fae568cf068cdf3d3a78f8f7ca965114c07e99c9f271dc1c2628ae6f430e7a03

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 7.9MB
Sample260808-nmjldazvcs
SHA256 fae568cf068cdf3d3a78f8f7ca965114c07e99c9f271dc1c2628ae6f430e7a03
MD5 c211a5292a85dad5eff73360dee1f787
SHA1 589b54ebff8d325cc661a8ba77cb1a30e60462ce
SHA512 a3cb6c26e29e040ca4bf0043b691c523f40c9bccd1a5640dcc144d8fd686071e141b2cc79d47ae0898287e9a9f052f06fc8f070b5e7cfa708bd61e41d213417f
SSDEEP 49152:ZZTdrtfSe0cJxAHD8pOSHMPHMkynGyrlqL6OBw0cqUB7985atQr6s2fiIvGQJRd:b3/LJxAyIHLEXgyDlMI8Pd/2TjYvH
TLSH
T12D868D1EBA6D00E8D1BFD1788A57A40BEEB17895033996DB66E08E550F13EF09E3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3316	elevation_service.exe
1208	elevation_service.exe
3636	maintenanceservice.exe
1104	OSE.EXE
1248	PerceptionSimulationService.exe
5000	perfhost.exe
5760	ReFsDedupSvc.exe
3584	SensorDataService.exe
2736	ssh-agent.exe
4708	AgentService.exe
2764	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6c53da195387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031aea16a2927dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a263a6c2927dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006eddf16a2927dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000860340ae2927dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074f3366a2927dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe
1208	elevation_service.exe
1208	elevation_service.exe
1208	elevation_service.exe
1208	elevation_service.exe
1208	elevation_service.exe
1208	elevation_service.exe
1208	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4912	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1720	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1720	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	4708	AgentService.exe
Token: SeBackupPrivilege	5760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5760	ReFsDedupSvc.exe
Token: 33	2764	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2764	SearchIndexer.exe
Token: SeDebugPrivilege	3316	elevation_service.exe
Token: SeDebugPrivilege	1208	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1720	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1720	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1720	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1720	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 4912	1720	2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	90
PID 4912 wrote to memory of 2420	4912	msedgewebview2.exe	91
PID 4912 wrote to memory of 468	4912	msedgewebview2.exe	101
PID 4912 wrote to memory of 468	4912	msedgewebview2.exe	101
PID 4912 wrote to memory of 468	4912	msedgewebview2.exe	101
PID 4912 wrote to memory of 468	4912	msedgewebview2.exe	101
PID 4912 wrote to memory of 4880	4912	msedgewebview2.exe	102
PID 4912 wrote to memory of 1904	4912	msedgewebview2.exe	103
PID 4912 wrote to memory of 1904	4912	msedgewebview2.exe	103
PID 4912 wrote to memory of 1904	4912	msedgewebview2.exe	103
PID 4912 wrote to memory of 2140	4912	msedgewebview2.exe	104
PID 4912 wrote to memory of 2140	4912	msedgewebview2.exe	104
PID 4912 wrote to memory of 2140	4912	msedgewebview2.exe	104
PID 4912 wrote to memory of 2140	4912	msedgewebview2.exe	104
PID 4912 wrote to memory of 2140	4912	msedgewebview2.exe	104
PID 2764 wrote to memory of 3948	2764	SearchIndexer.exe	109
PID 2764 wrote to memory of 5128	2764	SearchIndexer.exe	110
PID 2764 wrote to memory of 1664	2764	SearchIndexer.exe	111
PID 2764 wrote to memory of 5488	2764	SearchIndexer.exe	112
PID 2764 wrote to memory of 6104	2764	SearchIndexer.exe	114
PID 2764 wrote to memory of 1092	2764	SearchIndexer.exe	115
PID 2764 wrote to memory of 5984	2764	SearchIndexer.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.9.1432.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --mojo-named-platform-channel-pipe=1720.5568.13059697457127947979 /pfhostedapp:304f86c2de99f8e790b9b012b112bfa3bb85b563
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView /prefetch:4 /pfhostedapp:304f86c2de99f8e790b9b012b112bfa3bb85b563 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc440a5fd8,0x7ffc440a5fe4,0x7ffc440a5ff0
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.9.1432.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,16550742453799670300,11797279842941050898,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:2 /pfhostedapp:304f86c2de99f8e790b9b012b112bfa3bb85b563
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.9.1432.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2128 --field-trial-handle=1776,i,16550742453799670300,11797279842941050898,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:3 /pfhostedapp:304f86c2de99f8e790b9b012b112bfa3bb85b563
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.9.1432.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2248 --field-trial-handle=1776,i,16550742453799670300,11797279842941050898,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /prefetch:8 /pfhostedapp:304f86c2de99f8e790b9b012b112bfa3bb85b563
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView" --webview-exe-name=2026-08-08_c211a5292a85dad5eff73360dee1f787_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.9.1432.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3480 --field-trial-handle=1776,i,16550742453799670300,11797279842941050898,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --variations-seed-version /pfhostedapp:304f86c2de99f8e790b9b012b112bfa3bb85b563 /prefetch:1
    3⤵
    PID:2140

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3636

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1104

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1248

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5000

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5760

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3584

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2736

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3948
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 2832 2856 940 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1664
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 2892 2900 940 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 2832 2856 940 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 2892 2900 940 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 deba4abd832ac8d925bfe378b9ec529c92f40d784ba62494edd3f164b4cbc360
MD5 90a4a1b935d2e5dbcc368c1c08edca13
SHA1 9df112caeb8512f6f5cf3e97f180df7aebb3ec20
SHA512 01afee6d27b5045952f8da8ba283558933a41d6e08150b24f18486759211e0f81b291431544b0c17502314fc8968d0e6dbf21b827a8966a979f7b33d57780ca8
SSDEEP 49152:Sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnCMdFrIe78vH/:03q6sjBmTjYvH
TLSH
T163D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 5c88095ed6252ca5bbc736d0ca9286a9350261c5c744ce9db96ce8409405d716
MD5 e78422717061bd1756b34d1a4e4930eb
SHA1 e936f19e9db67b0e914e750347bad5741f3ea885
SHA512 77030474ff02479a2d09fc5e83ba4e5829062e5b90463620f5d61bbe801a15dc43fda60318255407a74587f247617aae94707c0a9dae1adad0ce8a294bb5e08f
SSDEEP 12288:E1XLsswWkxy2lRq2czAY+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjc:CXYfDtczARMdIuwe3zfIe7xmvH/
TLSH
T1AC65F129A3D508F9ED678278C8A28112E672BC554760E7DB03F099362F337D85E3DB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 4e79f8a559705b01208b2236f97062820666f02e28be2660104dfb4c25a2d33a
MD5 b401443138cd947c21e9ee66e3522500
SHA1 f799272c53fc4021ea8b1ce5c8be3773bb461144
SHA512 b1b0d0747a5cfbc58327733098ac6da85711a8d56e83f03e44f136bd74b4354947419d2149f736e057d643072cc9da07380526f78697170acc48261c37f83656
SSDEEP 24576:30Le5ji0hmxxrMBMdIuwe3zfIe7xmvH/:3Pji0AjEMdFrIe78vH/
TLSH
T12785AE16F6748331D073C0B9C5D2A69AE97130861B308ACB4296D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 218bec4b137c516a22dcef5be146beff45cfbf6bbc6a0ac937b611639785ad01
MD5 7812a2bb5987e82cba39a206271d075f
SHA1 d969cb7b7679998cd390049cd7963b863406dd1c
SHA512 6892796d914537aaf8f2821bd30c02f88a2ac0adca756c11bf6bd9066eebaca1f77b57409be13a000989631a5c13e13825f7704df33d67813c1ae6d39065ceae
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWn6q8wyufMdIuwe3zfIe7xmvH/:C/ezSC6vUzPveHjywMdFrIe78vH/
TLSH
T139756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 04ab1938a442aa697004a4179cd0583cb863628c8aae036b85cc03597fa39be0
MD5 fa8937b45455091f790c87a8e7b86c65
SHA1 f7a6dae74aa266627cdd78e20f861eb54c1a0e96
SHA512 6c3036e5b30621a0501656dfe04b43011b92310b1ac77bd64c8870ac1696f75dac57137562e9697b90ca9f7d23cd60503a7bad8852289b70927a2d1bb18d8f1d
SSDEEP 24576:qVbqPb88hv/l+YGMdIuwe3zfIe7xmvH/:qVO88hXl+3MdFrIe78vH/
TLSH
T13F559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3b24f58504252d9882b0c50afe7c458e8ef90e16666701f6ec5b73ac731725b4
MD5 79be46e675e30e4ea17a627c05981409
SHA1 be7e9178d28ea29ddb2c38c3865e28179d80e1b2
SHA512 318f94c8002be0ea6beb47ebdf60fdf8b26ef4d49543a0f4cb64de67593f00c8d1f98f24c4b7ee0c0bff48f92c639b3df629fa62c07fdb700780d90495808b7d
SSDEEP 12288:UL0+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:ULVMdIuwe3zfIe7xmvH/
TLSH
T19E45231BCB86C4E6E79A89B0A45070F325A4CC6E58519EAFCEB07D3A7778D2BD0C4117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 92ca9801a33ec20476c7537903ff97ad970ef491c57369379317fb8dc8507042
MD5 341474e34ca4ba8d21f238eb81152734
SHA1 5830d5d386e82961652b9137e7942bc004d6a904
SHA512 1509bb2dd16226d30ec72e6246569af88e2a292a09d5c34756a663ac9ff4d8ae4e5a40618ac1bbb177e9c1e2dfdec497ad5e5f2c78d27e49747b3d34ca1e8731
SSDEEP 12288:meBNUbTVO86UV+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0t:mJIUuMdIuwe3zfIe7xmvH/
TLSH
T19065CF3BEE28FCD2C27A8DB856918240E77278314F62A3CBD175820EDE235E55D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 adbce979b933f7f0e8ae41e2f760ba009edeef8e7e4b709ee9546a8939e441ee
MD5 655012fa6352f5a39a0c2bc146b8f6e6
SHA1 7b0e21513c8c509ebb438db7b0348092994b692e
SHA512 ef2f62c665e01ac113d6e7c037cbcea7bda9b66e51e6f6cf6430335447c95a709279cf466c4655c42be2e3957ad5465707aeab047a2863b9fe259b28a2e3b4cb
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THg:OQvGAdlCEL8c/DRNw5CUTjYvH
TLSH
T1EF267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1d88bfc505bc36958cca4532ffdc50503c2e99628aafb34576f3454d4a0ee820
MD5 7c0bece26939def43aa8db7c2958aa4b
SHA1 84c5c57a07784370e4fe9d2e0c3de8fa5825b749
SHA512 c0944f78ebf0b0c542e3b946a846505225deade1e64f5db244ba7803dfc475f81ad89c69714d59fc6ad565b1a296c0b4e4464343df2e455c8f463efe4efdcc29
SSDEEP 12288:mAwSfxL/2Dc3RDLLmt0LDQewsAjb+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIp:70ewsAj0MdIuwe3zfIe7xmvH/
TLSH
T11C75E031FE75D036C3BB0DB21B26D716147CA9204B511AC3E3F89E9E6A346D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7fecf6dbd64c906b39137eb926b64ccf45d170c2088110d0c7cf0f88eee77a9b
MD5 e4dec1fe54c0785e715444c8148e89a5
SHA1 dbc861c40eead402189c2d305994209f101df2e8
SHA512 8ce7f8ef5c389d1135b60c3dfbab809ee8a8f98d1b546e206db117f38d7f6a4d57edf6b6540e48440c8db0fa7d9ade245621ec12925575b5e32032cb121b42a2
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHnv:tUEtQevvqc2W1cpV2tI32v
TLSH
T17F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 66f3b30669e5902d6006eea3cf22fac154b2160eb943fbb109eaf23fb7afd670
MD5 ab9712812aa25f94265359a08a07f6ea
SHA1 a1acd16da6066bd63c484e6614f725efdf41f3c5
SHA512 55dc6d5f65476183b6e284f4d699d9fad38c378b6f4ec5694a8e78befac0ed3f0a2273e02685df67f65b9c8bd1ae97fff3ba6e0519d467504bbcc6aef490e56d
SSDEEP 49152:jCbRquA/m2yL5zTfFiV+XenmE3/zUMdFrIe78vH/:coquVjnmwTjYvH
TLSH
T158D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1286e9400e274145933dd5f03184c03fe79ef835b774ef61ef6a94929b1b5594
MD5 e5be7355bd207033a4e160abbd2cf376
SHA1 95e93e45dc056dc914d2c8b91c50fad455b45415
SHA512 4e7b41798e2574875d5034613cd67e14b1b6a31700c382462c8fe576402706b29b07eae74ced5119cd49a51a4111d414b160cf7794dcd4bccbd6c08e97918fd1
SSDEEP 24576:oAhGL3IFoiwtA5l7S53rMdIuwe3zfIe7xmvH/:oAMUFoiq57MdFrIe78vH/
TLSH
T14B35AD81E7F945D4F5B39AB899B69171EA76BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 4091c4b0df98543a4b3b393211ada857fd05784c80d729ed6b1ca564ba5b6002
MD5 91235e481224ff45391075fc3f87f39c
SHA1 32d3857aaa17b8578c1b342b9906bc5565a2fd5e
SHA512 f35ce643a486304da874bc3f69698384e52671ac2db7d364c97e59808ce193ea8b946262054252cbc14960a78061887537ead980b59abf38246e8ac6556fe0b5
SSDEEP 12288:wmw5HEjsChNVBFgl0WDm+CD+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xml:twu4OWTMdIuwe3zfIe7xmvH/
TLSH
T1DB65F14A76A50CF9E9A781388557D132F7F2BC162A21DB1F4770C61B6F37221AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b5c0d85fb6c9b1cfc0ea5fc15b2933c6d242120d9305191740ff099228304a0e
MD5 3d2e29a9f2f652d377b874aa539b84e9
SHA1 8e63ec291b5beac5cea22f38d3ec047e9ac1ed57
SHA512 0f21be0d60186556240a0c4ca7bd957ea054fc8bf079b3a47f684bbbc768b5e8059cc0c82a9be4c5ac5ce8047653e018dec442e76e7bd74f862ccb16309c4b21
SSDEEP 12288:6eZ1Iyr+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:XZuJMdIuwe3zfIe7xmvH/
TLSH
T1E955125A23D460F9E2978578D8E05196E7B1BC6B273143CF4A704A6A3F32ED65D38323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 de92d93841a7a5c677ea71b4f6bb83dd1451bafd7c6da68699392548f7d1db87
MD5 dabbc7fbc505d0d98e3bb182e5f31d6f
SHA1 420ddde3459de41bc193da13d191497f29dc339a
SHA512 2aada711106e66eff82fde30a2d3be52db13a64b1ea4bc4737ccc12bfc0e76e7773173dbcf63f79adc04503a36be49c1681d886654110081ce017ea87cef4c0b
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uk:5QRQyi36YOcPbLvw2gAf+PN35TjYvH
TLSH
T191667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 71b596f27a179e5219a62d83e275f68d0a25e16047ba1cea9e83f53a256d8492
MD5 8990a427cfedc75ee706b781fd49487b
SHA1 627a41709fd2b61feb064f6031fad7c7929e060e
SHA512 14c807eea12d29d88cb18e6a7e9e628f1eb9836d159cad9db7f5ce8c7138f8910adb750df0cd68a58925fa7492cefe621a27f1a9842c11567b831b337b36aa15
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uk:HQRQyi36YOcPbLvw2gAf+PN35TjYvH
TLSH
T157667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6d7fa1da5d9d21accd86c124f796294b3924a9f81ff78cb40cb2ba3a9f0e2d0c
MD5 47b04384819dcc8431be10cd5ff77099
SHA1 3c5468dd3db806629fff79b10d7a3acf3d5dc324
SHA512 0a2e5f002e84cb66762f04de496fe62328f80aa73a0b09b4dd72660f79dfd81a2fa33e01e657bafa4b8e9bb3ec9b1733d4f6c47e8699255d7940f941b43ad37a
SSDEEP 24576:+wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0ZMdIuwe3zfIe7xU:I68Qg55nhceWu7PNU3/EMdFrIe78vH/
TLSH
T188B55933B2F200A9C44DE1769F4A973196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5521ef18a368fe539ac52eafcd2697d048811f7cda7de506234d383f57dddd16
MD5 396ca6ee83414d8d77aaa681e6a92512
SHA1 d8015ab082649a8ab28b163c8e328fa4d4c0c8ef
SHA512 0f64e4c0d903e966844c07bb24fb9c9347e317acd7c9e57a27e4ff1052abf0fc6cc6b5e1fae9a10f768e3c33948c056a90052dd42614cfdb56e21727d25b5e02
SSDEEP 49152:+3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99O:/y5112gYy5azzVvt69nLKnhZWTjYvH
TLSH
T1F3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 99a63fdd4e1a0d0580a7fc5ab7c2475bea83aaa7be9a2d905b6d86b839dc8530
MD5 e4bb1ccbff19aef97e0e7f69731597c7
SHA1 1055b68db07b51f03ba0db2103d229abf8b73ef6
SHA512 7bfb663a9e2937d9c3d69ed607968a3969f42f11fe590047cee451514887e56df9cd8b346a53de932bd4bb88ea440558eb70274b08a0dc5895a6e307f00375b8
SSDEEP 49152:gB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glhMdFrIe78vH/:6u6Jmdxd2dCTjYvH
TLSH
T1E5D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 01b6832c1b24f14c1bd75ed2166a0cafd4a7fd5948d8ebd4aa3e1566d61e636f
MD5 4265b9e17a8c9014b1230c042c33158d
SHA1 2c7d12393aa0116e67715390e16a806c0ffb285a
SHA512 13a58a3da5c1f6356704846095f5936d412918d618a34defab587c9ea2b09c02bd81a49cd7ad02fa1982f54f7e4aed941c196d60bafc4a89c9fdfaa7c8f2dace
SSDEEP 49152:51hpsNoJpF1A63U44CwH7R4xOMdFrIe78vH/:5mifPWRwTjYvH
TLSH
T134B5BE13F2D901E8D05EC17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b561193e233f2f68df24f2d409733a38bc7916690f61f08540582a532784174d
MD5 61e2aaf6c269009fc43cd8f3631e6b81
SHA1 f1cda392ba6a46abd86a45b5dfdf08bc7bf3b366
SHA512 4af2f912508583a88875146d90a81526498f97ac19ad9206bf93c9aca457fe04e038e7a94a89dcf486574e1afca33e97849592301584ee6168fb88e0dee9317b
SSDEEP 49152:PSuZQIY0Be2KcRVtOnks6NMHqJMdFrIe78vH/:15dKii61KTjYvH
TLSH
T110C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ebb929d2935fe6c67c00d162e273fb5aaaccab660922065553280e4dc5363307
MD5 cf937079493ba8dd132179e031ad3da6
SHA1 49b687f17964e2422f87fb2660356e76d1c0be8d
SHA512 e40432adb5c78d6078c5738e799963304f12fed0e11531934a6cc321ec22f5579d9a89619dc92ef4aba71744ff775cc0678b731ad2d0782275e69e8752bc0f0a
SSDEEP 49152:0htSn8EApI0fig3giDn0AP5wCMdFrIe78vH/:VX2imphMTjYvH
TLSH
T18995BE13F2D900E8D05ED178C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b58a83e2f832976aaafbf07df1272fa27b70202effbf11b16e0b2845b372aeef
MD5 ce29d3122e4c1b4af803f76ac4ff8eba
SHA1 b2db4fb9793bfc293bef5a183b488a92a01fcf15
SHA512 c904b6782acaebf03f349adf9e9da6d57c958d10b66b588714684e972a3994c47b820405b0484ec16d5ee4ec32c1bc5f907ef4ad99261a3096a1e8754c0f6ddf
SSDEEP 12288:2c+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:2dMdIuwe3zfIe7xmvH/
TLSH
T1DC45231BDA9BC4DAE3858AF0904071E36598CD6FA95249EFDFB06C367B74E2B10C405B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9ca8edf7df2d0180e6ed1c3f4862c28d459653ec75777e778e21008d509573cc
MD5 0982d23d05c451dcf767cf78b923d351
SHA1 df158041559d4b423736a39c581082ef39984dbd
SHA512 add83c62879f6c046ed74bd3e6d7ecf911e9b48d808214a5c86ad919efb6db15f76041a8daa0987892bc013052e2a8b39a8302e33e348012815bcbecd2de28ce
SSDEEP 12288:AH+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:AoMdIuwe3zfIe7xmvH/
TLSH
T1CD45231BDA9BC4DAE38589F0910071E36598CD6FA95249EFDFB06C367774E2B10C805B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 928a9134c68c9e171e02c73fad22e18d2e31277c229b35fac3fc12826f5f7f33
MD5 fdd0120864ee4362eb379947a604d556
SHA1 4888c712acf4c2271fb4419d12db333d62d24151
SHA512 9ff54ecc240771ff7dca4c3a8ba0f73deb28eedc2a2e4ce6536a69f51a0b0fd796ec1061786b34bf4a4719a45e33f5e73e0068d6e21517ac18934c8c369b7c01
SSDEEP 12288:N9+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:NWMdIuwe3zfIe7xmvH/
TLSH
T13745231BDA9BC4DAE38589F0910071E36598CD6FA95249EFDFB06C367B74E2B10C805B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 9a5f2e2b3fc998f7c94352024d0ed3d6e4c9665a1f76ae83c7c482535094d8d4
MD5 e87bf5df8324b13176c90870793e6c70
SHA1 b1a5c4835087d7029764e1f66e497efde6f1ab5c
SHA512 16e7c8adc4dbc00c2f5a9fed5e8ce8115a409561f2ec7048f113604217a55cf0062557500f0609e16a90fab501571eb7513bce595da871105808890e73dd04a5
SSDEEP 12288:ZVK+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:3MdIuwe3zfIe7xmvH/
TLSH
T11B452317979A80D6E695C6B0C45060E3A2F4FCAFA6324BEFCF301C2A3F70B565494657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 418207cadefffae11794ec1cbce8070415fdf3476e031da9f9aa9b8121febaf9
MD5 d02ed5c41f977e97795de6a3f975a9b5
SHA1 9443333eb7816a632a0dd98b4c1e450a9bff84ee
SHA512 7e37f7ca638009dd2bbace806dedb9a5d361f0ae6f21e965ee154602d76357a2ff40905bb087b5d0b58e222cf580d03e7ae7b8a3a2b89a6544455d76db936dd7
SSDEEP 12288:uC+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:ujMdIuwe3zfIe7xmvH/
TLSH
T15C45231BDA9BC4DAE38489F0910071E36598CD6FA95249EFDFB06C367B74E2B10C805B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e6a6a1b47ca8fe11b4d566de6a529ddf6853ba40164bcbfa0e97b268123c86cf
MD5 d21ba10e3dcefc5d8ff474bfe424e95d
SHA1 f221f0fcc6d07995a47a3c58f986c3025c865b15
SHA512 c7b44f17f8905e83178852d9d48054839637afe4afabf58d0cff0689d0f22546cc901a5dfba71e82e94dcff37c0df18e5298d0ac55251e7c94fa5415e01aac57
SSDEEP 12288:JD+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:JcMdIuwe3zfIe7xmvH/
TLSH
T18945231BDA9BC4DAE38589F0940071E36598CD6FA9124AEFDFB06C367774E2B10C805B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7baed38d36b2e39c701c93149c46a48a5f4cd4bfab782bd128e47e5a1e02c851
MD5 81e76a14c1d7f4a543360ccbeba2049e
SHA1 0deae667e9ea2afadaceea2e8fdb802d072cc98d
SHA512 924776a976c4730af4b7874c5e6f686e525844e73c7a283d422c2f4b8265c5e4d553aa179ea2524f2ed491d57af4f1ed5cf678df18294af4ad472a6c7b93d393
SSDEEP 12288:4f+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:4gMdIuwe3zfIe7xmvH/
TLSH
T12B45231BDA9BC4DAE38589F0950071E36598CDAFA8524AEFDFB06C367774D2B10C405B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 49d7ec35eb1fcaf0da694910381134b7460136553d0a9591949fb947af165823
MD5 b9f277b9d36afe2cd548c3d54fd94ed5
SHA1 4793770fb3dfa73f917e74ab59351ddf89278b61
SHA512 8b1f6784aba80f3e9393f930a0ea65dbba456d927003b13b458fe23c200574ef88537c95980f4acaba1704da7070f86a03e045cb576ec4944adf165ae0dec8f4
SSDEEP 12288:MiZwbVzzFEoS2cPvyn+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUM:vZMRzFVSOIMdIuwe3zfIe7xmvH/
TLSH
T1BD650295B39008F8ED67813EC9119956D2B1BC6A0B70C65F07F43A276F337A11C2DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c7ea87f74c63a3d3c063d0674bf6c88ff1eba913bdc40659d6a3a3f54a42ae4e
MD5 ed8a640794476675c78d3a408b384698
SHA1 719765c6e7b4cb708a2e43f0a2143c0e060043dc
SHA512 43761488d108a6210802b9467dc5b47a9ef6e4361d780f31e49c8bac34d0461bc987b6f55389ac5a7cba71254d146a4b94c511eb301877ea84cd69114d325e50
SSDEEP 12288:BA+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:B5MdIuwe3zfIe7xmvH/
TLSH
T1C645231BDA9BC4DAE38589F0910071E36598CDAFA95249EFDFB06C367B74D2B10C805B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 edfb2428c4eb55807b88cbe7953b20b4128a59820cb97159cef564ec9a6f0b1a
MD5 7c053523dbc0cb1ee213c9e0d151286a
SHA1 41c2ad7b209bf695d1ef5aed8ba719e23324f263
SHA512 4f2e7bb16456c6ae5af821496e2719de7f9453b611817e8ccfdc501fd4eff120f14946514766a1ff887bdaeb4828efdf4ffe4c1b6eb990f04b0ea46d7c2f7087
SSDEEP 12288:3E+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:3FMdIuwe3zfIe7xmvH/
TLSH
T17845231BDA9BC4DAE38589F0910071E36598CD6FA8525AEFDFB06C367774E2B10C805B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 1ed3e5c817968772afd0ca78ff765b8e8aaa89fb13ad445fd6facab65d3e7255
MD5 94a37fbf1da5faeb733b3c809970b0fd
SHA1 e6c6872a990b7c197fa4ff26a100beeee187ca03
SHA512 b912c9bb2eff2decacc64151ea27702e5ea03cb579dc5f385329c15c56922edcc4814e035ffa7271f94e53c3df3727073c492b150de26e27c5e0e8ae6b1a37e1
SSDEEP 12288:GyPz5L8r+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:7zykMdIuwe3zfIe7xmvH/
TLSH
T13D55121773A620F9D1668278C8512692F3B1BC3A47208EEF57B00A363F376A15D7DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b088bda779b8d40bced76cb4229b8fad927349cfab1a330441be29ae14bfa231
MD5 cc5df0c3e81e79aa27b4b1be480aa225
SHA1 3f76839a673d6246b44bc11ccf80091614b5c46f
SHA512 232eadd492eca046234547c7d2cb3f46c05882787d142c26fc2a911bc3716e4a23030f21061d6962633ecc2b0e4521ec8f345bbabd5103ce659ad2025de0beb7
SSDEEP 12288:+A+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:+5MdIuwe3zfIe7xmvH/
TLSH
T1F145231BDA9BC4DAE38589F0910071E36598CDAFA95249EFDFB06C367B74D2B10C805B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a3e5c56ebd3a3e7faa593dec8e91f932ffe1e5d093c5eaa2cecf916735df322a
MD5 56302c688b84af35c7e927a82f78f5b4
SHA1 67170b1f99f29241c8396eac322a2dc38561b0d6
SHA512 57c9c0d66ff655f8ee9109272221da3bc3f73c8747321199b45318b0401549440c1defcce0b9ebf1efdec62d714ec744d0ed34afb7b6c0fc4452f0705f3ce0a4
SSDEEP 12288:MA+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:M5MdIuwe3zfIe7xmvH/
TLSH
T15945231BDA9BC4DAE38589F0910071E36598CDAFA85259EFDFB06C367B74D2B10C805B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 1f9b8522fd586b3e5084b5b61cbd5652938a559df5aa6765afc9f78f9bd3f090
MD5 0d4db43c1d3f2e2db0b61f49c3341fd4
SHA1 c03faf4b04685d2e23eebbc309360b896e34b70e
SHA512 359a93188d26f5d7b64e085fafef0c352edd215f075f32b638743f934eba6d33a8d4b8a7b1990c7ec033c6440a97636597bbc0829c663e3b90fdef5022ff3d6d
SSDEEP 12288:xyPz5L8r+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:gzykMdIuwe3zfIe7xmvH/
TLSH
T1DA55121773A620F9D1668274C8512692F3B1BC3A47208EEF57B00A363F376A15D7DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 29b571eb7e9fb0f80779ac55a669a0b89fe6bc0669733d7720985b64f4d15eec
MD5 04b09ca1425d60bacd36e9553edc8251
SHA1 171a419bdb81332f4706613cc5a09bfcc92330aa
SHA512 8281a3a0e19727b86f316fb362b2e4ba79d7272648d856002c3361779fe16815d42ab815989f2e34805430641a25e5b47bdb0df045dba982bc8a4f4f12261a48
SSDEEP 12288:8Cd9CWYoaLHF3z0z04PDvht+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xml:lTDaLl3z0zDmMdIuwe3zfIe7xmvH/
TLSH
T15E6502A5B39048F8ED67817EC8119556D2B1BC6A0770CA5F07F43A2B6F333611C2DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 93d8bb9cbd0a301679482358abdf5362020b2d4ce8682829c87ab23fe64b336c
MD5 d26dfedde81c5eba7871583bf7d184ca
SHA1 45edcfea79d0bad4e87ea17ea76a1a03b999d60d
SHA512 e4f505afb19458fd6b927bd4097a14b416f9c4de8b7ed671ca690e7872cbfe2eb51df6bf1bbb8e0d67bc3a9623910072d13c6f50e45d7b345c66df0cf5669213
SSDEEP 12288:7i4e7KRdTfgwCHKy7GLbbdIvu+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7o:73vd9CHKy7GZKMdIuwe3zfIe7xmvH/
TLSH
T1E375CF91F3E414E8F1B78A3589765512DAB67C5A1B31DE8F03A4251A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 f1958bb9b08fe571df0330050c14a525b64646d624bbdbd8b017a76f93bb0d8a
MD5 7655adfbbfaed068493c2d2baa6b4c66
SHA1 a5ea3383fcb2c6d54025b4c36d42907a37158b8d
SHA512 4a80a76dd42911801ccefbeeffece16ab8f0674c2ceb87cb6c769921f94ca7dd460feae8571e6e607341c82210c2820f7a5a1b70dcd6505e8639087dfc9fe6a8
SSDEEP 24576:xfwvUk9RX6wkyAIOMdIuwe3zfIe7xmvH/:rMnYIOMdFrIe78vH/
TLSH
T18785D029EBDC44E5E1B7823C89B3464AF2B178691B31C6CF029A536E1E33ED45D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 24859f2e5f71bdc4743a7041b78db91c044ba9e25a3883895ff4fea3a072214c
MD5 7da52dde6538eb99dd4b465962a32113
SHA1 0718116ae235069ddbc26d3ff8ca6494a0c6ee67
SHA512 8afb227117ddf80c6cdff45c38727728d1f66009d8c0aca25a7fee273869e4029d8cd8e53fe1f4d75653fb65c84ce73cc07efaf1710def8604f88e2bb6f01382
SSDEEP 49152:1YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0xMdFrIe78vH/:4ySzP6TjYvH
TLSH
T19A066C56A1A841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 301c560ced936dc75a5750917c51c3c8162035edc4485375743774575dfa46d0
MD5 9a14c7d1f32068e0923cd1c0897ffcf5
SHA1 20d3cb857aa4b42e0b464b20bba7dcb791618efe
SHA512 67d54d96f2692337fc3b6a4583a70431c0e5e911ae2d3085c8a8e1471b41bf26a718906e47d1e20422f64e3e440df4cb16fd2eeab3ce05648fba612438b76ad5
SSDEEP 24576:j47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY7MdIuwe3zfIe7xmvH/:j47JUQjTirIhCnDHUPfF/hMdFrIe78vf
TLSH
T11A65AE1EA3EC01E5E1BA827885155A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 f39ee7ef957311ed3ec2b526acc54fc380eaf9c331b1ef57d8bc2b138c987920
MD5 9c5f037a593c8593d41bfabacb718f3a
SHA1 c4de0129763c898ef871f03467f306adeadbdbed
SHA512 17618a95a05d60438f36b4c914a4218666f384d3749d5ffd36c85756bb79459f63f85d93790d41a440d70d39de54caf0beb6e65dc5a404183b70b059be6ce359
SSDEEP 12288:hbsfw+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:8JMdIuwe3zfIe7xmvH/
TLSH
T16355011AD29842E8C06E9275C7415681B3737C2A87E1D3CF97E0F93E2F36A915DE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 9e48ec59c365c5138c4040094e522da949de7bc683f8da0db9158177ccf5bb2a
MD5 ee77fd237ae79c16d0860119a2e3c77d
SHA1 a5fa5c9c996e3a151d8e5d40e87a736bbee18e9b
SHA512 497e777dd03965d9f34cc8cd5f3e736a6a1f368599b5a2ebe4da5a1a25f7f50e0da563fbd888cdde8e3bb86a609946b3ad43059c9faff9595b49c6628f058061
SSDEEP 12288:LjSP/9U3fdtPxJqULSOmHG1/a0khOjPRYRRYHrOBjNz86I:LjStUPeULqm1yhhYPRYR+HKBjNzPI
TLSH
T1B1451640762BD78FC6A950321E37D6CCA7707D01EE05AE0773C9873F8576668BAE5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 93cb1a0d7766ad453a3842b84c4a4532b53360a2b562ef60db25636cad97f5a5
MD5 e6be63567651f6fab7202ae026657694
SHA1 48f4b1debf2a8a8255d7a19487dba2bc6f592c76
SHA512 4097ca77cd2bc82e0acff78ee96f89d6840cedd735cb63b6b6b0e1c9cd34423b3e00daae761e1ecb2f2705b1385bc37aab2cf2b931e20372b96a88efe31cb2b3
SSDEEP 12288:MV/coZF1A7epygyO+Hn1hRe+fWTOpsREQv0H5EW6BBbgFHkneB6hl:MV/cO4NLHp1DPupgFEnS6r
TLSH
T138653A4165A7E35FC9FE9037423286CDAB746C06B7453F0173848A38986B67EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0b9ebeaffbf5e331e47d4117cab973032ba5531d566bf0e687a9250bf509db90
MD5 990dcb8b87d3b422739e00e2d288f44e
SHA1 7082507029f9287da16064960de515026c33a5fa
SHA512 0f2dfdb3edfebb0b63ece1a88c7599c9e844faacdb3cc82ff6e9fa0e7032e71f5bd2358501d49ee8a27d41fbfc79459ffb2982a7ef88dfcd0a9b7d5850b68510
TLSH
T1D6D0121732210234D81021370002790C0540D10BC10F40009838865D9B081A41906561
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 847c0b698e4ed3d45308e4e4737540fb68c59104cb44d11a2ad6a0ecc7193d20
MD5 801f4c1a14a344cc388f3d1e11201d64
SHA1 d6f020e4aaa3d931d4e9f5832904813ac237560e
SHA512 e7249cd7feb1e3938ac9b9db72575ff88bf2fceac4cce723e2d6273fafa71c55f24d99a0a55b249ea2b4e5f501a63c83feb18dc87693a78aeaf234ee01b41ba3
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Local State
Size 2KB
SHA256 f88b798c028123c6aed8978366281186c3ffb79cd0dda4e1ebd5f4a4837b1a7a
MD5 62e3694ee73e072a55595c2c90c3ee8b
SHA1 234341bb1b10d3bebe8dfd60affb6eebddad0c7b
SHA512 293032ebb757cce397fca7a220228917efac2d73a747481e5f4e8c6f0f2ab5edfbe9ba9d32ca278c06d2fe28d263011d151059162c40742255406c9a3cd51366
TLSH
T192519373AC24AF379AE3870879567F139F7A906496612F609ACD1F2C05C628C2302C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Local State
Size 3KB
SHA256 cb4f9e30f7d7789f7815fcea2a065905cf862c3daf9d88bcef0ea26efd69813e
MD5 378354108c7fb5e73e375e3fdcc5c664
SHA1 a5bddd2595eda3259a14459bc9f05249b41df741
SHA512 7e4045dfefaba4bbe982a11e81978453ceeabfab99398996c12ee47e140a925095db2a860a0b5dde6b64162ed7624b21eb813c31a6030b136245d38db035e9d2
TLSH
T184719263A974AE375EE3DA08B9863B03ABA5502795913FA4CAEC0F1D01CB3C91342C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Local State
Size 3KB
SHA256 8d3d61bbc2df7026a19296070607197b88f22c09c65c9170cb9066ca54ff3491
MD5 9b6c30e456716a67624e12a4b4c04112
SHA1 e32482255f1a06699160f975c2e90bb4eba53f80
SHA512 b697e0b481a55b465a2a0762e0fdc2223dd69df122789baf283ce4b2929c723fc81948da4e61e0592a1fb6d3da2ca06b5ca57511744e4ceba27324af1c1218b5
TLSH
T1F7616473A934AE375EE39B04B9962B06ABA65026E5913FA4CAEC1F1D05D72C81342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe594617.TMP

Path C:\Users\Admin\AppData\Roaming\CCleaner\EBWebView\Local State~RFe594617.TMP
Size 1KB
SHA256 cd63b55bd164019f0e6405ea4628e8c224128d284d92c3d18901e2ec9202730d
MD5 eadd0366debcad61164f968111aef237
SHA1 a77633f11201eef99d1507ab36d6867abe9109a1
SHA512 06447b7a1a7d639cdf84fcfd80ecd60d06cbedb3056fdec73cae9ecda793528ac8278a33a0fdca294f20cded8fd6a258576608245dc90777ec23511e93d8ef6c
TLSH
T1252162B3E8245F32AC83A7492263BB471F72502982200F50A2CE1F6D06D61CC6667D33
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1c5f8370eae73da9e5885d60acb5a3edd05ec65de3719b0b5c3dd81bd70a914a
MD5 dba7b7d9dff4b35bc00f150fa230373e
SHA1 144881d8f39c96e612a7bc99ef09e8bc98a9f397
SHA512 49d976a1ec97fda9f0ae8f888687ff70089bb8618a2462ee9111c2f7726c1a2025a2f25bf90a7e26ac85e3097434553055c0245ee3a056af23d08a02e1e91b6c
SSDEEP 12288:C07J+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1T:TqMdIuwe3zfIe7xmvH/V
TLSH
T14B452317C78AC89AE6A98AF05015B0F23158ED7E5F0089DFEE202D3A7734DDA5CE411B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 ba28bd68500fb61e5acc9a1200da3f34eec322535da5fd620be2530187560ff0
MD5 8eff351ee359c576e32456ddb27ae77e
SHA1 51d0f58185fd513ad6d5ac748ac95ca19bbc2b29
SHA512 35c8439cae429b291a55701c4ff2bc24ba656614b3148f5569d81c3dca278629ca4370693ea8e4df30b2d5a6d9f5cdcf3f1c95ff6097da47da47c7eeb218ae27
SSDEEP 24576:iG88u8FpJqH1bzria7/mLMdIuwe3zfIe7xmvH/:57ZFPqVea7/0MdFrIe78vH/
TLSH
T19385016577E101F1D47BD138894246A3F6B1B8250364EFDF0BA88B552F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9b55d9e655995f3e73bc6852183c219b45ee899e2aed09d894511fe46b3e723b
MD5 6752f9a3149532aefecd054b6de39b95
SHA1 54808646805c345725a7b015b96ceeb967fb7fd9
SHA512 ba19d2eb73b1b8a7fb7aeb7d82faef531a201f96dc00f4e5daf3394bcf46d0663614db4b66b06cfec3a6e0b9dc9215f241c9c62cfc4689282dd0a8a87aba2c77
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPMdFrIe78vH/:eG05lO43bFTjYvH
TLSH
T119D5BF6A62EC11F9D1BBC17CDAC6460BEBB23825033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 796108a68d3661abe3e4ce1a266a67fd270529eb0c7c2c182a04925e22b541b0
MD5 95a4a41feb686fc346ae7a7b7c40e47f
SHA1 e882b1e37a7365fdaa461736a55597b9e5b12d47
SHA512 056385d696ee72b4c54ca3ef49a3fa54a3dde94f5476dbcffe2e9edff911f9748e28cdc3144504ddad6d3d2080cc15034951b7a6a2d33bd60fbc5f75de92801c
SSDEEP 24576:rfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnxMdIuwe3zfIe7xmvH/:za5POZ3BJt2pasx2+mXMdFrIe78vH/
TLSH
T13865AE5EA6FC01D5D1B9D17DC583461AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ee99539609cd9b80a6279373e686aac15d4b08b563575fdea0e28454d658806c
MD5 ea18b47339eb6254caae5d4c25bf11bb
SHA1 21ad7c21ceca05c612642b4d3d3191747f1955f5
SHA512 93ce5f43a36d67622986734d91b0bc6cca35536fc1c11058d9cfbdfaded2bd01d79845fb033ed281b2bc7cffd6bf55e300984bcab7f3c32247483f25b722d639
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7FkzMdIuwe3zfIe7xmvH/:sNc/zEOVHFUMdFrIe78vH/
TLSH
T12E857C1623E901E4F5BBE1BE89779546FA71786913308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 1.4MB
SHA256 7211884f00a33358ae89ab2fb4e8ae63d81a399005aeb3f64182d4249e8b678f
MD5 7bc5ac7f723b396cbf6feb0325fe987a
SHA1 a44651c09db3fa774ec68ae8650a06df96212d04
SHA512 77fc73e98617e0a9a389a7e6e65a5211444b87e81bbecdb4a1cf9ff07f7bc179cce5f37c879057237a0d9cc0d0fa81b7cbd088b35e91ab239338f6f256a732b1
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bY8MdIuwe3zfIe7xmvH/:Xgb4mBIBhGF7MdFrIe78vH/
TLSH
T116659E1E22EC02F5E1FAD2B89DA64417D6B278160731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f97ad7c1db79b2530e8ea092dff0a502c382b59ee9c6015c48e16a343243f2dd
MD5 b710978fe7114f35ea7a710ef52fe7bc
SHA1 5676467eb6ecea080814a18b01c2138ac04fe5a1
SHA512 605dd70380a49aad89bb2d5dbd371db45fabd61fb6674b7437c4079b0bdc2e49c68df6081a9d822e48c5f47392d477169f8b7a4c4317a5d07ae737b112ec9785
SSDEEP 24576:ITkNvNnaFeYhJNtmZBmNMdIuwe3zfIe7xmvH/:ITMwBtOmNMdFrIe78vH/
TLSH
T1E355AF2EB6B846E4D1FEC6B4CD238112E6727861073293CB9290C13F1E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 fc68260167ca874c9c8a8ea860fbc96787cb58d68d5267cf39056a1e00864db7
MD5 6c8f498104509299c21c6d11b75f079d
SHA1 fe946453585b0fdf81f2acf784db7948963a5497
SHA512 5ae4b7a74ba63c02af753949c0354a4ab5190f3f9fa9763a537dcb74e2927cd7a6e2821ffe71b290c131e74d7d492a23e019de14d60574f62df73bbfe672bf01
SSDEEP 12288:NHvUrBFrEjwaQ2+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl++:NPUr+NQ/MdIuwe3zfIe7xmvH/
TLSH
T1F365F12F62AD18E5E676D17C85828259F771B866171292CF02E0813E5F37EE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3e76d13d4be1ce24fbb0d53fb88efaee1cab35134bd80bb7da6a9892c7e228f7
MD5 39baf30668509678c027ecb9c08d20ea
SHA1 16e6d8754b48f64a6b17b044b86405706901bef3
SHA512 e802ad2dc68448ac4cf4ec394fa8499246019a3cff59b466552c49f17f811302a3e0002aa3a719d02d666e0bc7c76a4a347c2802bb5048fc1f2b1a0acc0de9b2
SSDEEP 12288:5QcMxWDXN1Dp/fshBItT1IQgAd+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByInec:FD3FHshBIYQgA2MdIuwe3zfIe7xmvH/
TLSH
T18475E13EE69D04E4E57BC1BCD6538606E77138AD032256DB06D081BA2F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-235-0x00007FFC64F10000-0x00007FFC64F11000-memory.dmp

Download

memory/468-436-0x0000023DDCC20000-0x0000023DDCD36000-memory.dmp

Download

memory/1104-74-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/1104-67-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1104-446-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1104-68-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/1208-247-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1208-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1208-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1208-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1248-539-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1248-86-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1248-80-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1248-78-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1720-0-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/1720-314-0x0000000140000000-0x00000001407FD000-memory.dmp

Download

memory/1720-9-0x0000000140000000-0x00000001407FD000-memory.dmp

Download

memory/1720-6-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/1720-93-0x0000000140000000-0x00000001407FD000-memory.dmp

Download

memory/2140-236-0x00007FFC64F10000-0x00007FFC64F11000-memory.dmp

Download

memory/2140-380-0x000001E26CCA0000-0x000001E26CDB6000-memory.dmp

Download

memory/2736-581-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2736-126-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2736-120-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2736-118-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2764-248-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2764-286-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2764-261-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2764-585-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3316-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3316-17-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3316-130-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3316-23-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3316-24-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3584-582-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3584-107-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3584-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3584-584-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3584-580-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3584-113-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3636-65-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3636-53-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/3636-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3636-63-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/3636-59-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4708-143-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4708-132-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4708-138-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4708-172-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4708-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5000-90-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5000-556-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5488-596-0x000001872AC80000-0x000001872AE03000-memory.dmp

Download

memory/5488-652-0x000001872AC80000-0x000001872AE03000-memory.dmp

Download

memory/5760-101-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5760-100-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5760-94-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5760-600-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5760-598-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5760-577-0x0000000140000000-0x00000001402C9000-memory.dmp

Download