7aff5a77fd6222e23226e794c999bd924690409fd64b9b6975b4b370db08bebc

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Size 3.7MB
Sample260910-betp6avyct
SHA256 7aff5a77fd6222e23226e794c999bd924690409fd64b9b6975b4b370db08bebc
MD5 02b42cf2596f6b72fa10c70c237482b8
SHA1 69db84707f72667870894deec228777e2ac14d2f
SHA512 769de78526b91a02397790c895d4ebc007b6c4cd47a1691f8cb6e2736d62aa4ba5da3df7afdf600e0be6cdaf06196f526356bdfd064ade528c59fdb2dbf30016
SSDEEP 49152:zm9e4BcaaKT9qKFpFclC5Vh0Klth1u0MHzFHQ5QSgl3iOfJ4klKXnX:zmcGl5al3pfJ4k
TLSH
T1FF069C52B36948DDC6A6D23CFC23BE06DAB33A855366A7E7029E16531F636D10E3C740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4900	elevation_service.exe
5784	elevation_service.exe
2136	maintenanceservice.exe
4848	OSE.EXE
1116	PerceptionSimulationService.exe
5888	perfhost.exe
5660	ReFsDedupSvc.exe
404	SensorDataService.exe
572	ssh-agent.exe
5984	AgentService.exe
5904	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9a156bc1b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf9e834bc040dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f965f88bc040dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
4900	elevation_service.exe
4900	elevation_service.exe
4900	elevation_service.exe
4900	elevation_service.exe
4900	elevation_service.exe
4900	elevation_service.exe
4900	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Token: SeAssignPrimaryTokenPrivilege	5984	AgentService.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: 33	5904	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5904	SearchIndexer.exe
Token: SeDebugPrivilege	2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Token: SeDebugPrivilege	2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Token: SeDebugPrivilege	2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Token: SeDebugPrivilege	2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Token: SeDebugPrivilege	4900	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2088	2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5904 wrote to memory of 2376	5904	SearchIndexer.exe	100
PID 5904 wrote to memory of 1128	5904	SearchIndexer.exe	101
PID 5904 wrote to memory of 5168	5904	SearchIndexer.exe	102
PID 5904 wrote to memory of 3860	5904	SearchIndexer.exe	103
PID 5904 wrote to memory of 4540	5904	SearchIndexer.exe	105
PID 5904 wrote to memory of 5056	5904	SearchIndexer.exe	106
PID 5904 wrote to memory of 4544	5904	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_02b42cf2596f6b72fa10c70c237482b8_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5784

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2136

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4848

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1116

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5888

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5660

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:404

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:572

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5984

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2376
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5168
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4540
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5056
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2de06b3444b66d2388ea8456f97ce561cf28778454a345fd91db9e92950255d0
MD5 954c8eeb0c9459a232541ae3b960d908
SHA1 0470947fc9c21bf8bea0b4bf9b321826d3d3e400
SHA512 ea33e8a43e45e43c2eb09db80afd41b6037ac4fc432ca5c2a0cb95e77d65a335d156e5558305c6e0607f93ba34458906a6f6e19541bfe98887337a71adcd9fd5
SSDEEP 49152:hb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnDfJ4klKXn2:n3q60jB8fJ4k
TLSH
T16CD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 6c5a65df74716f75d0a02c6dd2effc3d3091d2ef4de7bde5a98c140aae4c8f73
MD5 67f346e0c000f63ec75c455688c7ca6f
SHA1 f6454670cdf1576aa7bb886710f42201f1341f0a
SHA512 6c5de1252cd25c77445e6a3ac19b460b75a3b16869817f7f2fa54ba75e18e8414b455c3143b542954ba479e4cb1e2376ccbf48a2433892d9f318499bff93c2f2
SSDEEP 12288:n1XLsswWkxy2lRq2czA4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:1XYfDtczA4fJ4yL/tNCJPXUQrP5
TLSH
T14065F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 6c4cca209a716fcb8912c354c974ecd5f5a72676669543107c9f5cec91d7cdbd
MD5 214a642fba959d76bb5bc5b81d78c42c
SHA1 6d430e054b8c98f34694ea09151fcdb9789e0e5d
SHA512 d842700bbb52b1ecf96ff2f5b7f9145a8d7457da7cdca19630a6f81266a2bfa410d9f2fc42996585e317f206632c4a5170d35557c18ff3ad86fddc9c831af6a8
SSDEEP 24576:e0Le5ji0hmxNrMLfJ4yL/tNCJPXUQrP0:ePji0A7GfJ4klKXn8
TLSH
T18A85AE66F5748335D073C0B9C5D2A68AEA71308257308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4bc03088c85353086409f27220c375cee0724c674e7b193145fcd08f17ea7b1a
MD5 11646125a6814e2528747a83c7d2865c
SHA1 6e34505cd6d8207c68351b224b52de709fc56bbc
SHA512 09ecb669c95e8d36e5a452c0d1c96840f2e171f11c72c62d53d131539d4cff35b4c7646d5d4c7f92a443e5d1d80779c1233f98153f46c34c6e49bb552dc1552f
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWr6q8wyulfJ4yL/tNCJPXUQrPB:m/ezSC6vUzPviHjySfJ4klKXnZ
TLSH
T127756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e017d04ccc7e4d15acaaa20c6d8dcce70a7b49482202628ee220fbe42d65ea15
MD5 a3b8ab5a8dac4aeac45282de9a11a3cf
SHA1 121334fec58fcd2a1d9fe347879cf5aec6da853b
SHA512 60655dd0a3875386d4fd325d7c0b2efad5a97f5bbccffb5157581d42956ac7826695f799f13600e212f84a3a16bc761b3939183e227e8e6a027594aacdb22077
SSDEEP 24576:AVbqPb88hv/l+bsfJ4yL/tNCJPXUQrPv:AVO88hXl+wfJ4klKXnn
TLSH
T136559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7fd002ad7c4ea4e7da4a6f7ceede68c22be4bc5aa415507a534e97124327c68f
MD5 14d49b2f83652804cc1d475bac002325
SHA1 571db36c8d6b7f8296c868a9a236ff2a14756f62
SHA512 47e8e21b81872da9270d5c7f4508814322cc90c412312bf42638a0d33c34564e5120b809e2084ab2172a32c127f99bd9898f5c0fba71073b9d4b4b917f69ad8d
SSDEEP 12288:VjvfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S5:VjvfJ4yL/tNCJPXUQrPi
TLSH
T1984523E751849086DF6A87F82A8CF001C714BEC5562FA2E6CE43B8C67FFC91A559C352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 082688ee1d27a1de7994bf9894471106243516eb6831ccc7a536b6d20e497eb0
MD5 5435ef88e33ae671d393a9313fa9fa4e
SHA1 53a9416b2ef918b67fbc0d2b947762f6e92b861b
SHA512 5b48e27409de3b86987ca007ca0c34d893f6dbcf70c57f4a3e76a49b123b30e19c74e50303fa7e784399d51966c235fb082acac51246bfe32f85f31e1d00e73d
SSDEEP 12288:VeBNUbTVO86UUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sw:VJIUUfJ4yL/tNCJPXUQrP1
TLSH
T1C065CF7BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6a640d651cccaddc66ea14f7afef907fbca4a43e9d27c1d2b0ef7789fad59e85
MD5 419a24c2bc6258ed3e86ad19e16ccd18
SHA1 fb797cdcb3c9ec3ce481ec59a8b3e5d823e219b1
SHA512 684f52ab5d4d3b80163d7179f7ce663a0a8126777e606ba29b6f7078aec027522c07f9553e5815c41a5d0df50bfb9ba4898caf1d7aa699ad27a03e47a393e6c3
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THO:eQvGAdlCEL8c/RRNw5CVfJ4k
TLSH
T197266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ad5e214b0abf1dbc985ab3c900a0ac972d30c07f11f914457cd6b7b1ae41332d
MD5 1f03577117ecef776fefeec683e5d627
SHA1 8dd0ebefb08e5c63cf28817736a58218992c4825
SHA512 e5258c848ccc5660051f2c4a0aea7e49fab0c2129af98a2cdba090292f7aa15db38c77805980f9892f71b94e1fb8fb4a1e645b894f45b500e157087f04ac0727
SSDEEP 12288:xAwSfxL/2Dc3DDLLmt0LDQewsAj2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWk:SSewsAj2fJ4yL/tNCJPXUQrPm
TLSH
T1F075E031FA74E036C77F0DB51B25D306542CBA604B621AC3E3E89D9E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 290a83ef847b95dd451502edf6414a97363bb5e99c980ba97b49edef416c7bd7
MD5 ac7ef8c47480568f3c0de34bc82fc924
SHA1 b483a2f434dd1b69e77a4a964d9d493c3a01b1e1
SHA512 50860935b48d66b6020a3deaa3be662dbfa38314b7711842bc250d5cd0c48e903ddc00c1a954f0d531036c7b5e69f342a767ac23614a5a87855525f6273ae530
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHOfJ4:aUEtQevvqc2W1cpV2RI32O
TLSH
T1E4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 36f8abcd827400611c476c0036eb9fb7f98994aab321d5d2a8b3c30d04c2bc6a
MD5 139416258004e26d674e205a834c447c
SHA1 dedaaffe3979bf32789e2ed917146a05652cfe63
SHA512 f21d6c5c9a4ed7938d831d4159d1b91a9ae40a93f06797f86bae3c33491ee3f324460f797f31281c572322a9039d6b626d84bde791264cf0df9956e348ed3a79
SSDEEP 49152:aCbRquA/m2yL5zLfFiV+XenmE3/zWfJ4klKXnL:voq2VjnmxfJ4k
TLSH
T14ED58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 032d3a800a80cfc4c8bf7c68f8bd0aec7dbbae96faa3cd92f065c0d6738959f8
MD5 d34fa2948cb9dbd1e2831791155134bc
SHA1 3e55ebda38fb85725a3e63a99432f1c5f156ad0b
SHA512 e06d5cccb79a8546035851f0f932a1fc20f877210206c42cd50d85d5201326baff0b125d886c9ddc6529e7dcba935216b184fc018dc9c23becff1eb378cae6b8
SSDEEP 24576:wAhGL2IFoiwtA5l7S53RfJ4yL/tNCJPXUQrP2:wAM1Foiq5hfJ4klKXne
TLSH
T120359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 6205d596e647cd99e1d743a1bd2691564120958a9b1004580c3da488979b96fb
MD5 f43834181d393ccdc675645bcb36ae21
SHA1 9eab04da0c6e10cab315fb68e09cac6fefa32512
SHA512 c2d05db24dfd02f1a6e701ae55c55ad3b49d43195fb321da43843fd9f410d48e5067dcc0ca9d2f6c83b775204d143ee63b12ae265909440c31b34998586ec637
SSDEEP 12288:gmw5HEjsChNSBFgl0WDm+CFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTS:9wuXOWyfJ4yL/tNCJPXUQrPm
TLSH
T1B365F14A32E40CF9E96782788687D132F7B2BC422A26D71F5760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 6ccf2da1cbe4c955aef3388c1c735fcd5af08270498a148522ca07caed1d6a73
MD5 2e714eb618179556418de676e70b3595
SHA1 1ec4a0ee88925fed530291d69e76470b6cd4296e
SHA512 660540f4eaef48be71b7c5c941fa81bb8bc3e4cd75b207a01cd3c4b547d68ff08a53a3203d18c16998d6fcbe8681ebe57253a7fe0de2a4de41284e1b530613ee
SSDEEP 12288:o/Z1IymfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:MZuzfJ4yL/tNCJPXUQrP3
TLSH
T11155129A32D460F9DAA782BC8AD4D101D3317CD2233A93CF5A5195963FB7AC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f049552de3223f78cfb02c879d1face7ad95d081a8a9e41aa24082775e5b45a0
MD5 d6c94dd87b6d37406fe9c800f91caa3f
SHA1 88efb2a3f3fd5d96016b901fe6237d3fb7e4d826
SHA512 280541d82510a1e8fe632248bacd9eb3d50238c10ae55e85a432472619c3bc1a8bedb293317136bdf37dcc26d747599b2b212c68e1e67559c337018b1396da73
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UN:DQRQyi36YOcPhLvw2gAf+PN3gfJ4k
TLSH
T174667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 33acfb5015fd3fa2bb509f3fa3bf552a8a444782287ebb39bc8dec043738e553
MD5 a669fcb72bacfc92355cf46f3cd8cb5d
SHA1 7688e409b3fe45cd322704b24949f00e187bb702
SHA512 fe8eff51f8ed43e1ddab78df2c438d879efa48e3dfc348efe49a9dd20374086e6eee36ddf8d6ca27cf49a072365903f8402a323800ebcd8d70abb7849fade4d2
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UI:MQRQyi36YOcPhLvw2gAf+PN3gfJ4k
TLSH
T12E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fdb4a4ca43ed655cd264f7681bf3168ccee58b8d25c8ce9d7e21b2bf641ff744
MD5 f625d4ffad2247960db13fefb3b76bdd
SHA1 93ea828967aea0f51f489f9f3ddd11adf1758454
SHA512 39c204d2c46f98b5eb375252411b563538814b0172e4c5c56d649a2fac09f1375eef5877bc511d1d2bd61a04b7c03b80d3ec0e8cad6d6ee8ea13222da5a4ef3f
SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0DfJ4yL/tNCJPXU5:o68Qg55nhceWu7PNU3/GfJ4klKXn8
TLSH
T158B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4d1c1db6598995ea8d1a9a8c41961280fa910a5b7414ed1ac92c1ca64c9f18d4
MD5 4c4f2ca4c5ec1ca34afe435f6bbcb319
SHA1 b10084b8b631ee9606487facdc586e3014964d10
SHA512 621389226fac75eda61386f4cd0a564740e5b43ac2bf58c381726338a7652670fc59f9c6800c6f77f62bb4663bca8e874870aacdb79a688d0de4e3fd81aed983
SSDEEP 49152:n3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99u:Ky5112gYy5azzVva69nLKnhZvfJ4k
TLSH
T1BE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b221c5a7d3b18513556be995a5ba6374b3074f83fc487e3949ff49b41ed76f6e
MD5 68c6f8170f1bdc7f329ba02c23ced0e3
SHA1 78eda9bfb22989c3c140fe72e42b31f02a98f806
SHA512 5f01a450646398575b3a2931ac108ee271530f6f63f775322b5f01d8a65e9955b2a8a6f4e5080bc928a48b804b4a51ed31774e0d39a5a947b7ef87ca09b1cc84
SSDEEP 49152:6B+taZ3usBWOBr4tEG20bqx0z+n217aau1glIfJ4klKXn5:ou6JmUxd2dIfJ4k
TLSH
T1FDD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 87cde14350e92aa99823505ddfa09a53e54252f289cafc4251ef258ce9871b97
MD5 1a0cd1fef90611f420e33844cf54c353
SHA1 47eb14dbd138442ada45f1481d9fc2b7a13bf992
SHA512 9d216c64dfa1b008e3f2ffe34cc6d446416d4cc1bfbfa04e95bdfb1cedab3d85520916d30cbd40b2df2f791325700655942c9b334bfe1b9e39c531f7f30814d6
SSDEEP 49152:U1hpsNoJpF1A6BU44CwH7R4x0fJ4klKXnD:UmifPkRxfJ4k
TLSH
T1D7B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ee01888afe33a6cc6322184547279fcb6fe6b02cc8a535b04a4eb463e24cf0d2
MD5 bb7fd2b2b78c8da06e12774a01c0507a
SHA1 301c3f21625522089f42cac81257b004a8763d43
SHA512 1294b652cdb0822fe3b180e546ed554b5e2706d6dd2706f2897467cf48f9f502787d93ca24c5ed00261f04126e8749c403925659968b8512586fd647c92b8e53
SSDEEP 49152:VSuZQIY0Be2KNRVtOnks6NMHqzfJ4klKXn9:75dKvi61zfJ4k
TLSH
T151C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6de75f254f9f467e674f31f5a42bbfe860b7a533856ed6c25320b270fd79b61a
MD5 aa375167a419cc0c78194e256d1b5a13
SHA1 642f636741704245966e99d58f79e720c55478ea
SHA512 dfbed1e17645edad4cad1e89ef6c0ba4b52433611722db006f9a269a0fbea26abc6073a08b52076fd75a1da77c9fcea918539005e4b3ad782453ecff60ed457d
SSDEEP 49152:YhtSn8EApI0figXgiDn0AP5w4fJ4klKXn/:JX2iyphtfJ4k
TLSH
T19F95BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d815eed69b231aef6ebd2c065ed033320f33243166c7ff76e5f1f797c04225e4
MD5 4b87f36451ae0a8520a8d46866480c64
SHA1 660ea6142da1c031f136ef447a275f1ed8346a95
SHA512 cddf936c4e8b0efa9bb52065a4164c3edf265b1a66b33706f884ad9990c1d6eccde5eae3e7c2b8567dcfed462b4bb04b2690359681ca32edd4cb9191f254bd97
SSDEEP 12288:H3fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sm:H3fJ4yL/tNCJPXUQrPH
TLSH
T1A94523AB60D5948ADE1587F81B88E001C7087EC6672F62F6EF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f85287f1bb721d8cd8ca641839177eb500e318894e58273a6b46f17b2a31c06b
MD5 01bc4d3f5a0b747f81ba66e46b48183b
SHA1 255618793ec568c899fa2c64542ecfb2208754ae
SHA512 6d81234e492cc49b16f1b3081e257a9737b7b64edcec7574c8a8322fb32e51e3e070933eeff2761e72b511fc951673add03b3a78cd64f545368e7e7b09992769
SSDEEP 12288:TKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sm:TKfJ4yL/tNCJPXUQrPH
TLSH
T1564523AB60D5948ADE1587F81B88E001C7047EC6672F62F6EF43B4827FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2d13b43891e748853036d0a16451235cca7a9bfe75e2a0aa1f9d2594bfe9436e
MD5 950fe0bd078d607e7362cc96e6dc739d
SHA1 508b27fca1612b0b84f75ae4bc5e7aecb57a3f3d
SHA512 9b47e3b11c29180b8a613065676ed4fc234c54d439e86428c1155a67b1062239e06838e21c614c73a5be599da33ce5becd3caa71539f668be82e6d34c8b4bf1e
SSDEEP 12288:g8fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sm:g8fJ4yL/tNCJPXUQrPH
TLSH
T17C4523AB60D5948ADE1587F81B88E001C7047EC6672F62F6EF83B4417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 c5d6f49e1614b85abc6a75f267f2d3055389f0764b721c1d86342ecd28616a12
MD5 7351c250792b919d40f467a8ca8cc1e7
SHA1 59ff87224d832810a111fba1351d177737b39cd1
SHA512 ad222d0bd4af58e776704f405c0c714b7836dfd238c3a886ad8f9efc27cd55dbb0c00468da96411f431ad8e7f015ae1c52a5de138982f722fd31c6989d163119
SSDEEP 12288:jVxfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:LfJ4yL/tNCJPXUQrPj
TLSH
T1034523A722D540C6DD66C3F84A84E001D324BDC5A73BA3EFDF4268863FF9659296C361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 05d94e8e28d26a6c78b35e97ea97e3af378d4fbcf067e8cbb21af9346d0a74e9
MD5 f02f5e2874be6aacc7e2c517a9581c40
SHA1 31828feb990dd5f80f7d980c9a70e8a56b190879
SHA512 b53b076724bd72a5ff06f8095bc8f322581e8aadd8530d52527e460674263a3ee3a6917343f0e95753f5da73b3c77d59ea6f4e874edba1718a5c840bcdb689e2
SSDEEP 12288:hpfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S5:hpfJ4yL/tNCJPXUQrPg
TLSH
T1B64523AB60D5948ADE1587F81B88E001C7047EC6672F62F6EF83B4817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 31c19a761dd7e0943bd6ff2d4226ae8bacee57d0e412899b20ad5e923fdbde78
MD5 32d90bd24106deb6cd601ed3dd37cedd
SHA1 38d14eec1b42487b2f2405e67ccf6da216ef46e1
SHA512 256478b1d8182a0ce838abcb08b75b3a02618956646592d42b770d0fc86b47e20494d1ccd6ae5ef9b2c2330ea4a6d7d12cf58038319a0160441d1f02de50ee9b
SSDEEP 12288:6+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S5:6+fJ4yL/tNCJPXUQrPg
TLSH
T1DD4523AB60D5848ADE1687F81B88E041C7047EC6672F62F6EF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 956217408df2828750985d11baa2ff9eaa88fd2fab1fc068939a15d122f8fd58
MD5 c1582c1b7e9a56e5e36a80876b3254cd
SHA1 44328c5a71ddf8e70ddb521b3662b0d1d34a3385
SHA512 c1ecb7ec71788035ed080364d9126d12fefdf280deebec633a1c6ebe46f7e09fa1b1ed0fda9a6d8dd26f8db6f93401b0c8d3151738515f56304ff710626309f7
SSDEEP 12288:yCfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sx:yCfJ4yL/tNCJPXUQrPo
TLSH
T1AD4523AB60D5848ADE1687F81B48E001C7147EC6672F62F6EF43B4827FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 84b2c36cae3f46689943849c84b54b5b4c1b35ba983080e31828b3fbb95d65ca
MD5 7e7755f0e207f8e3e83364d15cbb514e
SHA1 8680cd6377e4a2e69927835086dfd1c2fed30ace
SHA512 877205ed343730a3459eb178ef392192e736a5ec364e3477fd8eb9acb39490409fec7da03e0ed48e3f9f3d0c5bc8be5a2a097b1fecd66b7434a443ec297a45fe
SSDEEP 12288:7iZwbczzFEoS2cPvyqfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S5:mZMMzFVSOqfJ4yL/tNCJPXUQrPA
TLSH
T1346501A5B39018F8EC67827D8954D902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 eb6124d8b22b265307073da2e53dd5f735998bc719d57a317f65d76c66454adc
MD5 a082995f0a571c2bda137a7a716c8d54
SHA1 200b2368a1faa3af3ce9f3be0cac66f7b20039eb
SHA512 ae6adb3491985c551106327373ff7904b6bec8ecbeb0a4f1dcf6c0d028bec989e4461c9a4e5d1ff49707c745cf56814810e7d39c16c61c4597f6611dd4a4ba85
SSDEEP 12288:ijfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SL:ijfJ4yL/tNCJPXUQrPC
TLSH
T18D4523EB60D5948ADE1587F81B88E001C7087EC6672F62E6EF43B4817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 989f644449610cc1dc7d4284944d3300db9a9b15f0713c4e4b493ca03d55940a
MD5 f3dfebbce1ab2c306fe6ad721f983c99
SHA1 9d694af057025045046b32a294ab22df69bb387c
SHA512 001da4f7647a56ac408c90dd115d69af127b99c97934ca22a3e2105b52321a7578ce8e1e44c206f1a6f34b1bcaa549a522a5ee3900b29dd49e3977e326b374f8
SSDEEP 12288:KffJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SN:KffJ4yL/tNCJPXUQrPU
TLSH
T18A4523AB60D5848ADE1587F81B88E001C7147EC6672F62E6EF43B4827FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 d7eb572d45ea337d5d5fd46e4c3d31a35c8d5df494ed55d5a7246f55bf1ce708
MD5 89b7d28cd4e1fc922c7447245f66f6fc
SHA1 10847281e082114b722eafca131556c4ea605c5b
SHA512 dc152d5e43e896c43e16852cadd23f5301b21040dc3b9083fe21912018c31331158341bbcb709e4aba6f069025a06367e3fb7775b127b7b24d4ad35ab31cc5d9
SSDEEP 12288:uyPz5L8mfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sb:zzymfJ4yL/tNCJPXUQrPy
TLSH
T1A155125732A130F9D536827889909602F331BCB2072597EF5B9046B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 73e17e6981ab2c3a3455d7604c22ea3e32a4f45a1188da1053060aa8c05728c9
MD5 2a91315a7417a6566854f3977ba64d87
SHA1 a45271f4cc27c826ce8f611acb91faba3b910c67
SHA512 563d76933ec5736a0967ec8564428bbeba690208c572dd0a07feda2a10fa0d7c69a0af73e3e7ab8df51b274596f02539d7dd18061425e2e0b3c21c57b6542d13
SSDEEP 12288:WjfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SN:WjfJ4yL/tNCJPXUQrPU
TLSH
T1354523EB60D5948ADE1587F81B88E001C7087EC6672F62E6EF43B4817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4f16fa0d54785536b358355a38a70a26a063ca2508d776048899196d60b41008
MD5 db7a41854ce818b8fce847849d97984e
SHA1 49dfd47580635d9e1bba7c2abf1544e5f72d21ba
SHA512 229f1bc78870d23295430ce0947bca5f8b25b18fb4897fe96f6d081f802d3ca33120caa8ef82d222b7c1eb603493b54db8266d6f36d65662ead1458de50bbd42
SSDEEP 12288:xjfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sy:xjfJ4yL/tNCJPXUQrPf
TLSH
T1DB4523EB60D5948ADE1587F81B88E001C7087EC6672F62E6EF43B4817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 1fc48eab4c660642438022739a575f9ac7bf95204a3e0c5e86502d51d7fd95cb
MD5 f0249cb1dc9af02db9f7c473051a6c8e
SHA1 ca53ab89eb11679601771be8be5223e12a14ff2e
SHA512 3852bf5e30c9558b57a42a7420d51255a26c247753845dc85dc5826b5527b3d423ff08c98c0e2ef94056a77e499848075e80c8f6f0fc28a065e5ea9dd8077590
SSDEEP 12288:QyPz5L8mfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:hzymfJ4yL/tNCJPXUQrPF
TLSH
T1BC55125732A130F9D536827889909602F331BCB2072597EF5BA046B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 dc7016686808b920a66bb5d46b7e5f821aeaaf8a35a220d0f936894c557ccb1c
MD5 e9d46efeaa139060103288642741684d
SHA1 98408385035382088a45f85c3df33acbc080b2b8
SHA512 e7aefd1e5edaa90407ec5c26e3cc42ba04521e37893461771cb0007bc847d83fddac869ae5fd49bebaa53e3da0a1095b35943a72633c47a15872bb489e5aac09
SSDEEP 12288:YCd9MWYoaLHF3z0z04PDvhMfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTh:BT9aLl3z0zDMfJ4yL/tNCJPXUQrP1
TLSH
T1956501A9B39018F8EC67827ECD549502D3B27C9A0770C25F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 8fc45cdd41a153285f39f7c3bbc83fb13e2433ef6a526ac095db380ec39c0370
MD5 b193a05b6009fdfb9f4044caedadfc05
SHA1 ec09220486fa17a65e9fe5aa0ce3a31c925d20a1
SHA512 892b745d297442ac56a887f390dd21ce2b41b769b875100ed3355a98cfeef124d9426d648a842b2a62fc6c3ec28d9f359e056a504d6dba7f3ae042b66849b656
SSDEEP 12288:Xi4e7oRdTfgwCHKy7GLbbdIvdfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGs:X3td9CHKy7GZAfJ4yL/tNCJPXUQrPp
TLSH
T12E75CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 666154214e18f505b8b7068c5b2a6daa745cafa2be6d5bd146df881799a95329
MD5 b6cb345f35c1f298fc2b91bb13dab306
SHA1 284da3422af3e38ac69f3f5266ff953d975801b0
SHA512 83d2d41a31e1e6fbd8ff84928a6b2afef3a45220684ad9596dd7d352a79da7390d5a485b39fc38eeb8aca61950fa6a10c8cdf7ed673e5386fa5e0642b74538b7
SSDEEP 12288:DcfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:DcfJ4yL/tNCJPXUQrPn
TLSH
T1EE4523AB60D5948ADE1587F81B88E001C7047EC6672F62F6EF83B4817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e95831cc3a735387276f6ea68140443b31c73b2fbb786d0411899dd23acf2113
MD5 3e6e52ff6475986176a6d760a62097bb
SHA1 e06639fab6586287fce22ec8cf81c5ba00ac18b8
SHA512 0438af33f692e94a97477e7f159cc68e06885838b20a02e48e668d65040019876a8210c285756cf9143c281491d7db626d838e0827c33a34e8121ac70dffef8d
SSDEEP 12288:qGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S2:qGfJ4yL/tNCJPXUQrPP
TLSH
T1954523EB20D5949ADE1987F81788E001C7047EC6672F62E6EF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 147451f64e51ea207b64bacc744e079652f8f842d34112341f753904409b4b39
MD5 24f5b281fdd3d524234a0f96610c33ec
SHA1 8848015d5b4939792a0fad74288e1ea43bbbcd48
SHA512 226c7b2f9427618d3f2c9111c51a717dfd3efc47bad6acfa3dbae5d16140c3ef7d7d6c97df7dbf47f0e2e23a82a989ac6ac9f3c16eb9f812c6bbdda56a357f1c
SSDEEP 12288:IdfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:IdfJ4yL/tNCJPXUQrPz
TLSH
T10A4523EB60D5948ADE1587F81B88E001C7047EC6672F62E6EF83B4817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2d0aa884879e14c10501652148dba1a788acb826038ab8ca4328ba0cc907ebf9
MD5 d1bfc61362a20b24a6483c8812166fcb
SHA1 75ad156802d3bebe515193d4b0c85d45dbe8cd0a
SHA512 60e5158aa78a327534867d5c2a7c6d14dbcec3d1b2ebef0e1cbdad1980a4ad450cf3e20c6d29c3ef4572c0f37e50aab7ee6912b4566fb391f5c4b4e91a1f8b71
SSDEEP 12288:8jfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SH:8jfJ4yL/tNCJPXUQrPO
TLSH
T1884523EB60D5948ADE1587F81B88E001C7087EC6672F62E6EF43B4817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1635cdc27fa78787fd5992d4f7ecbb894ccac7cc692617dc99e05645281e4794
MD5 e678453853551edf93257d6d11031ab8
SHA1 69aa67dd3a087b64cc3aea7c19ac56a41e486e0f
SHA512 9cbee172e4c3cdc773bb455251779f085b6bcc27c4bbc861c77031788b633060f60e194700bae1b119f24378a255a9900b33c6d5408248218b6946c7151ec33f
SSDEEP 12288:WcfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SL:WcfJ4yL/tNCJPXUQrPC
TLSH
T1A44523EB60D5948ADE1587F81B88E001C7047EC6672F62E6EF83B4417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 135a53d9c3141bf743349a49a62cb558e382f2bd2381f70a6ef642fdcdf1d663
MD5 1006fd486433e714a3fbc997d4bb1af8
SHA1 127b68874fc4fb974f892f4cc72dcf31a3dfa6ec
SHA512 29969eafafd7971020cafe05177d1d7da91ea3de40f210af38d6778ce0d86354026d69242ac29e01f63c2febc47e6d85ee729c45573f164dc7cd2b2baca433e8
SSDEEP 12288:vbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:vbfJ4yL/tNCJPXUQrPW
TLSH
T1EE4523AB60D5848ADE1587F81B88E001C7087EC6672F62F6EF43B4827FFD91A159C361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e78f635ba3a81d926a55d26f9a85d1d8a7221faeab23443d4076c4888cc22b39
MD5 d98d423887a22c47fec6d4e6fbeeaec7
SHA1 40dcb382c0c5fcd8922917f421621962682e10b9
SHA512 cccaccaaebd2e13163bf658d85c67a99df48636bf09247151a3dde7c1d59b37884df0e6efc573a9ae14c1e23c9e26380a7b2907c956e0fd6971fa778690f3e23
SSDEEP 12288:jpfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S7:jpfJ4yL/tNCJPXUQrPS
TLSH
T1C54523AB60D5948ADE1587F81B88E001C7047EC6672F62F6EF83B4417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 b92b8786b21e7c0ed17ca88abd306ed6592463a622a66cc52b9428121535023d
MD5 4bb191f933e0eed3ced3a735f1c435f6
SHA1 9000633b68a96a532db24a50c3542c270a103e8e
SHA512 7df807f4f16fce4778869546b891d209e7fdfcb26015bced7fa3cf038c0bfe9763ef5c35f2b04d427160435f5ed018903b95e970ca019d408ee09c0de032418e
SSDEEP 24576:Kfwvok9RX6wkyAIPfJ4yL/tNCJPXUQrPB:+MnYIPfJ4klKXn5
TLSH
T17575D02AEBDC44E5E177923C89A7860AF3B178591B31C2CF029A53AD1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 15a0a9cef71b10d2535d909bb873a5375de1b5beeb15789a04c462cfdfc72d14
MD5 f3113b775f29e469715c53405804fcf5
SHA1 e936269d578022c554266d2105e44d76d0c9442d
SHA512 538bb280dca707eaf03aaedb74f0d4c97242331685dfc955a23dc50e2e7ef63af6d7039eab534a9efbd491f7804d06bb79dc7b442b36c07b0681463c8635faec
SSDEEP 49152:DYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0YfJ4klKXnL:dySzPAfJ4k
TLSH
T1DC066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5c1a13eed1785114789f53b153299d3b68f8f7717b2b4d7afebe588d25ce9616
MD5 59b710862554590e456f363bac024358
SHA1 54600d9232f56aa3d2328b5fd2ebe89735f2eb49
SHA512 9eece81d7c8e417f1dfcaaa116501a0dfec9791c0553fa6139ab838428c8a31e5d1fa690d425dae55fa32994fd3b39c41b8781210a6614657b0e308d5631a786
SSDEEP 24576:f47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYafJ4yL/tNCJPXUQrPk:f47JUQj4irIhCnDHUPfF/IfJ4klKXn8
TLSH
T1EB65AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6bc43fce3b91af0b40b031cfc9dc117510ae3ade58f223ba88bb27058bbe4360
MD5 b8381d87cc4257968713a05b3cc332d2
SHA1 d331ee3faa7e190daadeab503d7b4658a3b113db
SHA512 da92d62240758705b2763b734b8703561bb0b9462e2baa4d7d6075b7edb6734e490c4f01b4ce26068571cf3ca2d9b7ab135da779fb795d7a3d808c848d003248
SSDEEP 12288:7GsfzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:hzfJ4yL/tNCJPXUQrPD
TLSH
T1B355015AD29801D8C46E92B8CB449201F3237CA593E2D3CB97C1F47E2FBA6945DE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 92b9975caf82a51fc5459428f7c232b69159fea4996e5b7e3fa3d46b70751444
MD5 9803905ea068a82aeeaa5d82ade691aa
SHA1 15d366ea76785790823613b2a63fe3b559cf0165
SHA512 07773f6f794310aa40bbf5401e4ada4d66eb5bb9b55fff3d02a6cf44b1a70ff0698d8a206f492e50dd2e3c3f45a8117e49e4426cd254a42bbaad44e88a8d555f
SSDEEP 12288:mX29VKbU3fNSKSAGwVyE2XLmfU/64TZ2WiSKXT0BlQB8aK:mXeV0UPN9GFmfU/tTg/Xj0BlDaK
TLSH
T13D453900762AD75FC5A940325E32D2CCA7707C51EE05AF0773C89B3F9576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 f11b16656f165e7f5404aab1f35853699d8bdf66958d8b461eb990fc75bc0cea
MD5 d0fed322291ed40794f9088256e027e4
SHA1 9eef71e352fcfe9df68d1a6402fed45e821784dd
SHA512 7454c5d78f0f4578a3ad95082646fa6e5cd001a14771d439af9a07b8eb65d5d0f9c6b8f5080eb7dbc2f9a195ca3dc6ef5e107c85ee84e78ad8b21e8afc74b4f6
SSDEEP 6144:mZ2h6cDFqdLe8aPh3eVKwYKYy7+dUftUAeGIyiugSvC3tMxFC3tMx/FAow6OZmlP:mZ2h6UDxeUKB3AZmlzZTqssU
TLSH
T1EA65E8816137E39FD1F76072032A5B4DA764EC06B6096F26B7C9443AD826B21A0FD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 242fdf620aa62dfa6ed875f555686b442226472fa04be68e06b8e2d0aa4b516a
MD5 9c1a1163b07494cb9662661b954a2950
SHA1 e3ccdcbdffaf8bac2696c8ec40737d08443b6f4f
SHA512 74eb70a2f28f45f3669ca2553a4ac627e649f8010e890b440c01630ca0267296ccf7464220874e1caa04c2a790cd10c2843a46d7b7297ab8ffd1a39fb9947f7e
SSDEEP 12288:QF7rfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:0rfJ4yL/tNCJPXUQrPN
TLSH
T1F34523A751C49446ED7A87F8164CE000D308BED55B2BA1E7EE42B4867FFC9861DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 003887111dfed006d9fe8412ce2246c60e9a3daa164691686195b585bc10ce1f
MD5 c713be315475f472653d4ae794759db1
SHA1 ced9092ecaf1946b4ee585f5e7ef01c8705ecbda
SHA512 5594d3961e1bc2afa9282c4f6e2ccf40e194bcc70e88cf23e5efe0b82bb36fe57e2f5c172e7cccc55fff5deb8e556e97d9c04e9da786239ff5c51a46269b3ec4
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYlfJ4yL/tNCJPXUQrPz:/gb4mBIBhGFafJ4klKXnL
TLSH
T16665AF1E22EC02F5E0F9D3B89DAA4417D6B278160732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 152eda6b2d37776ace46600351dffd30c83f77be3ed3a2403aae766e3e3947ed
MD5 9552610a9d88b2d1a4418e92ec134715
SHA1 5d9bca3d5e990a47bfd3766264d096196c55ffc4
SHA512 af03b898a95918b1b189938e731c01eb4ef36990ba6250d51344698d11d4148b609aba2d9df73c36172b3406f420d908869d8678931ba3ab566cf54fef2cd295
SSDEEP 24576:XG88u8FpJqH1Wzria7/mqfJ4yL/tNCJPXUQrPZ:W7ZFPqVha7/9fJ4klKXnx
TLSH
T1D085026672E101F1D47BD1388A868663F771B8150375FBDF0BA88A512F23AD50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f4f26fb4fd58963dfd6552c14d0ea29ded2fd2cd8634adc6cf9e4c30c1d4fa1d
MD5 5b57816af791576871022236a104daba
SHA1 23b4f72c0f08c52b1682fe3492d6b1f9582f7917
SHA512 cafaa5c6c93725ef806ccb8b7f8c9b35be56bbf3a1d77d7bb7daa1ea2406935a4bef6d37260bcd18c7673a46a17b1c43f59ed0ef083ddd57b3879b9541591703
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj+fJ4klKXnc:TG05lO43bnfJ4k
TLSH
T126D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 be53284bde8c6d11795d154afc4c9db3d0da8ab1f8647233305e5bf1a541c16f
MD5 c509182a4f5007d03f39e56178984eca
SHA1 f141f200e35ac7f6999bd51014a788aedb035295
SHA512 a80f4b85792d650138a65ac9be37da598a68aba59c7074d5afa10c409b646e03add0ea8a884be4cbdb4429b812f9cbe0676c8139916e2a035c5216ea000e7885
SSDEEP 24576:Yfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnYfJ4yL/tNCJPXUQrP3:ga5POZ39Jt2pasx2+mGfJ4klKXnP
TLSH
T1A565BF5EA2FC01D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 60afe46f2f539286dbd609fdadde1e41b44899c7b4bb7107c65a3f361e9703ca
MD5 2be418839f563a90155cbcfee6da0d11
SHA1 f08b39c85a2cb741b2efe303de14b33630c82813
SHA512 7240ea4612f642a7142fb22b611366857be2cd7fac11c280be2b507ab75b9d28c23ff6a84e351830f5c01144cfd76b6d1847f16c0eaa0a8e77618fa36e611180
SSDEEP 24576:XNcwHdjbyQ4nLC18lb/EOjowL7FkSfJ4yL/tNCJPXUQrPs:XNc/zEOVHFdfJ4klKXn0
TLSH
T143858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1912555e22f160210bc2fef20fbf915470edf35a7c9f8d8de3fc341fcd5ae1d9
MD5 a893805fefefe2e8808748ad72283f4d
SHA1 48623d5e7dcc33cc3213dbcaee48ca030e542628
SHA512 b46ae75ef6bdffe594afdafb398401856aecbc9c564a549131278d711228ca69f3a1dfb47177811c32aa62c59681fe9094d4a6dcd3c2dbe66678ef4a0696487d
SSDEEP 24576:StkNvNnaFeYhJNtmZBmEfJ4yL/tNCJPXUQrPT:StMwBtOmEfJ4klKXn7
TLSH
T18C55AF6EB6F845E4D1FEC6B48E238112E6727861073293CB9290C13F1E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 fd6da136d5698f602e4e5947416e5f4785ecca8a9362539b2d8482608ad58ead
MD5 5514069a87acfafbf062c05b1a2b393b
SHA1 5c42b00ecdfb24814862db1e180029b69c669c27
SHA512 a31ec566b30e6f8f461e39d3600323817c54c3273f285792f5ea7e5fb531a2b974d64988f837a32d09806410d2b9510516a1373e2821b6bf61f21d436e9b36c8
SSDEEP 12288:NHvUrBFrEjwaQufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJ:NPUr+NQufJ4yL/tNCJPXUQrPU
TLSH
T19D65F16F22E818E5E676E17C8A858209E771B8A21312D2DF02D1817E5F77ED87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 d58d9c50472e5ea33a3defd3859d507e490b464870cb1a8e32c8bf0bb7a1dc97
MD5 9e001c7e1b3d056d7abf99e6e9c2e5f8
SHA1 19cdcd050c28def47a4b11ac8ab929d3a1bfe9fe
SHA512 489b19775efb3afaca16a9a56f4415585ea3302cf8975d003a253acb5fd13d3a4b1cb724f9eb38d28de740736ab03066c708826a83762f3cc3a0f4ab2bfdd295
SSDEEP 12288:YQcMxWDXN1Dp/fshBItT1IQgAXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+Gu:6D3FHshBIYQgAXfJ4yL/tNCJPXUQrP2
TLSH
T11F75E17EE69C04E4D57BC2BC9A538506E77138E9032266DB06D1C1B62F6BEE42D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/404-101-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/404-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/404-320-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/404-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/404-107-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/572-113-0x0000000140000000-0x000000014026F000-memory.dmp

Download

memory/572-121-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/572-318-0x0000000140000000-0x000000014026F000-memory.dmp

Download

memory/572-115-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1116-73-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1116-67-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1116-293-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1116-65-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2088-311-0x00007FFCA8180000-0x00007FFCA8190000-memory.dmp

Download

memory/2088-87-0x0000000140000000-0x00000001403E9000-memory.dmp

Download

memory/2088-9-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/2088-1-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/2088-309-0x00007FFCA5710000-0x00007FFCA5720000-memory.dmp

Download

memory/2088-315-0x00007FFCA5580000-0x00007FFCA5590000-memory.dmp

Download

memory/2088-314-0x00007FFCA8180000-0x00007FFCA8190000-memory.dmp

Download

memory/2088-313-0x00007FFCA8180000-0x00007FFCA8190000-memory.dmp

Download

memory/2088-310-0x00007FFCA8180000-0x00007FFCA8190000-memory.dmp

Download

memory/2088-0-0x0000000140000000-0x00000001403E9000-memory.dmp

Download

memory/2088-312-0x00007FFCA8180000-0x00007FFCA8190000-memory.dmp

Download

memory/2136-39-0x0000000140000000-0x0000000140206000-memory.dmp

Download

memory/2136-40-0x0000000001EB0000-0x0000000001F10000-memory.dmp

Download

memory/2136-46-0x0000000001EB0000-0x0000000001F10000-memory.dmp

Download

memory/2136-52-0x0000000140000000-0x0000000140206000-memory.dmp

Download

memory/2136-50-0x0000000001EB0000-0x0000000001F10000-memory.dmp

Download

memory/4848-61-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4848-277-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4848-54-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4848-55-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4900-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4900-15-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4900-23-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4900-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5660-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5660-316-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5660-333-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5660-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5660-89-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5660-95-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5784-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5784-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5784-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5784-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5784-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5888-308-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/5888-77-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/5888-83-0x00000000007D0000-0x0000000000837000-memory.dmp

Download

memory/5888-78-0x00000000007D0000-0x0000000000837000-memory.dmp

Download

memory/5904-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5904-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5904-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5904-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5984-133-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5984-138-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5984-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5984-127-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5984-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download