7f2b83a86f31bd78510432551ba35044ace72bcee05d1be938053619f664cdfd

Analysis

max time kernel
151s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Size 6.0MB
Sample260810-rd82fsgf75
SHA256 7f2b83a86f31bd78510432551ba35044ace72bcee05d1be938053619f664cdfd
MD5 1ea4a045f0a27363877e2f6b8b842bf2
SHA1 73c4df215d4b004210dda8ea85dc397e10a9f12e
SHA512 5498d327567b2750c678a8dae0f37f85b8b9af68b682713b188b04e1792b496da2e302284385c41d7c13362eb421fa2c386d9ef75c816a79586173a1fdcab229
SSDEEP 98304:Xl+0x9FjO509xZqNcxfH64NWgr28z4V5YtH:1hx9M509XqNcxfH64IF8zM5
TLSH
T13856AE56A6A450ECD5B7C178CA468617E7F2BC0513719BCF06A0A67A1F33AE12F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4660	elevation_service.exe
4680	elevation_service.exe
1308	maintenanceservice.exe
3528	OSE.EXE
3968	PerceptionSimulationService.exe
4356	perfhost.exe
4596	ReFsDedupSvc.exe
3736	SensorDataService.exe
5248	ssh-agent.exe
4240	AgentService.exe
3064	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2cc30682957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaw.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000374dfa6ed128dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0fe4caed128dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010338571d128dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057cd06aed128dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005813c86fd128dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000449e0670d128dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da422172d128dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b92585aed128dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017c1ac71d128dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
4660	elevation_service.exe
4660	elevation_service.exe
4660	elevation_service.exe
4660	elevation_service.exe
4660	elevation_service.exe
4660	elevation_service.exe
4660	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeBackupPrivilege	4596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4596	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4240	AgentService.exe
Token: 33	3064	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3064	SearchIndexer.exe
Token: SeDebugPrivilege	1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	1204	2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	4660	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 7144	3064	SearchIndexer.exe	101
PID 3064 wrote to memory of 940	3064	SearchIndexer.exe	102
PID 3064 wrote to memory of 1960	3064	SearchIndexer.exe	103
PID 3064 wrote to memory of 1056	3064	SearchIndexer.exe	104
PID 3064 wrote to memory of 2744	3064	SearchIndexer.exe	106
PID 3064 wrote to memory of 6768	3064	SearchIndexer.exe	107
PID 3064 wrote to memory of 3108	3064	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4680

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1308

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3528

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3968

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4356

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3736

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5248

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:7144
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:940
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1056
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 577c361de76a52e52d0a801b9d87d96848e32d42dd6f48d8d6dd78202f956b4a
MD5 cec9ac6a6880b8e1fabc72e0401a9431
SHA1 96ffa094c609962a29811d5fc2a339b3a35e83b0
SHA512 638efdc0e2d467a44bb6a090a44786600296d522b6f0b05b40c6365bc08ae3461964f6a9beec4669cd7b45d6a81626f3821c729110fa6d894775bd3fb4b14c4c
SSDEEP 49152:ob+632BuPkFKRrdE6ohdstBhuXjfS4LWxn44ZPzwFI/wOifnzH:C3q6mjBcYtH
TLSH
T167D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 eb03bb11797cabc55b7b5e9d5c73d23426a8fe8f6865ed1b32022217ab31b049
MD5 fcae0fa27f723c7bd39c542dccfcf47d
SHA1 23ee94f8089bad5a45d33afa67c2ad4892238261
SHA512 3c3b19f1c822428daa509184d3c69b574f4f34ce7cc4ce37760c3b53d249e8f4033ceecd6801896d35215efcb6494975547c7838d7e716eff4a1c2bbbffecfae
SSDEEP 12288:z1XLsswWkxy2lRq2czAecM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:pXYfDtczAXM3tBZPzwFa7/wOifnz20
TLSH
T1BE75F128B3E109F9ED67827DC8A28501EB3378954760E78B03B4953A1F736C85D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 e52eee80fa47a3ec454217f130b6e8ed027f1e0d498e7d45523b3264831f86ce
MD5 eebd518b779eeb685d2173b75fad44f7
SHA1 4e951217500d7efbbc0597881decf0cb82f29a0c
SHA512 bd57f17f926c4d3a72393a33087db167e4574ae2f08ea8287342ce6bb2f30dfaab71a2a3974380114497f94493ddd66fa835930725fc394d7ad4d4fc74a9c1ad
SSDEEP 24576:N0Le5ji0hmxhrMQM3tBZPzwFa7/wOifnz20:NPji0Azx4ZPzwFI/wOifnzH
TLSH
T1DC95AE16F6748371D073C0B9C5D2A68AEE71308657308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c3cd66376ea937c141e5c8fcab0c03b8205b863235db5153f0e28f9f1aa68360
MD5 9d9ccb7361263be3421370f88fd371ce
SHA1 14090faf0a6b6e5419babf6da8f5b48f30802a36
SHA512 6258d76aa321c91110e18fe1661e07e0eb42b1cc0188b0af8ffb15c40e22f5816173f8fac988e23a56691704da5f71ed985878d9797cfc1fb4c395baece7eeee
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWj6q8wyuuM3tBZPzwFa7/wOifnz20:b/ezSC6vUzPv+HjyV4ZPzwFI/wOifnzH
TLSH
T1BA755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cb452bcdb7beafb1312ac217251f87f0b4a3e8dbaa0cb712e0cc2cc53a89b4c9
MD5 545df0da6df6f92114169e1d5078a6b3
SHA1 9380f10262be2d97facd908ab8dd03e162cba764
SHA512 55f8f018183fc7ff649a08227f1fef69cfeb2d00593789de75c74a50ca9ccb313940495ead5b7df16b1e274ca1bc8140fe42175d70efc7c02c9cb18bdd15a4b5
SSDEEP 24576:EVbqPb88hv/l+BjM3tBZPzwFa7/wOifnz20:EVO88hXl+R4ZPzwFI/wOifnzH
TLSH
T1E3559E66F6748331D073C0BAC5D3AA9AEE3234415B318ACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 a4c3cc5ca703e1845385739fb515aa44079433e1a33049d648eb0ac622db947a
MD5 d830c1991b2a76f91bf474d9ced87939
SHA1 11ab0d2607d033c2d0e2f58edf44d555d14cbab7
SHA512 ef9a701fc37a1a03f6c4881cb529556b857795984d081ab06939a7aa61eec07ed0d743e293238b56d788f684e9f6d0a4f3a904b113d54e7de6e8963db53944d8
SSDEEP 12288:+G3cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:+GMM3tBZPzwFa7/wOifnz20
TLSH
T17A552382E79296E1DF511B7521E7E6028B09ACC85510731F5EB2303F5EFBD46C01A5AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 f5d757bf262e41b2e6c1fe9f2bf55aa8303d5d1cfe2913a90a1ebaff6897faa3
MD5 2e1af1e124d9d8eb7f692b0e86fbf2ca
SHA1 c9f2c34c4560b5a4203c55c348f87f380f0356cf
SHA512 16e8d983415575cddf8e1c18fac40153f7496224c51c1c8034635d927b35ecca6927c4bc3184d1ba853645a0879c912586c551d84721edd485301701347594ac
SSDEEP 12288:qeBNUbTVO86UycM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:qJIU7M3tBZPzwFa7/wOifnz20
TLSH
T18D75CF3BEE28FCE2C67A4DB95692C700D76278704B22A3CBD175820EDE235D15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 da2595bc4f7a0a4334c73223bf3b3c34707664ab29346e41fae8a85461e62e80
MD5 54b38a15c1b1941cf5b219e7ab1986ea
SHA1 9ce37d008e8f9dfe0b47024ac5654b3c79f66df8
SHA512 0ae9e5f3b3c0a2b98cdd0db6fd80643e102def3d3ca06cb8b59dde2dd75e33648179e08fe44502f603a52eb06c3a0685835eeaac284ecdba15f3f46175bc12f9
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THl:1QvGAdlCEL8c/WRNw5CfYtH
TLSH
T13B267C656BF880F5E1A7E138897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 bcbedb8412596734dc77500282372ff8c869c88df11fe555462c3138e4eeab0d
MD5 106971f429f0de96c9eb1fb9f1c9a5e4
SHA1 ad5921e94c64f34ddb74837b1d804f0c4add83dd
SHA512 b43ded8312cf1a7d0c518b83ac847d838cd0826f07b198b75f7cd24d5cf069814b4bdf80e5f00f42ba9a3aa68f836e2bf52486d4d0a01835c329350c98d97c7b
SSDEEP 12288:DAwSfxL/2Dc3mDLLmt0LDQewsAjQcM3tegtociOPyazluRF4KM7GAwOifEWDNRV+:8fewsAjBM3tBZPzwFa7/wOifnz20
TLSH
T1AF85E031FE71E032C77B0DB61B76C716142CB9604B612AC3E3F8499E59706D26376A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ec845b511fd4ceb02d9def8ef2ce6f7f6f914291b2980b118a9afcdcc8c15ffe
MD5 e037cebc989ebda1d9fe9263c6fa8bb2
SHA1 975f5a89b386fb9a774f9d7d63c465ee66c0bd9b
SHA512 4eeaf7c09ee94d7cbf3bb3d7bda78eacd89e1d47284cdd2b56e74845267a9fa17c46f8e931789831e60f6716f9ff5d1e9ce2c16ab25c876254daab5780a837dd
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHm:xUEtQevvqc2W1cpV20I32
TLSH
T172474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b328e849488643786baa86217ac69f46a1a87e16a42a160db8045a4a905feeca
MD5 77f40fdc002f17fd7dee3d9d294a6600
SHA1 6ad3b4c6f505da38182f0d44f9dd4bd1568c5a75
SHA512 ebaaeac21f18abe7f695017f416ab67dac8d7c3e9559885b5b354408de6ccfe5dfb7102bdb41639465510d6b9f0f54b1bdee73c4ceea58e30aa2b5756132ae3e
SSDEEP 49152:VCbRquA/m2yL5zifFiV+XenmE3/zh4ZPzwFI/wOifnzH:CoqHVjnmrYtH
TLSH
T191D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c01fa151660b15697ef6c5af65180a5412ffb4e2a76ff1f454505fc00068799f
MD5 39afacc85e6ae733c11e9e5ce2ad8136
SHA1 0b6866ac602b8bd7b8d9183b21da6426f8063849
SHA512 c478ded6ec107a1f5cceb1f5278f9ad3526f0d8c5e941c043344ebf2d27db330d30c4d2236dc219ef6c775f3cd8c739dc1ad7236d8a1c348d48a4b3fcf45e8d6
SSDEEP 24576:OAhGL6IFoiwtA5l7S53CM3tBZPzwFa7/wOifnz20:OAM5Foiq5y4ZPzwFI/wOifnzH
TLSH
T1C5359D81E7F945D4F5B3AAB899B69171EA76BCA95E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 b62c7ecda46a15d5d434da5cd33c4b78fc4e3c3523c5ca8f80d8a767aff341b5
MD5 796a4d2506bb561f30ed16bbf25773f1
SHA1 620f486ce5d191ac3d5b1bc53872235c5feba277
SHA512 6eb77153255c646ad3e1d0a316e92d6d6595960b049086166b0c3130e34f943038315670309999c3c43a50dbc6c9748029f7de98978f6da67d78c42aa62c267a
SSDEEP 12288:xmw5HEjsChNEBFgl0WDm+CpcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92go:swuROW1M3tBZPzwFa7/wOifnz20
TLSH
T1F075F14677E50CF9EA6382398597C136E7B2BC412A21D71F1770C22B6F77251AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 78447d3b3b0b05026d5f3f1ec2c66be2e2fe28b9b38a729e5b5dfcdd27231944
MD5 3cd63673a1ad0bafbe39266ec732c343
SHA1 7717283420d70301eaf32ad0f94e1cbeef47e76a
SHA512 3f8167937ae3e7a766f4aba584cc89df3efb5181c36c9eae59b691963dff9d622c518003726aceb116da8c992d591cfd8ef0c126884420e6ca1cbffc642b02ee
SSDEEP 12288:qyZ1IyAcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:TZuIM3tBZPzwFa7/wOifnz20
TLSH
T12165128A33E161F5D7A3427D89E29605D7627896233153CF1A71413A2FB3EC68C3A736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bdac7b45eddda53613816eff71e45bef0231d8fd948171e21e685bf015b429c1
MD5 84d23c5efcba853fe69d8a5fc481753f
SHA1 a5c215d96ce0bfb0062bf9e0b9a8dc53c40c9190
SHA512 e2c963597f570753a1da8e7d64fd6410a45e2e9219f48d94a45f6502c3b6c027c4772aa6580cb84162202f7d4505f0e8eb18516f0674a8424a18c396378d8ff9
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UZ:OQRQyi36YOcPDLvw2gAf+PN3AYtH
TLSH
T14B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6d6734b9dc3f9b8bc52841e26d04f657cc5e1f8af60fefa893f5428a4f569441
MD5 09add99271031436e6a88dd16ce40ccb
SHA1 69993e0410f1941c4bbf25f4f96f603c2ab6f78c
SHA512 12e7d026d0c46779087cb75223767e2f34fcd035129968cbbd6e14c778a81938c1d5bc4d3f46d84f7db45664711a1b0670179277927a092e9f5f250239541bb0
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UZ:OQRQyi36YOcPDLvw2gAf+PN3AYtH
TLSH
T1F1666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 56bd30f7bf9319c841fc6ede6252d806eb848fe38c23b0c47814dcefb78111a2
MD5 953a2a5eaccf69eeeecb57f5ac9c94b6
SHA1 8f95c4f69f03deae3912a4950d6acf1c29595e95
SHA512 86a907fbe861b28bfbea13a70f0f12d5962be73921904af59f4a4dddbbd9ef4a39a13026680de9bef762fa837ead3ce95e039247a0f7404e63f831607df13732
SSDEEP 49152:+68Qg55nhkeWu7PNU3/x4ZPzwFI/wOifnzH:MthTRc/eYtH
TLSH
T181B54A33B2F200A9C44DE1769F4A972196D17C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f03893f2cb9fc3f6bff96d2feff7a5938b3f8a9330cd1082df3892709c85e140
MD5 e60c8836e21e9487ab84909e50b26b32
SHA1 872c50a2754d8ac688ad04a1951aa125eaa7e706
SHA512 4d61dac94b6a227e920c3b7e4ce5a7ea918ae0de08100d6b088b92118bc85c2d58cec7b73ba1d57a9c6c409b8b99bea7dc4e408c1031737e741d2fcdaa4e4573
SSDEEP 49152:73aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk993:ey5112gYy5azzVvU69nLKnhZxYtH
TLSH
T17D167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e64862c279c3195e38f83aabfab38d728839ce1e83155738c36265126523840d
MD5 bea8d4ea4f343ae01920720b2db834c7
SHA1 daf36249bc8329cbcc2992b256250717e6f2ebbb
SHA512 4a066fde03fcea9a888afd3aec65f71bee26245d70a4739139679deebb258dd9aeb4a601716614717742d4c34d8d50ccb3d0768e5505b5a7f7551888733302b0
SSDEEP 49152:UB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glH4ZPzwFI/wOifnzH:Ou6JmIxd2dIYtH
TLSH
T1D3D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6101dadbb0289ad658f0f00319bac35a08a28e770f1ab6e23d2aef1b6ddce57c
MD5 544fa4d8c044b6f196ec37924b7340c3
SHA1 aeb98315e0e868d034203ca94e08dcd9279d61d1
SHA512 ec7499268da47290651d4fdacba10db5c7ae6028d1074b5e3ae725952959f3764497c8267282031c12d85e566a09495be50776a738d5e9700386ac7dfab2b378
SSDEEP 49152:T1hpsNoJpF1A67U44CwH7R4xb4ZPzwFI/wOifnzH:TmifPqRrYtH
TLSH
T1D6B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 17533c21958e079fd2558f3afe74873f9530a93a4371772a18212c1278eb91ef
MD5 2f166299ffda59e34684f30eb65bc55f
SHA1 239933a97cdd21eda39121d912ac29b7babb7706
SHA512 1f9480fc07f3ac13442c0e70f56abdb1d6efc5b48dad04f48999b74cb2b10a1af56bca9bce5ee63d8bb59263df88470350ed3e1cb2faa1e9a12f71deb4796a17
SSDEEP 49152:sSuZQIY0Be2KkRVtOnks6NMHqI4ZPzwFI/wOifnzH:O5dKqi61FYtH
TLSH
T1C4C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3cbf8ae5ad91220de07822e3e27fca7b78a9bb86f6ed0cda6bb18c57f3342d2f
MD5 fe12322115ebf9f21053ec2d0915a2a7
SHA1 aab56d54067fc80a596e1f3f560e3183c6a035f9
SHA512 2808abf115c57b9d15b9171bf9e86880e3be4938d17e8cfdf8d9f9759bb103a57442c6ff6078736860f78729f497c321aae10dcd6f90f1c5b1cf1b439594970e
SSDEEP 49152:YhtSn8EApI0figjgiDn0AP5wX4ZPzwFI/wOifnzH:JX2iWphXYtH
TLSH
T16C95BE13F2D901E8D05ED178C7468632EA62BC160B35B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 c17f3a9a516261fc483d8d9c02bf1f77c0506bbf3aa6d57c05d101dd4373094b
MD5 08b674c92401ce561ce0131641a7dd10
SHA1 a3047837093caf41d2e57057236a6957c56f742f
SHA512 6ad5c50915c4c814affba4c2b86f4d1fc17b2ecabb386187fd89f853f51fa7be4875e911857cfdba8d1875fcfef3b146e847c00fac893ce1ec615b46545807b4
SSDEEP 12288:K/cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:KkM3tBZPzwFa7/wOifnz20
TLSH
T19A552381E7938BE1DF015BB551D3A3018B0D68C9A611635F6FB2103B6FF7D4A801A9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 201aa98e45b4f530e3421aa3deabf92cad6a900d039d921564deb50a7ffe50fb
MD5 43723dbb14a919ac043bc26cd9d4ce47
SHA1 4ddb91126bfb1fa541330def7e2850e8d8dbd54f
SHA512 bf288fd082c80c1577cbe4fd946aa80b5e0ab0659d1285c4367e22276468bc51efa59ac342b8c629251529cb1b6c48bc377a1d675284f566b3b6629fae16fe7f
SSDEEP 12288:i8cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:i9M3tBZPzwFa7/wOifnz20
TLSH
T1D5552381E7934BE1DF015BB551D393018B08A8C9A611635F6FB2503B6FFBD4A801A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 edcf50170074dfd0d48d602121f09c168946ea33c58bd892f844769b801355f8
MD5 86215aefbfd3f9de522880c2caf31f37
SHA1 b85695a4d73b4d13c29bfd3932f415ffd2072e6d
SHA512 9046769baa4504436b751b79aa4aa572b3e89223406ed314c41e4eb31f123c31736efdfcb6ec9340982d2c1b80e5da499561346126f5a6a299cf51d9278cce9e
SSDEEP 12288:J6cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:JTM3tBZPzwFa7/wOifnz20
TLSH
T10C552381E7938BE1DF011BB651D393018B1868C9A611635F6FB2103B6FF7D4A801A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 379a7d0e2449dca3e64f932745bed2aa7dc39e52b74bed81febfad25578dc4c3
MD5 bb72a6a57dba791ab81b7c41811de23a
SHA1 ec2b4a82b3f1d6d53dedfd74f277cdc98c6eb21f
SHA512 8fc056337883221f87858e177333eabf5b5ae7168638578e25675f71c7a0dc0d908be4cabf3cc3e148bd05e437d72c3dee04b5935ad320a049030bed7444e97b
SSDEEP 12288:DV9cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:wM3tBZPzwFa7/wOifnz20
TLSH
T11B652341A7A346D1DF12977981E39201D769BCC8A731639F6F71003F1FF3E858429AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 c00ac89600ad279979685f27a760e0f889ab623111953864beeaef4b4b505dbf
MD5 4dea598789e3c96b164465fc0fbf932c
SHA1 82e9ad852a6da37ce4852c6efa9bad90a547b5ca
SHA512 323582a73d0a5d3872961ebf094c8274157d554eea4c66b90863cb4cd25a20b40aae4647ba9ddd6ba35a52a1a7255333ed5f3c22af0676fba29a5a6d2da82c29
SSDEEP 12288:m1cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:mKM3tBZPzwFa7/wOifnz20
TLSH
T17C552381E7938BE1DF011BB551D393018B1968C9A611635F6FB2103B6FFBD4A801A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 d27cd1e978d366121ef980d3eb2dc0efa61dc939c52afd2559c4cd6a703eb20e
MD5 f2fd9d5dbe4d4eb9d9ceebc7795d3057
SHA1 9c85d1a7c38da3778a0574f6098be203d2d203ea
SHA512 6bf85f1012196e05ac49c1a888aa33fc52bcfc6e1880404eee94608ae386be1e3121698d8caf05eb3b28539d561aac937e3b54c26bdab29fd1598826f3c5f576
SSDEEP 12288:BYcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:B5M3tBZPzwFa7/wOifnz20
TLSH
T120552381E7938BE2DF015BB551D3A3058B086CC9A611635F2FB2503B6BF7D46801A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 e717a9093c4bb06339c13cb882f79bacf0b5e9a5d9af787125153b1dbb784fb1
MD5 65cfe49a406f00a16d8074266554c850
SHA1 cb63093d22cf9d03d0630a85678df265c71d92bc
SHA512 8efefb74934b875e7ea9169f11e8926fe3bc4768b9b827ef479310dcb39fe518b334763625ca442be2547f2fcf6f36e33eb9e1d51e640d211e0a75115ef57092
SSDEEP 12288:D0cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:DlM3tBZPzwFa7/wOifnz20
TLSH
T1AE552381E7934BE1DF110BB551D3A3058B086CC9A611635F6FB2503B6BFBD4A801A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 09a36e7de70a5553ee75360d45863f60fc177d5af24ae9defe24218dc59266e3
MD5 119930f8c633601f0359f5bac64cd5f0
SHA1 5e1347bbf9ab1f4950d8485ebe304695888a5f8b
SHA512 44afe90669615251c16ceca590b1a1dae8eebe23ae65cf052358ecc21618d503a67fbfa7438513f04930e015eb545ba6a6cef1997a98c3945bd13bc8cf655140
SSDEEP 12288:eiZwbDzzFEoS2cPvyccM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:BZM3zFVSOdM3tBZPzwFa7/wOifnz20
TLSH
T186750195B39018F4ED63823EC9668906D6B27C590770C61F17B4322B5F737A14C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 38143d4920e68d4871dc708c88366b96d448b8062d325faf812765d70e3a4298
MD5 64f62b149803eeb44a1b64aa0dcff746
SHA1 d1ae3a957ce7f006b9698602fc8b1e3e68391554
SHA512 e16839614c654b5cefc30f47fbb0fcb662434fa6c574a29dbcfa6601509ef19a13467926b3e160ae175ed57dcf2155ebd180b38646deabdcf8cb1c76051fd408
SSDEEP 12288:OTcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:OYM3tBZPzwFa7/wOifnz20
TLSH
T127552381E7934BE1DF011BB951D397058B0CA8C9A611635F6FB2103B6FFBD4A801A5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 0a3ab19370c39517a45bf1acd489cf1a21e3a8e56db5d89865c6d1e74d4ff69f
MD5 dd3f94a50a145fafa204f7ab1914a26d
SHA1 6e52780f616a3fe10c6f13a1353a0a606e1c0925
SHA512 dc1369829057394b74e2d2b4ee4b4d00c8a3627178156f5d478f2c7d28c401549760bf8f6329a06cfdc04b282bfa37cac501ab62fdb746196abaf755e6de5196
SSDEEP 12288:BncM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:BcM3tBZPzwFa7/wOifnz20
TLSH
T192552381E7934BE1DF010BB551D397058B0CA8C9A611635F6FB2503B6BFBD4A801A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 28549f6c054af8412e80b470a26b4f4bf5e8b88d54c35fece8b8da815abe7163
MD5 c7c55663e3dee09e07253d1839dcf0b5
SHA1 8692937465f5adc63a0cbec4d2e03e19315a13a3
SHA512 d7f9773f156c2dd30f86b34f736f33e68787133f10fc267ab96392d3a8f581209dacbbdb17cd6066776e276be3cec078841c7f02a85f672e9d4c4d8d38b0bd2a
SSDEEP 12288:HyPz5L8AcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:qzyRM3tBZPzwFa7/wOifnz20
TLSH
T12E65024773A231F9D622823984A35A02E775B875472097AF17B0023B2F77AD19D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 6ecd25cc57d46180e4f64e498640b6505a6d86729a9c0c1ed1d3f6ce3b13405b
MD5 ac626e76ae9b2b0b33ed41acaa7b4d43
SHA1 12450de13d5b1bc8ab77437555cc6dd9844dc4d6
SHA512 66805971e33e2f1cc68fd869682f6bd3de4d6d4b47d7a3c4ecbf762e3df32112100925ed40fbb328b68063d7c654f1f4b297317b2c614c3e62e5040f7fef708b
SSDEEP 12288:lTcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:lYM3tBZPzwFa7/wOifnz20
TLSH
T1A0552381E7938BE1DF010BB551D397058B0CA8C9A611635F6FB2103B6FFBD4A801A5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 96e9efa34df5c762da2c5e4e4b4360050d36c12f557ce83fe802c50a8b0197e6
MD5 b414ba00628661b0d50bb56792e7cd1a
SHA1 c3afeff1a698b9e3a711eb7de118ff9816d1f7eb
SHA512 ef5bd8ad931dcd0c9a42f387fd7e34045dd52a841ca04a9f5417cd593d62e77ab5f42325e11d4ead2c3f8103a904994a28ce841034b9811c437b504286138ee1
SSDEEP 12288:STcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:SYM3tBZPzwFa7/wOifnz20
TLSH
T19C552381E7934BE1DF010BB951D397058B0CA8C9A611635F6FB2103B6FFBD4A801A5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 2bf988a8d10be722c2f3a54832c68c85dc25d923cce649b4310dbf988fa4a114
MD5 df4452261c4145a18df7af2b374eb7ae
SHA1 65e65acf4df94ee721db3412ccdbd59ec1bf13d9
SHA512 581840da2593c4d0d81351b984c95c5325183e534abdd5a2a4c51b8427ba9e601c5d81b50be4a3f7e7985c5f8f18ab46b48c264ab36199022e0cd2ff06c51e80
SSDEEP 12288:fyPz5L8AcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:SzyRM3tBZPzwFa7/wOifnz20
TLSH
T1A165024773A231F9D622823984A35A02E775B875472097AF17B0023B2F77AD19D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 fe928a8ddadc8596946344982abc41c84bb5661b2cc9d9ee2c295889ce78d296
MD5 929cfe5800e417e0d7cf3f479e1e5a75
SHA1 516cb66583333fad7816dac044a536556d1e7392
SHA512 f6ec6705246e92c1790cde537d1b4674348f9a9e6523f90796b1aa9dc274781a96fc2d3499b18e056de0e448d87a2bd983c9f9d4116c4f02f268a7714a94f737
SSDEEP 24576:BT8aLl3z0zDDM3tBZPzwFa7/wOifnz20:BT7Llju4ZPzwFI/wOifnzH
TLSH
T1D6750195B39018F8DD63823EC9668906D7B27C5A0770C61F17B4322B5F737914C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 fd84bcbe09aa1aae50d2b9af9b445c62dc7f7482315651a70b73299330a35287
MD5 75f54390f530873cffec1838ae1f8515
SHA1 39f0addd422f86d6829947c16bc0bb6179601f0b
SHA512 6de7b543c1c912b44cdfd2354f0f00b4294de3cca38264544a893ad6842b76c4d4d9602e22198d89c845adf9b04a3dc25bf1abac4029f11042e34b4cdbb027ff
SSDEEP 24576:U3rd9CHKy7GZvM3tBZPzwFa7/wOifnz20:erd9CHKyaJ4ZPzwFI/wOifnzH
TLSH
T15C85CF90F3E414E4F1B39A3589769512DA767C9A1B31DA8F03A4252A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 4736eb87721929830295dfb132d8b4ec479db419a07e6059619ad2b6ad1d3304
MD5 c96c62825ee9c580b79b4cb79b4ecf6a
SHA1 1d08f97c12aa242f96d836ae50d9a281fcab3535
SHA512 53fe3db1cc9ae1b6f19d82cd77f80e9587c5f1e53c4e87ca4bbcdf46d935a4166b5447bd67675424cc362be007ee75593c3e4276d8cfbcfcbe93016f073cc0d2
SSDEEP 12288:EacM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:EzM3tBZPzwFa7/wOifnz20
TLSH
T1E6552381E7938BE1DF011BB551D793018B0968C9A611635F6FB2103B6FF7D4A801A9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 05edbf8cb422be0831a141ec001b4fc5bbb266dbf8076b81f4ce1270d68cd33b
MD5 a52aa2797f771166962e8bce0bfd3f6c
SHA1 5d7e4a8ace88787e865e770130d97fc4c49bf830
SHA512 294da70966d02f3d23a004a3fa44d0a106cf148d97c848449506b4fc155991ab035d79b4ee4aeecfe2e31d94fa7c9861d0d342af88c95ab6abcaabd9cee9afeb
SSDEEP 12288:ZgcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:ZxM3tBZPzwFa7/wOifnz20
TLSH
T169552381E7934BE1DF110BB651D797018B086CC9A621635F6FB2103B6FFBD46801A4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 c6ddb05ec2549491db9f5b4590e9104ddc40bc61d87fed1b1f2725bae9211928
MD5 a5ff400f61407429fb0cee1625390d95
SHA1 7937b9736811bf3ee776a89239dde41d608ff8db
SHA512 0f218020411379a85fb765f7428a7347d69f97412cf1f17e7833abfd8f5270e085a9ac3a9a912273062c1cca4e4c57337a947681f162e7039c9a0d3e1796d08c
SSDEEP 12288:JBcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:JWM3tBZPzwFa7/wOifnz20
TLSH
T18F552381E7934BE1DF011BB951D397058B18A8C9A611635F6FB2103B6FFBD4A801A4FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 c6b143f0c86ffdfb8664de44c08c4568a9c57d563812fb0ec44914475e649166
MD5 50604bdf22dad02fa229b670ade31db3
SHA1 2432ed3cadf1aca3a0a5c006c724e653699667e6
SHA512 0822ca483a5170a77f7d9c3d9a9c2ec167a48a14dfb7bfefbed1c6cdb5a699c580a1921aa64ae536e903eb244edfe17f86d52a42cb8650e922e5a47477fdd1a5
SSDEEP 12288:RTcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:RYM3tBZPzwFa7/wOifnz20
TLSH
T1B2552381E7934BE1DF010BB651D397058B0CA8C9A611635F6FB2103B6FFBD4A801A5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 8defe34f1386371a684764f738d22753306e0839e2f4fdde0f6432474a7927c5
MD5 5335582e3c546651371557604c76bc71
SHA1 c0964d423dee314133118894b2046a5b4b3c97cb
SHA512 607e9d60fb3bc97d2d1da691968ec1b60eb44d57cc83edd923a608c2345c0f8250090876136d43ba4f44d004e820b9659320495270529770b8263c3483e61093
SSDEEP 12288:sacM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:szM3tBZPzwFa7/wOifnz20
TLSH
T196552381E7938BE2DF011BB551D393018B1D68C9A611635F6FB2103B6FF7D4A801A9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 a1eba7e063ea42b9d49c5ee7aa87c61969d42408daecd29056d63031c1533fdc
MD5 7368176eb85ee4c1f3dca5b1e27d4da9
SHA1 c7fb1169f7324a6b72dce8a88f11a37df1c56198
SHA512 36044dd1d354db2b5004430435ff89b3ee7394dce87e2308cf9fc78c0f7e212fedabb9e9edcef64f1df63a1f6d1b1e335ebc90686bdcba053cbb719bf3434ff4
SSDEEP 12288:FrcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:FAM3tBZPzwFa7/wOifnz20
TLSH
T11B552381E6934BE1DF014BB651D397018B0C6CC9A611635F6FB2503B6FFBD4A801A8AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 b819289723f7e8c5a150208f4f753ef8601bb9e60015996045c433a92724b1f3
MD5 019f8fd88cf66c88d4f9aa7e381a3e2a
SHA1 bc69b95e75c8f4b4e55820ce36d2895d8d47de06
SHA512 bd877485ef031aa1a9f2ce6bed66543d813d4a4e5f43b7892bec26c2e38351cc2e5a2913943eef636d3ec7fc16b5a051c6e2e4118ad4fb9bb1a4f182651ad7c8
SSDEEP 12288:D1cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:DKM3tBZPzwFa7/wOifnz20
TLSH
T1B1552381E7938BE1DF011BB551D393018B1D68C9A611635F6FB2103B6FFBD4A801A9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 a25ae597be4ac90dccf320e74dbb4330c28f5b28626442b93db572a98adcec1f
MD5 f0430a8ccf5673dcc60f67721116c9e5
SHA1 cd3b1c1cced26323fc77b4ef23794afd26b25cbc
SHA512 d0144cb5dde15cb5333321e412b507bbc037cdfba8b6b3bc5443620a426ea3d3fd1e9a3bac84c90ecf7e77750dec6b79061fd0775971b5a971f09d1040af5733
SSDEEP 24576:zfwvzk9RX6wkyAIsM3tBZPzwFa7/wOifnz20:mMnYIs4ZPzwFI/wOifnzH
TLSH
T10D95D029EBD844E5E177923C89F3460AF6B178591B31C2CF12AA536E0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 560250d7c5842e80734fb5d169e544a379fc0c9d2ff4d1be2fa814194fa3bf4b
MD5 bea82ca628b77d8fc9284ca6f6d372d1
SHA1 9e2df888e50fb8bff9e66913d182fefc9bef7ca5
SHA512 8c05b46b299d134e1e77ece4557adc35af229036977a7dd60f294f8707eb8a755afa6c798d457aed13ad1e620d1a6e0b79eac4249c33069bffcbef3126cce7d8
SSDEEP 49152:TYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK034ZPzwFI/wOiD:+ySzPgYtH
TLSH
T149067C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 af2da33e0756bbc7916c39e7897b2626802abb0d42331d26adce2cfb655277fb
MD5 57d0b1827dfbe88c4d04eeaecff78dd1
SHA1 7668881e11f7f4e80777e7a3010a71ea173f9892
SHA512 60f78a8220b78cca2cce2d12207357744134150bc851cfb66e7f12cd1769fe67f0e713a3002b7ed7418d3a7b1eadd8af21ad184dc52880254bd08dc61b967928
SSDEEP 24576:e47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYtM3tBZPzwFa7/wOifnz20:e47JUQjqirIhCnDHUPfF/H4ZPzwFI/wt
TLSH
T16765AE1EA3EC02E5E1BA927885558A1AEA71742D1F31C6CF1270437D6F63ED48F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 1fd34c5ea75988a0668451f825d977cfa90b81c98d7e49cf5e3df1564f66fa0f
MD5 a81cced48ec25b5972b1250e35f0b430
SHA1 e3991b219e143450dd3abb0bbe4a089086d18b51
SHA512 655b630ea7fb9d36acfc3fee6f344e5cc71f869391eeec82b479075beb96a5d29a906ebd03ca579c5471b0e58cf54c88037fe7b7ce6047078ed6f97580d062b8
SSDEEP 12288:ppsfjcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:KIM3tBZPzwFa7/wOifnz20
TLSH
T1FC65F149D29402E4C56E6279C7968601F7277C6583E1E3CF57E0F03E1FB6A808DEAA53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 5163c7c88c71056d62a15c7a597576d15263c4d14ee1884412beb5183ca5d336
MD5 e2aeaed826eecb917066ee45b3c83aee
SHA1 2903d931ceb26cc5e14ab5baf15f5170ff2ea835
SHA512 77818feb5ef824cb05b1592dabbd4e13449a32c72e912ab6fa6fd15ceb4ca0d00c333ebbfaa988f0b3f110a9464a2b998e8bb1db6d368aff50f974edbe08026f
SSDEEP 12288:07iBjeU3fQnUV/l+LDD50LqB9rVbV2At4MzPXb/HRsFuD78nDcy:07iheUPlVsLDdPBhlVrDr/HRsFuDAcy
TLSH
T137452941766AC74FC6A940325E32D2CCAB707D11EE056F0773C8973FD576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 64844ef5677b25bb64aaca3b47a1a40481193f48aad6e6bbc8143ad71531ecb5
MD5 c2c5e18ebd6efc54e3feebb5ac21f667
SHA1 11755a403c3ef6a7bc68748b1acd8171d0236118
SHA512 946335810ace0322e6a5a0aea76de7363dca6c8d2eb3193f8ccd4265f9204f44894ffd3533cbf32ae51de3e0a237dd304bbabcba7fa408d38021ebd019114104
SSDEEP 12288:9sBWKfDzaCkj5Q4CGk2TlQ+PAr7ndra1yf5e2bd6NAFaL64l:9sBW2Dz3Ag2Tf2bd6NAf4l
TLSH
T1D665F841553BE38FD1FB607207295B4CB7A4EC0677096F26B388453AD82A725A4FE3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 e7f005725df28ce6dd3d6c6fb87dfbc2b1d74eb10dd654eab5561153f0a65809
MD5 b48238537a15863892f2cc95a57e74f2
SHA1 bca724823a2794af331ef4d39c4c05fed1115485
SHA512 bbc1b33563710f134e713ba420e9c4e64bff3eb9308addb82f9874557718ab55eeb3b573cdff76cfcf5361a6778c222c585abb3a3318ba50636afca34537de5e
SSDEEP 12288:Kz77cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:YwM3tBZPzwFa7/wOifnz20
TLSH
T1A8652342E7968AD1EF211B7410D7D211570DB8D85B10A2CF6A72103F6AF7DC68839AAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 445675534b43539ce0605d784270bf5534034e6b8ef7ee5fed6198745326c954
MD5 0f3e3a633e47c098ed5bf0acff322479
SHA1 ce2a7567e0d69c939aae78ff535a641372709515
SHA512 dee7e917b989327e2f2b6659b1ba0baf3a8634555ca50df82e96ca5cd2495f341c45f29bacb3f7b046901300b2c2cffda488bfc29244448eaa44fa5d5262ba32
SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bYuM3tBZPzwFa7/wOifnz20:Ugb4mBIBhGFt4ZPzwFI/wOifnzH
TLSH
T1F465AE1E22E802F5E1F6D2B89DAB4417D6B278160731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 86db378d3118da97a17bc0f1a62f7e34e4b865baa79207ebfbbabbec376c0754
MD5 ab25b73e0c243fd698281f2b5063055b
SHA1 8875e2b161452189ce1350614dfc9130a8423641
SHA512 cbbe97bdf4022b19ca349e7e02687264fc6e8ba0346caac62f01733c1f4fddd8d26ac26abec89ca1b2f239608339df0c70d6d9eea18c83e654acbdbd95f0840e
SSDEEP 24576:pG88u8FpJqH1vzria7/mdM3tBZPzwFa7/wOifnz20:87ZFPqVya7/24ZPzwFI/wOifnzH
TLSH
T1CF95F165B7E102F1D477D13889874663F6B2B4250324FBDF07A88A661F23AD54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 554a880b1d82e1844fa248855e0c74d2a3e7bb9cbf15f94d00befa0cb82e597c
MD5 d093dd07fe66267c47ed2c7b1f656c08
SHA1 089d72bc7b524863fbb1daa2a2f03a268bf2ec7b
SHA512 83030c8e716307f6b34d5626add55a654c3099f620f09ef803c4cd2fc55e41534c89e664876f941b7aa0fc0e8eead533f04eb0768bd146ff8b3d0c0b2cd36c42
SSDEEP 12288:4HvUrBFrEjwaQIcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:4PUr+NQJM3tBZPzwFa7/wOifnz20
TLSH
T18175F11F62E918E5E776A17D85838709E771B4621311A2CF02E1813F5F67ED8AC3DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e5f9398731f76c55d9a71e84ca812799f0d469f58babe360d12efc4abddb8fa3
MD5 25e0613baa47d11698baede33d6534f4
SHA1 dce4d8f09bbc0b15f46648d275ff6dfd6d08e287
SHA512 b5c5f1ff97ad5b7f46c90ccc60b26b12d76e7441af74e18d885083a8104d91214994e57f85fdc7a3a551cd9f60b2da2cb4f92c7c4064949610f7b94f302db775
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj54ZPzwFI/wOifnzH:gG05lO43bpYtH
TLSH
T175D5CF6A62EC11F9D1BBC17CD9C6860BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cc1a46f9adca052e7417d636f2e617505e79aa5a35d4d601d025b9c4c3114342
MD5 edb3211cb60f282ae99659004cebef69
SHA1 2c0b1ca62a20c9f93696bfa31d7009e9a2ce4c87
SHA512 d3d553bf717c2a39f3ec1122c6066cab8ae90f4bbb2581e7d9df9024f64e002514e0b4dc426b5b9684de3ea86cf23d981d20ad57a295cf2fcf4a973c2fd3637d
SSDEEP 24576:vfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn3M3tBZPzwFa7/wOifnz20:Xa5POZ3lJt2pasx2+mx4ZPzwFI/wOif7
TLSH
T12365BF5EA7F801D5D679D17DC583861AE5B1342153329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ef853be44326d5c28beb743cc998580700433c10e3335231f636de4efa3515c8
MD5 d7c6ac56fec29deafc5922510e17b922
SHA1 b6a626c042b79548dfc819b9749f864876f17936
SHA512 26a4d82e66e56159786b9fc6f99ca4abe6cae9fba38f460c2bbc1e220de0a4acdf3bbd8b1823101b7fd9a51a607786f2581f92319f214b4025651d2b25d99e7c
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7FkVM3tBZPzwFa7/wOifnz20:KNc/zEOVHFW4ZPzwFI/wOifnzH
TLSH
T12A857B1623E901E4E5BBE1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 353898d2ed7c64c76935e2546cd5677355f167df99887b2cf5dcfea3b2616bd1
MD5 135bbdaefe2ad2025b5cdd8436f86a2a
SHA1 96a9466d5e0c7770c8025da6c64dd15a1c95762b
SHA512 993df1104ad2e414500d5ced67b410edc20185f967a418dbf54ef28f1c3a307ff67ab4f54b8ff8187d22e68522f2bb3d31b31e4ad0212e7c3b43655bc075c483
SSDEEP 24576:fzkNvNnaFeYhJNtmZBmLM3tBZPzwFa7/wOifnz20:fzMwBtOmL4ZPzwFI/wOifnzH
TLSH
T11955AF6EB6B846E4D1FAC6B58D238512EA727461073293CF5390C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 5780ab4e1550bfbe0344cd6f85fe8bc8c3b7102e7ece688a38f10e73d5d09da3
MD5 6a5a7b88b27637bd367b8870286f2765
SHA1 8773c70542d371a261f8b74d7768d986dc6f7655
SHA512 dbb6cf65219acf4bbecb63132336a8e508ef648d8da8c724c0eb6934db01a18b45c74f2ddd8b4af22da4ad8aee85d07c5b8a794c8e1e9ffb9e0c2fa6e14f52cf
SSDEEP 24576:/D3FHshBIYQgAEM3tBZPzwFa7/wOifnz20:/DVHeBIAAE4ZPzwFI/wOifnzH
TLSH
T16A85E17DE79D04E4D57AC2BCC6A38606E77138A9032266CB06D0817A1F6BEE46D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1204-375-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/1204-6-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/1204-8-0x0000000140000000-0x0000000140798000-memory.dmp

Download

memory/1204-428-0x0000000140000000-0x0000000140798000-memory.dmp

Download

memory/1204-1-0x00000000020C0000-0x0000000002120000-memory.dmp

Download

memory/1204-75-0x0000000140000000-0x0000000140798000-memory.dmp

Download

memory/1308-39-0x00000000015F0000-0x0000000001650000-memory.dmp

Download

memory/1308-45-0x00000000015F0000-0x0000000001650000-memory.dmp

Download

memory/1308-38-0x0000000140000000-0x000000014025E000-memory.dmp

Download

memory/1308-61-0x0000000140000000-0x000000014025E000-memory.dmp

Download

memory/1308-57-0x00000000015F0000-0x0000000001650000-memory.dmp

Download

memory/3064-330-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3064-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3064-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3064-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3528-50-0x0000000140000000-0x0000000140258000-memory.dmp

Download

memory/3528-51-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3528-59-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3528-167-0x0000000140000000-0x0000000140258000-memory.dmp

Download

memory/3736-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3736-324-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3736-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3736-109-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3736-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3736-103-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3968-77-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/3968-73-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3968-67-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3968-210-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/4240-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4240-137-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4240-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4240-134-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4240-128-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4356-79-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/4356-255-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/4356-85-0x0000000000A70000-0x0000000000AD7000-memory.dmp

Download

memory/4356-80-0x0000000000A70000-0x0000000000AD7000-memory.dmp

Download

memory/4596-101-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4596-260-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4596-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4596-96-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4596-89-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4596-339-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4660-21-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4660-20-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4660-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4660-13-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4660-95-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4680-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4680-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4680-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4680-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4680-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5248-116-0x0000000140000000-0x00000001402C7000-memory.dmp

Download

memory/5248-117-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/5248-123-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/5248-322-0x0000000140000000-0x00000001402C7000-memory.dmp

Download