17C6523864D6B20C6E05B5779D9C9DB00F87DAF96DD8727B6C67D082BF130789385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 7aa7da765111324780103a55e4f8807c42649b115fddbfcb1a800c4c81876933
MD5 2a9189e79d7f6dc83b00382ab7b1f3fa
SHA1 f3a028ff72e370fa5f693cf9747e4fa5f8ed11c8
SHA512 6f6a790ca9e0f8004b00466058f8104db750b49a2ce542bc6a6026d60f3d9fdf1873498cfb8b4ed0426f31a6ab5311ce4fdfa43cb1ab682908685ea9ea7dd9b0
SSDEEP 24576:Efwvhk9RX6wkyAIImb57GBiOl6a8JTth/RWZvR6wQQ92pN37:9MnYI/b5+Pl6bJTIZ5jdgph
TLSH
T11195CF29EBDC04D5E0B7923C99E7460AF6B178595B31C6CF02AA536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7b003449a5e5ff4fb25ee71cd2a7999fb7301cd7180776587440e3d02e7ebd8b
MD5 45d37e148bf8aed066641388c3301b8a
SHA1 28d32b6a698e793229b475d72aaa797280c42b25
SHA512 298dd59994fd6db921de3a677de083a382e4a6e820c1238313cf807590c4c4b9004377e1ab6b4634defb9328922f5091d4bd121100bf11305070c068d43d2ca3
SSDEEP 49152:dYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0kb5+Pl6bJTIZ3:MySzPaslgJTIZ5Bgp
TLSH
T183066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 def3d81711cb422fb2ef0a74fd930caf26a9dbdea02a19f294ef8a859fcf978e
MD5 0fa6bc2feb9c6459fe26178c5a73968b
SHA1 b25e8699c69eca20e810197b6817cf9175d622ce
SHA512 3e98f145430236d874bcf2d9ee836895c0f8e1ff1497b4b872dc1a8cdf39d6d5eb817329ce8d4cc4feae1d4a6e46d20385913c0574496f12891aae73e74b9e5b
SSDEEP 24576:447Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYTmb57GBiOl6a8JTth/RWZvR6wQQ921:447JUQjqirIhCnDHUPfF/0b5+Pl6bJTZ
TLSH
T1A565AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 dce8732d5bf333cd0bb31a27c46d5b7c66e23e9bd1c58a4324e9e998c728724d
MD5 3fe2a405c47b426519d67d40e726767b
SHA1 f57fa78ef6f60f6909ecf3bb8fa27263e8559b69
SHA512 427caea94c7d5e557c08f69a45e7ccce6a70cef661c23f9e05f378def5ce6f5ed2ccb4925b81069c0f4e87da67de255d5358200d2580aadefb373d0c20b8ae56
SSDEEP 24576:/Mmb57GBiOl6a8JTth/RWZvR6wQQ92pN37:Tb5+Pl6bJTIZ5jdgpt
TLSH
T11875F14AC29811D8D06E6279CB858A00F7777D65CBE293DB46E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 12ccea235469aba240d33da5466ae7484dcdd6c94858552cbc64d5d5525480fb
MD5 4efc034b241e3e4357b047ed55001751
SHA1 fddc887994006c1837667f6c6c1cfc112faef1a8
SHA512 af9352088d98a9da51b698ed9ef2ff5f4cfae40667bef906abc56fac0042a2a00504f9afaa2fee8452c03aaf82193e41f367d6f85d2d76e115bf30fd16ee6215
SSDEEP 12288:HToqkU3f5BNulvsg+PzUMGCuy+qQzIQM3WMR1mA:HTo7UPb18IQMGMRz
TLSH
T1B9252800766BC75FC6AD40325E36D1CCAB707D41EE05AB0372C9972FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 37fc0d740b08913015733980e6f0cf5fd843800c1ea0449943e2d123ffc60778
MD5 75e4453a4ef2a1a0247bc560b4392b69
SHA1 5ff067891663e05cf71f9975fae60bf9b8101017
SHA512 fcbf7bccd503cdc78ee54262e2b057ee52f1c7853e99eee991cad235e4361e7f19a70c50eb4f566650f1f4a394848b527c0c1377ca67af97b61a4e1788672111
SSDEEP 12288:fGcCvskM4v43P74M6M5PKJvMj/3bJiNuvNrps:fGJvMj/3bJiNu1Ns
TLSH
T1AA55E8819537A3DFD1FB6031072A5B4CA764EC4677096F267388093AD86BB25A0F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 8a825891f6cc65501bf7321df363b1d933001abbcf15c091809a59a24c1a7b80
MD5 b06eb6b6654a9489b8f1b8e1f98dda0f
SHA1 630c30f069817d82ec59aa95054c90c0a3875c06
SHA512 9482cda15a5642066b99442f24fbd9f918d3eea39d7ec19a4e9df935879c01dfe6b27506a2ef3c05b5e0f49b8a8cc94827010e0bcd53123c58f8f47501871fcb
SSDEEP 24576:E0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3O:EDb5+Pl6bJTIZ5jdgps
TLSH
T1EF6522428A6A6086E4BB5778D8CDD710B83EBF65CF8566E7C529142BF1306C97C7230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 09a2c72319d2a4658e931d1f2d2598d519324e957fe26e415739cc5598810ffd
MD5 11ecb6515ec03e37781016a377586862
SHA1 75bde7625230eab4355a9948cc8718840cdfa95f
SHA512 ea5debdb508693da5e8f32026863a13a80740e9abce1dd9fe882155714264cae446161230bcf3e54ed07f672fbab5673230b9013fa6ac9a48ca65879c62853fb
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bYGmb57GBiOl6a8JTth/RWZvR6wQQ92pN3R:qgb4mBIBhGFqb5+Pl6bJTIZ5jdgpL
TLSH
T1CB659E1E22EC02E5E0FAD2B8DDAA4417D6B278164731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 dc92bdcf8ef00057abb89538385c9ae7b5b18616e3fccc4d1b0157b31ef96dea
MD5 d43c4f90669e8f460029ff91d7032f40
SHA1 3a9da8d54e9361b19516c8450ff5bae2ac6e6004
SHA512 35facb8f3210e4265286aec198a3fc2a2992d955161aadd2983c1b0154cf4ca9c2376be9f496e6c6ea8e8aaa4de41aa4e550f38ad7b385561fc14579c78c3a75
SSDEEP 24576:iG88u8FpJqH1ozria7/mDmb57GBiOl6a8JTth/RWZvR6wQQ92pN3X:57ZFPqVXa7/Rb5+Pl6bJTIZ5jdgpp
TLSH
T17495F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 bd188a6912b4ea7088270474dbe65f7f723dc3ac10e553430f0dbc52c533e68e
MD5 30874365a3844a7bd1ab6a0c9eb7868c
SHA1 fd618fbcadc73fd53f0170820ec9374dae57dd50
SHA512 3c397ef79ae17445c8eda5c7eb94df6608e81a1fe8d4a05c96e6f95a704f717ef43838508c4844daba4e3969ebb2b2abd5a9a99271c38a22240d0bfe7ca3772b
SSDEEP 24576:/PUr+NQ3mb57GBiOl6a8JTth/RWZvR6wQQ92pN3h:/JQ2b5+Pl6bJTIZ5jdgp7
TLSH
T13075E11F26AD18D5E67AA17DC9C68709F771B8624712A2DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 73b2e3bffe2fe36c6d86c5cc86a97bbea9bd926565188d1c71910c14cbdc500b
MD5 e11c15224bf927b2e14ac61c5dd519ed
SHA1 1fa77c18b94bd502e77709b43cd06cd991338bad
SHA512 68f83ef1fe817193b5b609b8e5842f14cbf3a3b3af2cb924c1ab2910b1097ea979ab88544df0047202a3ec0159ff608dc44ed95626c2674afa0d299fa6efa059
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmb5+Pl6bJTIZ5jdgy:6G05lO43b7slgJTIZ5Bgp
TLSH
T1CFD5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 89962439dd41b82a1c246a1b6b2d957d62434c14957611f83f946c795bba2bae
MD5 78d23b5ae6ee44b5c69f6119d0b13f58
SHA1 1d0033db7fd8b092e2d2b6c436cdc70ffc403d54
SHA512 1e1221bc4b82731f1d8d2a121c742a2130fa3687290b9b414e9646a6e625983c35f6bd9f00510eefb73709c9ec80ff49add7be8f975c9927e697b882a4166843
SSDEEP 24576:Dfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnpmb57GBiOl6a8JTth/RWZvR6wQQ7:7a5POZ3lJt2pasx2+m+b5+Pl6bJTIZ5Z
TLSH
T1AE65AF5EA6FC01D5D1B9D17DC583861AF5B1342653329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0ba6a4e98db565e4e66f1a32349f5ca0678a5ba4b885f67fb4daf3b1eaa083f8
MD5 0676962a4f7a0fa993848bde0e1d03cc
SHA1 738d2657cc3495ac8c83c3a9d1fe1734e4863043
SHA512 6c9ca1f4159d6ded104b5dbbe0e155c4ad04513d29d5fe6f367bb8777faf7e0fad4b6960ce86e37a40ada63936bd09228d0e2ed3dcbf4b8fddea4d18e82dbf69
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7Fkbmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:vNc/zEOVHFxb5+Pl6bJTIZ5jdgpS
TLSH
T1E5858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e06bc1c824b395e67ebfebcb340ed0fd55d0b5686142eb102644372e4707e43a
MD5 1dfc7d76e586e6a26afbfc56bb2563ad
SHA1 65a8c572e77979e466f029f30905453e83ed8ee7
SHA512 8274205538339e5685840e9211acceece940b8c6c4eb4b0c4b8295f43bb7a9c93a12abc9b886dd5433f18e26e594fa05966a86d038b625cb8daddb416436a886
SSDEEP 24576:LzkNvNnaFeYhJNtmZBm1mb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:LzMwBtOm4b5+Pl6bJTIZ5jdgp9
TLSH
T1C055AF6EAAB805E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 ba729871931672b194d44cbfef05b6e7bfbd3283763aa5fb885b2d29e22bd6b8
MD5 278f52be63300813f10c2aa77f28921d
SHA1 f852e27bd54caa6f2703ecc1c5f8351ff6fd1535
SHA512 8a4f4d4d2a3c41f76974c81eca7a664447da553f502d0e106a2aedbee4ce218d6c836e0735ec6d1e435690599d1aa80efcd585ca518c65778793e3c66ef1ba5b
SSDEEP 24576:sD3FHshBIYQgAgmb57GBiOl6a8JTth/RWZvR6wQQ92pN38:sDVHeBIAAXb5+Pl6bJTIZ5jdgp6
TLSH
T10585E17ED65D00E4E47BD27CDA938A06F67138A9472266DB02D481BA5F2BED43D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1132-402-0x00007FFC6A2D0000-0x00007FFC6A476000-memory.dmp

Download

memory/1132-382-0x00007FFC6A2D0000-0x00007FFC6A476000-memory.dmp

Download

memory/1408-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1408-135-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1408-125-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1408-131-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1408-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1936-49-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/1936-38-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/1936-45-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/1936-44-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/1936-52-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/1984-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1984-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1984-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1984-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1988-64-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/1988-72-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1988-66-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1988-292-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/2588-312-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2588-106-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2588-100-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2588-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2588-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2588-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2800-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2800-94-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2800-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2800-383-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2800-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2800-88-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3452-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3452-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3452-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3452-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3648-276-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3648-53-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3648-54-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/3648-60-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/3908-119-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3908-113-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3908-121-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/3908-311-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4108-82-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/4108-307-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/4108-77-0x0000000000690000-0x00000000006F7000-memory.dmp

Download

memory/4108-83-0x0000000000690000-0x00000000006F7000-memory.dmp

Download

memory/4520-328-0x00000000020D0000-0x0000000002130000-memory.dmp

Download

memory/4520-0-0x00000000020D0000-0x0000000002130000-memory.dmp

Download

memory/4520-331-0x0000000140000000-0x0000000140798000-memory.dmp

Download

memory/4520-76-0x0000000140000000-0x0000000140798000-memory.dmp

Download

memory/4520-9-0x0000000140000000-0x0000000140798000-memory.dmp

Download

memory/4520-6-0x00000000020D0000-0x0000000002130000-memory.dmp

Download

memory/6036-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6036-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6036-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6036-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download