f6f58a36e2bb6fdfe332e57d68f24046c785ae06917e2467fc6cf08d0ac786c5

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.9MB
Sample260910-11btxayxfw
SHA256 f6f58a36e2bb6fdfe332e57d68f24046c785ae06917e2467fc6cf08d0ac786c5
MD5 eb6eb604ab4b25bbed2fde136408eefb
SHA1 cbf66e0f2945515f20dd2ede04d0b27e5a6358fd
SHA512 6000085dfc393c3796d8c8dfb33ed71e2030ad10ba6e9c1c92db289c4da49e2a495c347fa5ed464534c351087b0c808d2d2a20da66b92d75114a5f5b10fc384d
SSDEEP 49152:TOAeQDh2Y6yr1fKjffYUAkiiQ72t8s+GpHsIwDmg27RnWGj:CFUKjffYUAkiiQ72usPED527BWG
TLSH
T18795BF1A63A801F9D1ABD178C546960BE7B27405132197CF07B88BAA2F63BF15F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3776	elevation_service.exe
5176	elevation_service.exe
2584	maintenanceservice.exe
4936	OSE.EXE
5680	PerceptionSimulationService.exe
4120	perfhost.exe
5796	ReFsDedupSvc.exe
2912	SensorDataService.exe
2992	ssh-agent.exe
5908	AgentService.exe
2588	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bef2228a238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000cdeeaf07041dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dabbb1ad7041dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d30e89af7041dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013aa84ae7041dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015b25eae7041dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e65294ae7041dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fee93bae7041dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af7f02f17041dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3776	elevation_service.exe
3776	elevation_service.exe
3776	elevation_service.exe
3776	elevation_service.exe
3776	elevation_service.exe
3776	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	5796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5796	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5908	AgentService.exe
Token: 33	2588	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeDebugPrivilege	5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5068	2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3776	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 4904	2588	SearchIndexer.exe	100
PID 2588 wrote to memory of 1444	2588	SearchIndexer.exe	101
PID 2588 wrote to memory of 2528	2588	SearchIndexer.exe	102
PID 2588 wrote to memory of 4404	2588	SearchIndexer.exe	103
PID 2588 wrote to memory of 4428	2588	SearchIndexer.exe	107
PID 2588 wrote to memory of 4152	2588	SearchIndexer.exe	108
PID 2588 wrote to memory of 5992	2588	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5176

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2584

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4936

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5680

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4120

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5796

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2912

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2992

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5908

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2864 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2528
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2892 2752 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4404
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2864 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2892 2752 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b9ce481645cbed82ff8a2271435789132f4026f510f1a5379d1bef334bf9aca8
MD5 30cec419820d8f945e3b42a0aca901c3
SHA1 167e778acd8bd8bba97efd0f9735a1beb0521712
SHA512 d363633e779b341693ee5aa70d2f82569a35a243c84710add8a5f1d33be266f2d7f35365916f76b31932b46d00c290e442bdd588ec62cf336e6902d42b21e308
SSDEEP 49152:cb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnvDmg27RnWGj:G3q6sjBsD527BWG
TLSH
T127D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 bf8423bcfbd0a95fa244591caeebda1ed7b59c2ddf7ac7191564fe09c05ac818
MD5 213cc1ba141d0b4c050145c60080ac9d
SHA1 f61824f1d835db8c0be1dcf87177be1a6b2deb76
SHA512 ca640bb27ee3903d12b50e2ef4aa5768b20d61c354c612d2db71eab5814c986a607c9c93860a5890ca55e62c0a5e40ed3a43180d1b065618339538f0052b2262
SSDEEP 24576:AXYfDtczA8sqjnhMgeiCl7G0nehbGZpbD:3tcpDmg27RnWGj
TLSH
T10185F129A3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 d3e384f264c472fad4c6acc990ec6927606257594c487b698d4177a84226757f
MD5 fcd4ec7d58539c97814249e2613d2190
SHA1 dca615ba138d605d5bc728e4452a9631b52e90ac
SHA512 df8cfd832f420a46c9c5bb282f8fa2b6ca098462d6cc64bd4892b9edee3f9d7935fe9f0de8fee7ae11f3085946c91998be69d77f41c4b7dbf87aae86779eb907
SSDEEP 24576:c0Le5ji0hmx7rMTsqjnhMgeiCl7G0nehbGZpbD:cPji0A5uDmg27RnWGj
TLSH
T1B1959E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f3cbb36b2ad1cc002cdda5a105b932eeb2365b3b9d44c59aadaa1295d95dd0fb
MD5 d450d98c6e1abd5ca7b869d1c65e476c
SHA1 49efc68004e6c89caf0ad42d62b98d6e67e7bdd7
SHA512 59a6325b77e70cf0f2103dbc1dfd1c0add77c25c5326f4039774e17c11092e7b8e6ae8822923cea3f27d158dcfb9487a3a8593891bedaa266769e9e8fc14de3c
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWn6q8wyuFsqjnhMgeiCl7G0nehbGZpbD:a/ezSC6vUzPveHjyKDmg27RnWGj
TLSH
T164755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 09f7f8708682fd9f9b62d817c079d09b93e1afa6d00899dd4261046ce7631f2f
MD5 984c5290fe67daac4f7523db9df467c5
SHA1 c89ac47c38c46f0cadf34fe35b8606f973e91478
SHA512 9284e6ef52fe132629719d6335b7040dd981128d9e9187fb4d6f3a92fe6fe29ee2228a852e11e1995ef2c5c2c40bc4adcd4ee76187cf81f2dae799d043caf511
SSDEEP 24576:oVbqPb88hv/l+YAsqjnhMgeiCl7G0nehbGZpbD:oVO88hXl+xDmg27RnWGj
TLSH
T13A559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 1c133ff71eb5cc5077fb455c68c31acafd8a520236c690106a185609f252d716
MD5 e6e112e6c2e11a031e79b331754ba401
SHA1 41946cd412ec49067b428b530b5e962390011861
SHA512 1cc80b215470d59a62ffd184f09c73078060e0eed88494354821b1b25a954e3fd982a21a9937e551c0a35bf628e2eaf022473415c33d7cceee398b3625dd06d2
SSDEEP 12288:B9nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:B9nsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA6523BF974C50CAEA7609B5C3E9F15EAC137E56982008436AA37CFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 dba1741b5052875ed4249241c1f4dbb8357c107a250b762c1827d1f3059f9d25
MD5 62b17af5f99af9da87f516a9583c2ab8
SHA1 9bbb62be5c6f3c0f5d00f6be2d9383b27067155a
SHA512 abd93b3439a24eb09c35eac229490d901fd70af658a494933dc7cd2e13e6f62b43dd0ba3a29738d791d509fb2b462b5af240b2a76c9d63344815f8e633c0f48c
SSDEEP 12288:8eBNUbTVO86UYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDm:8JIUYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17785CF7BEE28FCD2C27A4DB85791C600E77278314B61A3CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 92bda937d922c6fb6f2affdd11dbf51582a9cfde1f1f2ed1454774cc6e659492
MD5 6ad7dc4755e1dc4b1e44498d01b0ef02
SHA1 414f3cafab591298018ff70fe7472b72f284e9c2
SHA512 048d46c955cefd7f4fb4ee6eab1f444210501b60217a8c8776bf44ccf0339bc02e38b4f5375b949dbe0ffb36db77eff6c5840da8389201527849f18f46142bbe
SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THn:iQvGAdlCEL8c/DRNw5CJD527BWG
TLSH
T178266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 26f1c3edabd8187291f5dbdcddba2bcc69bdab5a72e043dc76cad026b938e01c
MD5 93f81d379f8817ae61114ae02b90dd91
SHA1 8217f4877b6584655f3e021f50a23dd6707c0cf9
SHA512 6203f73413ea99a147a83367e6d396688ad1b42e05b1b695e092833a31ec42235b2039b7681b2ab5c740bb63211b7ac439de5518bfa3fe4e0ae4be09196f49e0
SSDEEP 12288:0AwSfxL/2Dc3DDLLmt0LDQewsAjqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:JSewsAjqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10085E031FA74E036C7BB0DB20B36D71A582D7A204F6119C3E3E89D9E99702D12776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 781ecb6b134dcaa0ac714862bd661bdecf5924e5ea019763ed7a40b918e3ce6a
MD5 4a2d7406265b249a92bce6fedcd73321
SHA1 64b347cb319d1fe1e1d96f006e3fa10105bc02d9
SHA512 26f70141ba8149bbf63c715117b36f8d3dd15c8b7d52af133beeaad0add23dbaf5eea114ebc289a70d9acdb85cf68adb313551123a68b409918e350a1dbb305c
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHWVQBWG:CUEtQevvqc2W1cpV2tI32pB
TLSH
T128474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b46d189bcb77fa442a0a401b41b8d9cdeec0ee6ea47a1cbd957297ccc99aee3a
MD5 4a44ddf9e6cbdfed8652cca022b04edb
SHA1 516809607b3087c5ea04a09db9a6f75ea283abf8
SHA512 0d46366f38a02fcd6b31c73ba7e8e8cc890c54ec76e495d62a31160d27659f863d0646ccb21928f615d95a85f0aff18b9d1717c640c0c4e97515ae846127b714
SSDEEP 49152:GCbRquA/m2yL5zTfFiV+XenmE3/zeDmg27RnWGj:roquVjnmlD527BWG
TLSH
T1EAD58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b4ef2c08c4365278f30264afb984e2bf55c509448042b3555521780aada54964
MD5 bc2a7059b9286ecf275972f0203f33bd
SHA1 1d1d8d9ca26f6548f5c0b0a9f3960d2f5ac8ee8f
SHA512 d5b6bc1ee2dd365e87a1808db0d437c4cbd97d04bc25684bdc7ef501427f085f16bcde3fce029963968744e4111424faa36a6712cd236d2c9e80969ac00336a9
SSDEEP 24576:iAhGL3IFoiwtA5l7S53xsqjnhMgeiCl7G0nehbGZpbD:iAMUFoiq51Dmg27RnWGj
TLSH
T1ED359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 d45380e4aed18563a22decacb4d6b6b26b85b1c78572ec520ba369a72fabda2f
MD5 c6267554a23eff800c89eb74b23a484f
SHA1 75040836570268793bf25b3a5ffb7ffd5cc082a0
SHA512 daa026c1d4831dd559b68a9ab7982933eafeac078a9fc7dcec45a0ae800f4d64e948118f616b29c8f4ea65c564aa47cfaef621c192e67cf8b38904c93bc2adc6
SSDEEP 12288:cmw5HEjsChNPBFgl0WDm+ClXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:ZwuWOWmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19485F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 5ea37a216d00a281008ec89bb1674e6446599f3b147361533bdcaea80d9dbb25
MD5 21fc07d0bea1bc4e7c4c56b731c7d03d
SHA1 5188e0a0be6daeff9e09ec4b9a8b9becc0e5fb96
SHA512 21e68daa97a026326ca1e85d15b817a8349fb06f60d3b69e63faa80c26f86b7e72ef82b1310d17a820aa470b374d441bb8ca2bce18067b716bbc3e1104c6763c
SSDEEP 12288:K0Z1Iy6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tZuLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA7512AA239820FAE163417CC5E5D609E7333C62673043CF166659AA6F739C44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c82b15d6f8c12a83ee0e27f2031cc55d870d109f869df80a03c7e181b4df08d8
MD5 bc07a22979eae8c810fde69c893f0048
SHA1 4007a2680211da94da7d0127e696ef20944906f1
SHA512 c0f98c6ee2b0a7e9dbca365fefb1b452be706c6236846018f1f9097b7e081be5b908b21027f837f1d5a7d0ade258bb4ad8f1dfdfa931b7cf7cbcb439e6389aeb
SSDEEP 98304:YQRQyi36YOcPbLvw2gAf+PN3QD527BWG:PQyiKa/X+PNAVQBWG
TLSH
T14A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7adf759149e59bea42541887b764c31bab4a342c25a8e277e1fb944b8eb61856
MD5 3f1a205bc636d81952b69be0f857e509
SHA1 22ab3a47dd0c7de7a4e03da995ea0f4128b91b29
SHA512 dfcca17271b977a94814236b9eb3739e4895ee5c2d74c720583b2afb726c494b0030eeff464c4b4f31bfb52c1728afd684fc8fe771add60bee0dfa8533f8c528
SSDEEP 98304:5QRQyi36YOcPbLvw2gAf+PN3QD527BWG:wQyiKa/X+PNAVQBWG
TLSH
T1CD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 08e7ef48feea0cfcd4ad9106de0fa3b537acc772b995a44acf7e5beb3730def4
MD5 ac65f87ac4d55584a00c446e004bfebe
SHA1 923a6356b8a99a839295cc960149f942269fa4d1
SHA512 ca9e1db5e1ffe8b83f8e0a2d2e4c220385988a276d8fb8bae12d7312248535d7673684ac738c0fdd583a84565b81805c7447965c12504b00ca69e1e7dc803d90
SSDEEP 24576:iwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL07sqjnhMgeiCl7Ge:c68Qg55nhceWu7PNU3/uDmg27RnWGj
TLSH
T1BCB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bbdb948ddd411150d6ce79b29f19e8b3b17de1b904384bef5ec11e914f2c9f7d
MD5 c5af251e5a8922c5090c20318298ce29
SHA1 7f8a650416b22a74cdb81561c1ffacde2f1a15cf
SHA512 a726e7a0c05315e1d9bf79f2308abcfb5d3a2078d6923f215ccd5148bbcdced6095db54fd179d7352fc0373bca7fa066ea85ab65de1a70a5fc838a951c31a359
SSDEEP 98304:3y5112gYy5azzVvt69nLKnhZ7D527BWG:KLIHEWh9VQBWG
TLSH
T165167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4d1616585c740be27c2d1ad6db0f0a3b113a6e05a4d355bbb0d21bd4a80e8db1
MD5 4fdafb85364ce53a13f58a38befc4cb6
SHA1 e9cb0d526420af40e08459a7ac2285e303eed696
SHA512 062f3007f816b2b19d6410f619e09d65aed381d9c390381e7bd62bd410aaa170eafdbf60a8c3bf52faa9bcc84db704f8fd1fddd14ec7eb554379655e2deab662
SSDEEP 49152:dB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glYDmg27RnWGj:Du6Jmdxd2dYD527BWG
TLSH
T1CED59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3ae599e7f326b968566c823a8e0af6248dc0e7a76fb575d87c4e3807da2d82a1
MD5 dadc6bbc25081fc184522b42823bb851
SHA1 62f0a218200ac4ee15376fa077bfb004a7e9098b
SHA512 547c63a3351597ffb5a09748fefc669fa11b11e201e392ac79d7fd0473807431abd9db52e8074730845eb029a78bd51cc70bb3489cfa926450a9592ed568038a
SSDEEP 49152:+1hpsNoJpF1A63U44CwH7R4xkDmg27RnWGj:+mifPWRlD527BWG
TLSH
T136B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 07948ab7214397ac0c81528a75ad716d847bafe702a23d0e6de57d46c161c98a
MD5 0d4641b9908d9efd700f2542afba7207
SHA1 6e09e91f63e85c5b75790b759eec87b994f2c5de
SHA512 c3cb391b7220f3f76cde45771741e0ae1e433a07c01bee991b2d7179e8bf42ba964f74afad31196d6ccaa78db2f7ba1d5ddd4c88a278253b3a1bd3bb7a5155ac
SSDEEP 49152:NSuZQIY0Be2KcRVtOnks6NMHq/Dmg27RnWGj:D5dKii61/D527BWG
TLSH
T158C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 15fdb22c17279f0c79e1915d48328ff6bbb6d9a2b59ce0b914c9fbc5c29bd51f
MD5 457f7005e000c2f9c720a444fdc90fb8
SHA1 7ca693acb7bc53e51c596ff74941bdddcc068900
SHA512 1575c728761a622044779f823d7d2af61bc34783d688d97317e848276f925f7d73cea398cc9977093ca7095e0cd0797889a34255c621d05a2f07799728f93c84
SSDEEP 49152:8htSn8EApI0fig3giDn0AP5woDmg27RnWGj:9X2imphBD527BWG
TLSH
T1FA95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 8dad2758e64bba27308e6274e09c2f4c4d224fc249683a03d938478f777826ea
MD5 32a77aeb6cf534078b08380f9fc95def
SHA1 b210ce219698039ab9117477218fd3366282215b
SHA512 e617a2d983e28388b49e0aa060a7f6b9edd33dd5cd19f2fea47cb5d3e10a9fad6e8a253a7b00721868ee7016dec6accb60b0aafd715310dbb0ee441b1a9b0e04
SSDEEP 12288:SfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B56523BF965C41CBE92648B5C3E5F10DAC173E5BE92004837A977CB9F7B24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 43718654859e7fbaa4442d42fff3dca2c6c0514541c6ceea7a508fb35031e18e
MD5 118d93ce71822f588dfa4b900d04c5da
SHA1 489140e2d0bc46fd5bea46bbf9d9b86572bd3d06
SHA512 d2b697c6650544ae5dd052f1a409c393c1fefa2c459a0cef5b417f2f58ddb27ab832fc09827d59ebdbd0a936e4a15d7bc95569d016c00d374261d9391ee6a445
SSDEEP 12288:wuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1206523BF965C41CAE52604B5C3E5F14DAC173E5BE92004837A977CBAF7B28584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 01e524a505ea6d796ed8e2a4e0fcf5da33002c6508473a378b922e7edae6f22e
MD5 374ff1c610a3c1e55093f5559272fdfa
SHA1 4b79f2e1592c4391e0ec5fb88cab815b4fd60097
SHA512 b3d32d498db4752bf90ed31c5a474fc0ede28a53ab7f08d766656f6e5e127ab47ee61d97fde8c662cd82a9389b1ac08e71d5d66364330f3711b93ae47ded584b
SSDEEP 12288:wwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB6523BE965C41CAE52608B5C3E5F10DAC173E5BE9200483BA977CBDF6B28584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 0836689c85626e6fce36984146f076a944781cddc4f3aacc204618c11c397bd7
MD5 142ca89a658347dce865fb241ccae980
SHA1 771ba1fa6f48e15837deccab6c37efe1054e12d6
SHA512 0cbc95e1b9cd888551a5ff35930fe7748abd2162b0052fd70f7bc0b31474da3ce9e5e22aa9343c710faee24f4fdeaed3dcafc0011f7d7cd5d724b6ffee307fa3
SSDEEP 12288:bVRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE65237B575C00C6D87285B4C2F5E11DE8237D96EB3005DB6B532CAD9FB26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 3724f5497f0e25892e65a4d081f6649ef60e33f3d2d1dbefd296d8a40c6b925a
MD5 3616f276c2daeae751c2f3e9679d3227
SHA1 9a387236d28fdb3cbcff505c260fb27dca234993
SHA512 66bf2f4281c32e4d39f7c045e5c09b2b9750f5d0db69867c3dbb1d775d4e8952b43f301a022d4fe4f02dd470868a7870789a0d1654aaf4fadf27eed7017f10f4
SSDEEP 12288:sZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1756523BF965C41CAE52608B5C3E5F14DAC173E5BE92004837A9B7CBDFAB24584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 085435292246d8e133265467c2e9fea7072789a78975a3aa55d6d9514a96a466
MD5 63e5c22962ca982ea85059226d33887f
SHA1 09297a15dae1415f3cabcb1be8130706b343c3d0
SHA512 82671b7dfb2ea9a3df44e9dfb68144e1f5dc934a32731e40e13971e41d6c0520db5600cbcf516e414c73117e85e870353e7b3c2e22307686ceca172c825bdbb3
SSDEEP 12288:kiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B36523BF965C41CBE52604B5C3E5F14DAC173E5BE92004837A977CBAF6B28584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 d962248132d6b74ddc68f7d8992ebc2981c43d7ce22cd4a64d934c50f3b2c56a
MD5 e9077253aa8d2441e852cf9abc209fdd
SHA1 b99db550d7aa8be71635478c2efe4c4d5f258960
SHA512 2ef19909028a34c812f550fc5e1caa9f64c44fa55d5a889d8647346d3b0c488a8c314b542a625d1e1fa1a3a54c297e40c24423a62c1ad5d5307e292818fdc893
SSDEEP 12288:YWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE6523BF965C41CAE52604B5C3E5F11DAC173E5BE9200483BA9B7CBAF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 cfd7595c6677563c398de9398f0bb134b50af88ea3860477227dd176560e253b
MD5 065e8721d160dabed27eabc7b2df7490
SHA1 767ca221023676e0c06c9d314cabe90694dbe2a3
SHA512 cba66e18a85c56f65202405c03a926655c629930ba69affb26b0b88aa70c7f17158e7d6a0846ac8b905735aefde4bdb4fe686d9f2629087c4484c5efd5926a91
SSDEEP 24576:KZMrzFVSOOsqjnhMgeiCl7G0nehbGZpbD:KZMrzf2Dmg27RnWGj
TLSH
T14F8501A9B39018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 a8698778bdbb093841afe70a1d7f8f52dcc170c2b2e5e941fa0a83309c06f997
MD5 f78af747e600a6bff1e6898eb82bf475
SHA1 28f195759961cd7406d8a5da40541a3c5d7d3f05
SHA512 a414bbc3d81d14b853db46ae64556e628e9ce3b11978d40738579eb044a96d855e1894be33c351845f77229be19b1dcb3cec457596bfdd5159484e38d93fe901
SSDEEP 12288:NbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1186523BF965C41CAE52604B5C3E5E14DAC173E5BE9200483BA9B7CBDF7B28584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 aaae8fcaaa7cbe4759aa8fc3749b7c71378ae18c725ce68bcd3c454fe2e32b3f
MD5 2d660aa7008ee3fa6caf37c7232c1504
SHA1 ed215c5efeff517306572393cd8a369a99514a3f
SHA512 4ff35957a436708964531eafb9eef6b3c1b2f72f0969a9e05161ef4b4be82ce8f0a67a19b66fb078f8bc5965a4b38b28134e8c8c6b5f2342c9e2e2286c5dd966
SSDEEP 12288:U3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:U3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D46523BF965C41CAE92604B5C3E5F14DAC173E5BE9200483BA9B7CB9F7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 4de46d4c1f4aab292ce154e4445958371e614138f0089b8bcda25a174bf688f0
MD5 7d97f59dfe88e9f6a4df731e9182d05b
SHA1 f4e847b2f994fb501390b77b7655d4c9b3051c61
SHA512 6828a93ee8d57aeb23602ebe9dbd6dce05f573dedbdf31d8159976388520fe53900bb944fcc1279886c2e617489c6b4a0a082f85a955a14b8af91cbd431f0dfd
SSDEEP 12288:4yPz5L86Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Zzy6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17F75125B73A530F9D1378178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 88e47ed6bd0a54da6f46294e30a67519cf0ca2fce7a07eff72f8cf9f7afe38f8
MD5 cc91551b0d9d846c5fea0483f745fd77
SHA1 a3b28cb96ee12d7a018a4d0167aca28020597a78
SHA512 df71808e5714fa1cc477b26f8368be294711158967567e59a058e166cce8efae91da5eac71a6f3b6f79a39f34457e4034a4a395864c7c6dd30937def0eafa542
SSDEEP 12288:zbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1006523BF965C41CAE52604B5C3E5F14DAC173E5BE9200483BA9B7CBDF7B24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 d0196776137cb183644ea0e680242cbfaf29d79d7a524bed9108954a1eb69d78
MD5 6cd9d8a25c09722d5302441f719b64d7
SHA1 7a7ec605a83a43d48c729c525e0b98f1a8d3ca42
SHA512 4754b22fc33708a4e7acc413efa06bd09ca68221cf6962261e9418e6b0bc553a3217c65f023b0f99edefd0b3588cd6376dba54ce618e5d58fc3276b58e908792
SSDEEP 12288:HbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12A6523BF955C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDF6B24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 327065089d5e0f4889775254ff419629f22930d045ab28ff0eedffa298cbdc9c
MD5 c905aeb1d816db6106e86775122e343e
SHA1 cea4d3980ff50eec642122f1487a737473b6ed08
SHA512 cb90cec4238039b9d4bfe34a4caab52fb955b029380f8925a55eab412bf8f5489dbad27244211a310ae8cb4e4c51002ad9508f7d6adb402b924d6f2bff98840c
SSDEEP 12288:iyPz5L86Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/zy6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A75125B73A530F9D1378178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 a364863bc130e1c6ee14bd66d8142a2c293710e4ee449d2bc97c5958a424691a
MD5 375579be82229edd01d5b576f2bbce68
SHA1 0f8b165e210f4a69c6366e7c1045d320d09844b8
SHA512 90fd0d5cee82f4a6f36e616b1e34bdc67952603494b454ca69d96c3f3a5f3b9a351f418ef125e3a197126022218c9540aaaa6ccd2146ea43d63f8e4a5950e784
SSDEEP 24576:eTxaLl3z0zDgsqjnhMgeiCl7G0nehbGZpbD:eTsLlj5Dmg27RnWGj
TLSH
T1188501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 9d030b973ddba1a883d5365d9fa7e5da88b9e8901ee44a470e7b8564e71da18f
MD5 c5e026cb910c5ccffe4d2e3edf67a2ba
SHA1 ab16eadbd7c1d1770714a3a8d529b25b81576107
SHA512 bc6c8162167744987969138818191ae0693dd62a927f8ffb7a5b47357a43fe9c8a5a47cdd45f6daa2025bf875d4a5b52f3f9151617f3e97c0fa00d67ca9a9563
SSDEEP 24576:j3Zd9CHKy7GZUsqjnhMgeiCl7G0nehbGZpbD:DZd9CHKya2Dmg27RnWGj
TLSH
T1EC95CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 12791e971c114dff32db72bae35ddef201e7596b07c34bdf36db74a01bebb4ca
MD5 4757ae14c0b8896d5b2a9a2e3ca2d745
SHA1 da2a0df97d552e96a2c61f8892fd2b0781a439aa
SHA512 cb828c1e25ac43b7836db64724b39670a79bbeb67761330c95fd333e8fd8f09db0fa117a3072fb106482fa0e5836d48b04c2d193806966cdb28c3461e2abe5b1
SSDEEP 12288:dQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1816523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA977CBDF7B28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 622c8df5cbc804d2dc3a7cfb00faba72f0187e98f0d933e2f8c553bf6bf93db9
MD5 98bc84f5c6e318349d28eb38834600f5
SHA1 ee6bd55474315eee02eb5b357ada0fd987d27739
SHA512 d57be27acec63efc19493a1bc75cad3ad38537680eeb7b2ec4596f35ccb40d5094f1625b8a30460f841de42e1ae98c82fa0f3a386e0d737b7ae348dea4442700
SSDEEP 12288:4aXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4asqjnhMgeiCl7G0nehbGZpbD
TLSH
T1066523BE965C41DBE52644F5C3E9E10DAC073E5BE92004837A977CBAE7F28584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 aa362281c98d6c83a6bedc57644905b72dec5d8dd391d1204d8f0e13989eb98a
MD5 5ffa0a801ba6432db43f7cd291fc4424
SHA1 f90bc6d247e505f63ec11730340d1409985f4796
SHA512 5bd8182cbb6acd9ffdeaaf4d9b2f3cc3e02c1fdd5d2c999243d96563c26673e373e8ee053aac6b5987d2365b915d3dad445ac283b18e5fa158180bba54ea8d3f
SSDEEP 12288:ttXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ttsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E26523BF955C41CAE92604B5C3E5E14DAC173E5BE9200483BA977CBDFAB28584B3C427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 847c19c372f1a9c0e8ff61ec86cc27a75a68528d973d7072bbda01bde0f0aeb7
MD5 0b76848d97bb3d0b5f398c8d525dcd7f
SHA1 aab84adc1acb796a2081ae83405b1ff54dd4e923
SHA512 d269b646c55a1dbe5827e129693e4b11e55b5fa493cdd1ea4ddb306ca65724546145844a49ab185ef731f39b6e458db8cfe35d378f925a41071b22d4da6b53e8
SSDEEP 12288:NbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1496523BF965C41CAE52604B5C3E5E14DAC173E5BE9200483BA9B7CBDF6B28584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 8bd1923913a161facec53824f1235da215e7850d11d3b4baf17d91509656b30f
MD5 4a21ecfe55440eaac8960a2aca8d1312
SHA1 0dff76be3ab71b846a22e58a3cbe84db9a19e6be
SHA512 8e11aa9ac2800fb8642a2963d62371a7e626654e6511871315f5d66e45f5cbff3974116aba569496010809560f8c59c10e18d9cb80b0160f6421e0a7b21d95ef
SSDEEP 12288:8QXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8QsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D96523BF955C41CBE52608B5C3E5E14DAC173E5BE9200483BA977CBDFAB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 eff26a0bf699c2d7e8c4a5c50095dfe76cd8061c7274e5363830cd8b33755a97
MD5 61cc8fda2717cf66c0d702d4c7e6d5c9
SHA1 9acb40425aede7f645a9bed8b06c3f9a9e7855c7
SHA512 e9cbf05e286936b696f5777a43286d91cd6b21fa03c262f1ff8a344e05795f9d97298870d8788df3b43ab6d609da9e04cc7042c002c2ff6a23197ccbd586a020
SSDEEP 12288:ZDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AA6523BE965C41CAE52648F5C3E5E10DAC173E5BE9200483BA977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 5ee18530aba46395e48c845da977c2645dbb172cfe18aaeb188526ba08d55397
MD5 b88240fd87d8c6e8ce67c013a4a1caba
SHA1 d4cda206255497dbd055d7cf5e22d909999a8c0d
SHA512 dde7a8b58d1e9cc0fe74f8f5956925df4c4f94ef8a84ba1424698f6e9535544b56683e63d922dbe20b73489e3cae5913302504054ceed13e4f6ad537c15e40ad
SSDEEP 12288:GZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C46523BF955C41CAE52208B5C3E5F14DAC173E5BE9200483BA9B7CB9FBB24584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 f8574dc5ba20b4269a338f506beb9a5e2062024d4c9e85d83fe2b988407b2a64
MD5 f0c3da054cf4499f175c3757c410da72
SHA1 4edbb9c4300560a231d51c1695a1e4a894111a27
SHA512 ee3ac431d4b9fdb969ff9701f5eed3ef53125cc7a76af6402c096bd4d93a6ce1e9e4808d5072f86e9c4f6d23216a14dfc9e908f6aab501e2853b5032c09f457b
SSDEEP 24576:nfwv2k9RX6wkyAIHsqjnhMgeiCl7G0nehbGZpbD:3MnYIbDmg27RnWGj
TLSH
T1D495D029EBDC44E5E177913C89B7860AF6B278591B31C2CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fcb7b6eacb53d2275caabc7a8a945e3ccd69b6d1dc641fa997025cbe4ac3a5e8
MD5 71d15cd091b6ccafb130f0a5dbfeb883
SHA1 874676a2cc01dca9a7be1e5ce2d1c303a2bd7543
SHA512 bc91313a6f43f0a678a219940328bb085ecca8a8f122f384d9691efae510fef28b20efb64f5ffcb7c96fbbd4e1524f8c8ff2ab7b0e203d573f298ae2c333964d
SSDEEP 49152:dYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0IDmg27RnWGj:wySzPwD527BWG
TLSH
T168066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 78e26760b3ffe4f63397a64df397bd10a5c420e97a1e642e78205e15a62a6c04
MD5 c94bbb77d7378fba2cab15a7bd1a2a80
SHA1 700d817af368977b731ae42dac9706ab221ec8e9
SHA512 9f01a6ce6c3e31ea45ae37652c6bded7035173cca0dddc5cdb51dacd064be6a99da3bf8e7c427c00f0282fe0f78e1f418add53c40a29a3bf6ce734ddbd927026
SSDEEP 24576:e47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYesqjnhMgeiCl7G0nehbGZpbD:e47JUQjTirIhCnDHUPfF/YDmg27RnWGj
TLSH
T16265AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 dcdbc48b3200f9f7ad331c885b0a1881af0fd93de81304dce97dd9ba48504f53
MD5 af5ff570236f77c904c7afcdec46cd88
SHA1 a691cb8be245d25bfd9d14bd5c791ac2510697e8
SHA512 3ecc632880dd03fc7509abfe217db9b1e037506ef5ea3cd54b3bec9f4b0818754c60a13ee396504cefe55487509975baffe80c39c449f17ce7124171c4a990d6
SSDEEP 12288:hVsfLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6LsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14675015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 4f3cb54273b59ec5006f893e700da8e18ebd89b816e9a9526a565002faeca8e3
MD5 c99d174c45ce6f455cd0c87c32fbf3e8
SHA1 0253e772b91437ad5e97dd5ea3ce8a345fdcf7cb
SHA512 0a0ec8924cfd14ccc1019feed22dcd471087090bdbe183a6110a4d10df616b676f5f6e9dc84564e675ba0aa0de3fa485e4ca30474121cce19909537feb8a385c
SSDEEP 12288:pjjjzy54GZxINt/hWe0dhtRACgDcrN67Z+p:pDzLgINcT7EDcrgZ+p
TLSH
T178450750762AC75FC6AD40326E32D1CCA7707D05EE456F0773C88B3F8576668BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 7075db051f6b2d4a51112670e5b048001d3f7afb85a7c5bcf2d3a75c0acb251f
MD5 c3eb11ab4cb610719968627b1d54b42a
SHA1 61b34bb54b1cf9a11a92c4b17bdd6d4fe94ed6e7
SHA512 8c390277d47ebe7781a124d0b26ce003dd2ea226457a5acded76e1bd78932f170aeaa479144dee253ce7848d8c520bc0f23291b36427e0c0d831fa4fe6f352cd
SSDEEP 6144:O51UoAZ0/2I52Ig2IaPUHwFDuc+scxFoVbiqRYKDexHGYKDexH+oQUNzAEV9270E:QUoAZ0zDuOVbiqRfFo4N3DNj
TLSH
T12B65E881A537A38FD1FB5032072A5F8DA764EC06B7095F26B388053AD82A755B0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 60df3b930e4157810277736896dde90e8b1cb8df7d7273e45d0b1fa719d78856
MD5 1cb81fc031cd6b461063f3605432bbd3
SHA1 d224424d61e87b827be7ac0923790cb1522f84fe
SHA512 bf8ffc643dd2727a70ed677528194ed56cf7283d2f3922e838651bd2bbad839ba2e9e00c56bf1da1b3fe87bf6f521d06f8029f211c6e4e864a832d963066df1d
SSDEEP 12288:EO7zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15565237B934C518AE83605B482E9E12DA80B7E669F1044C3BA5778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9411fbfcd9dd93c563e14963fee34a463e0909387cae678c68442922b3b4a342
MD5 c0ede913e9ace19ff97b374fddd85505
SHA1 af3743831d81a4d2d4a08848703b542e4d0a07c5
SHA512 d0120b7fc5518d3100eee4c6ba81abf8685135d1b228e02930474f7a2adee85430c769efb5d116f9ae1a5f44692be64d41b1908b79598028628301b023cd27e8
SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bYFsqjnhMgeiCl7G0nehbGZpbD:agb4mBIBhGFyDmg27RnWGj
TLSH
T137659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 2e938accda5ba91a7767b75cb2d2c5df86057fdf2636604767e5988ef6584710
MD5 5d28d229fb44efb7ce9098deac6a28cd
SHA1 c965a395325354f3440d58ad30fbc60968c5b38e
SHA512 755c0c4f5ab6e451022cce1b29a5c3fb1ab941257e16acb22d6609fb35f87c713c8076c2e4ff2765194031f583d4d26e891c3598770aa2f4760a97432a19541b
SSDEEP 24576:WG88u8FpJqH19zria7/mOsqjnhMgeiCl7G0nehbGZpbD:97ZFPqVka7/xDmg27RnWGj
TLSH
T1FB95016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 de178ebf54fd62fdfb30bf50b96f1ad351736e84ed0425134f91655e2d0f5170
MD5 5dddd3b1c7a85bb28769bb26f517f75a
SHA1 1e9364eb693ee405c682a0b87746090d1a8294dd
SHA512 7988094056935d563870c0ef80d2b5cc28f9f078506b1f0d4242c4b48c7966dc66e3c464b9f98d56c4a82966c3010c1df745f2154daaee80fe3107d1dc0d3c36
SSDEEP 12288:QHvUrBFrEjwaQyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:QPUr+NQysqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F85F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2b2e178960c3657cfeb31be27d0e4323e7df3bda6e9f5abb35937fef254bf4b1
MD5 ed68f2765f223d4b583c888341c10ce1
SHA1 d511735295a1352a55d215c39d23b9baf9eaa0ce
SHA512 e6884c7abd895c7779e43123c520dee445c37b6ddf95744c1de14c46a2c758e013e76f3075cf49f5398fa370af1acf57a62d0e936c805306ebca737c406e5fca
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmDmg27RnWGj:cG05lO43bTD527BWG
TLSH
T1A3D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 23164b558382bbec9143f90bf0914b56db5a3cca67b268d280c8efc88bf6c25b
MD5 e93b6895facd94086561edc44db03948
SHA1 2a2a2c35c5315cfceeaedc20278126b19cd7faed
SHA512 a90aec8153e9aa12539353ff92f6ec2686987125b2bc0f90ac87d532fc86ec914a939cb2c9a42c998c3187ebad4e862a7798d309babdfb654bb91837eb5d2f45
SSDEEP 24576:7fa5POZ3dpuWVM50JicR2hG0lasx2+47eidncsqjnhMgeiCl7G0nehbGZpbD:ja5POZ3BJt2pasx2+muDmg27RnWGj
TLSH
T11965BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 32b20c919bf8fd4fa10f8f434c20ca777e6978ea35a7e9758645e20da39bad61
MD5 2251aa9371aa3409273c4cdf4b9b0a4f
SHA1 ed70edc219f02c59ad07ac5faa751047355203b4
SHA512 13f1845f47074e8d582f8d8bbb2b923840ace45e71c40035202ec7aedd2baeef9d9d4e0881a7a25c8a9c097539be81a459041244f0d5e9b4ea7006fcc1b832d5
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7FkGsqjnhMgeiCl7G0nehbGZpbD:JNc/zEOVHFRDmg27RnWGj
TLSH
T171857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e003b17f1c28f90caf213a8d6b59e6ecf7ecdf1147665e834591dfdce09b1c4c
MD5 1b6749e858ab87dbd5358a0ea8b32566
SHA1 d448c271ce70d0c2b0cf7e65f137702e04cab3b4
SHA512 c8c1b08fac8e253a7878f66df59e8c5d8a0f6570c03a3e8fe2f9c25c399d460cf4a52a9c31fa3f5a3b6c0976503b90be8b649d5f504ff57b13d19207bd4be786
SSDEEP 24576:hTkNvNnaFeYhJNtmZBmosqjnhMgeiCl7G0nehbGZpbD:hTMwBtOmUDmg27RnWGj
TLSH
T13855AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F4E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 f593fc653ae8eaacf52552eba4efde92d27b34ce869694753315e1488d52208a
MD5 8e152ef6aa740f4a8cc8c1b9253370e6
SHA1 268c2ff497f00f997d021b0120042cbdcec2a5ce
SHA512 65cbdf9c61c56c760e7248dea5224ffc4cfdcad4c59cb9623e773bb79f97243f84881cb4fa9dcc379db06669a61a1af8a493a5df358896fb1a2b74a5b12ac994
SSDEEP 24576:sD3FHshBIYQgA/sqjnhMgeiCl7G0nehbGZpbD:sDVHeBIAAjDmg27RnWGj
TLSH
T12B95E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2584-51-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2584-38-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2584-45-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/2584-39-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/2584-49-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/2588-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2588-309-0x0000000003030000-0x00000000032CE000-memory.dmp

Download

memory/2588-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2588-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2588-135-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2912-306-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2912-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2912-99-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2912-93-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2912-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2912-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2992-305-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2992-112-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2992-114-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2992-106-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3776-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3776-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3776-15-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/3776-21-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/4120-77-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4120-302-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4936-272-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4936-53-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4936-54-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4936-60-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/5068-76-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/5068-1-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/5068-7-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/5068-8-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/5068-6-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/5176-133-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5176-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5176-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5176-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5680-64-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5680-72-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5680-297-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5680-66-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5796-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5796-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5796-81-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5796-87-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5796-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5796-322-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5908-117-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5908-126-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5908-124-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5908-118-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5908-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download