e33ea8712914941f32f821d26687accccaa75f1171e66d5f7e0412a9707cb063

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.9MB
Sample260910-eggedswgnb
SHA256 e33ea8712914941f32f821d26687accccaa75f1171e66d5f7e0412a9707cb063
MD5 9a4071f71d130aeae9c957a992a8f72a
SHA1 9812d95a4f012678c5714413c9bacd419f4be48b
SHA512 c0d168d4f4ba1c409ec78193b07bcbf0874946058f4f3b1169948bf4f95f26a361e37ca95ebca424e640d8f88e03d2214b6927bd572466d7283ec8d9385fda45
SSDEEP 49152:ROAeQDh2Y6yr1fKjffYUAkiiQ72H8s+GpHsIex4x8EVep:oFUKjffYUAkiiQ72csPSix8EVy
TLSH
T10595BF1663A801F8D1ABD178C546560BE7B2B445132197CF07B88BAA2F63BF25F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5704	elevation_service.exe
4728	elevation_service.exe
2988	maintenanceservice.exe
4740	OSE.EXE
3196	PerceptionSimulationService.exe
1844	perfhost.exe
1100	ReFsDedupSvc.exe
1752	SensorDataService.exe
4284	ssh-agent.exe
2764	AgentService.exe
3940	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\74838f15238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e09dbc20d840dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054bffb64d840dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001bb6841fd840dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002581a521d840dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000006e06f720d840dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055133422d840dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5569120d840dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5704	elevation_service.exe
5704	elevation_service.exe
5704	elevation_service.exe
5704	elevation_service.exe
5704	elevation_service.exe
5704	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	2764	AgentService.exe
Token: SeBackupPrivilege	1100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1100	ReFsDedupSvc.exe
Token: 33	3940	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeDebugPrivilege	3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3780	2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5704	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 2144	3940	SearchIndexer.exe	100
PID 3940 wrote to memory of 6028	3940	SearchIndexer.exe	101
PID 3940 wrote to memory of 2132	3940	SearchIndexer.exe	102
PID 3940 wrote to memory of 2992	3940	SearchIndexer.exe	103
PID 3940 wrote to memory of 2412	3940	SearchIndexer.exe	105
PID 3940 wrote to memory of 5544	3940	SearchIndexer.exe	106
PID 3940 wrote to memory of 3536	3940	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4728

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2988

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4740

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3196

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1844

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1752

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4284

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2144
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6028
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2132
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2792 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2992
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2412
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2792 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 082211ffab3f35fd5f382e365bff28aeb1390e899b47d72cdb83782abe709b57
MD5 b5931edb26c6230d4c142408d7dba4e1
SHA1 810bb3afee87f2a3b70e10c3e8fce2e3c71f2df4
SHA512 b642a26fd0850a8be683669f92a16f98b9b10927ec38f7989b8141a751ce2ade890c3a4a00409486c1f249746e3d4901ac964c28105139f90fe160a03f155d3c
SSDEEP 49152:jb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn0x4x8EVep:B3q6mjB7ix8EVy
TLSH
T1D5D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 1ac10e9b66b7fe57212b8b843a5eee43a555a8ab4a0f031e0498e83561e97d37
MD5 a83bfd8e2c642dc2badc87548e91e5cb
SHA1 302164aa94d1e8f3b83daed3acd4e388222a1b03
SHA512 8377c3715c4754ab8c3a6c044a2f83026e05ce9b570b70d4cd3b8bc3e9497ee030696b5474adbf511bbb0986737287a43424e898a54c7a1688a5a5ce3ba9788c
SSDEEP 12288:w1XLsswWkxy2lRq2czAM+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:mXYfDtczAMyxknw4FYnshx8OfVe247
TLSH
T14175F12877D548F9EC6B8139CDB28112E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 7df78d045630cc5a179aa150bedc88fa9a854469b47b070cda6b9b0e8b21dcf2
MD5 f30ecb242b0008226d6bed0946c7c648
SHA1 252927d6b960b51d622031993c2a3f94147a39cb
SHA512 e6d1e23d46f5e26abb0cc1d50645d95123738909d292405c803154f63926cfe22fac7dc6793dbc60c822a1ff34fd0d3a63e6ba0148f322022e5b89ae51b0e798
SSDEEP 24576:d0Le5ji0hmxSrMpyxknw4FYnshx8OfVe247:dPji0Aodx4x8EVep
TLSH
T1BB95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dcbdfd5f015958acb089e184ace170f002e62e2c0871056f2b3cdedb40210340
MD5 5137d38a9ec8769401894474df9eda64
SHA1 566003cb147bdfbd05a35faeec2fb689764d374a
SHA512 43841c2baab9b6677027bb25a5a0698b0fc8005fd8cdaf9b1026e2c3205d2b242a63b06218aa340879b7260b3ca87d04633b498a0c9e5ef0290c15d5f62eb2ce
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWj6q8wyujyxknw4FYnshx8OfVe247:n/ezSC6vUzPv+HjyZx4x8EVep
TLSH
T108756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0a51fd7a7e59c836f3972d5718cbc8be5229b87fd839c9e2ceac0ae10781413f
MD5 6ebae689423a9473e72ac01cba3b5b39
SHA1 6145bba6e60ac3ab8796bd9136a231227a4a2e47
SHA512 0eedc1a7f06efc75e2c86af064be4f96417f6acf7ff38b68857a757bb6a1ff7b562930e77814f52a4eaf3b465a4c4d8474cc829212484b7e72cf47a219cca247
SSDEEP 24576:LVbqPb88hv/l+Boyxknw4FYnshx8OfVe247:LVO88hXl+9x4x8EVep
TLSH
T140559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 ea65e019115d0c42af20b1f1f350aa745243719daf5732780115b81375755ecc
MD5 5450caf21db589fc68660ea1826b2192
SHA1 538a79e6c2e715e754c91799c70e9e3ed32f4347
SHA512 65380fd912827b75c7348525c4dcf75a295d7a1bb9424eecfeea55d318fa0315485b8b49d380d842f7f3306d8aa9d3a59ed9ceece0b4b58732e3b5eeccc15d2f
SSDEEP 12288:6aF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6aFyxknw4FYnshx8OfVe247
TLSH
T1DF65237CABD9E4E2F65E14331A7572263605FDA0DAB4C11BCB78B54EE0B0C50E06E613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 c47e44c2ee0b5f213102c07fe725c318ac5ff91af380fc2695cdc46a0a294872
MD5 414a67bbb3627fe37ad1f225cd90c625
SHA1 80bf5d14225465995328d3c57df8b1ca836b46c3
SHA512 887d611947a6661e7acdc8479f3e4eb5a0d0f30b0e8987bf28d434b6b427a2c773d36e662fd83ee45e2a2d7c1fe0a656687d1944222d4b6a6bc05d912b29741b
SSDEEP 12288:heBNUbTVO86Ug+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hJIUgyxknw4FYnshx8OfVe247
TLSH
T1D375CF7BEE28FCE2C27E5DB95B918200A76274704F6193CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 49bb5316fd3b242b73b218ddb93391aac0f74e3561c2bbc505ea6ad83a1dcb2a
MD5 afe62c02d4b4cd1cb0955a5d801e1a1c
SHA1 9e705999bde795d08857ecef8aca24f450df8d57
SHA512 ce0f71cf9c1ce98124f612ce4f21114fedc395e0f44d151b2fb8a1f71868f61f1f31cb9165b7fbb37d0f57b5771c8116ef7445f7b155754a097804b123ed50d5
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THL:zQvGAdlCEL8c/WRNw5C2ix8EVy
TLSH
T142267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 81cc5783eccefb10cc72bbe219882b27a4bcb8eb4853699c162358e456f52e35
MD5 24a348cbe114b71e9646c2ff9b9236db
SHA1 ef2d11537954b91cce8e12dead4237fdc2f51a51
SHA512 15242127e2481d92d6a818cd7b2a1b971120c1f0279534fe90900c5738e0e168b4dc068978a105939c9bc5695657399fd7edb4ed3210353ea8e39ffae5694cba
SSDEEP 12288:uAwSfxL/2Dc3zDLLmt0LDQewsAjy+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:T+ewsAjyyxknw4FYnshx8OfVe247
TLSH
T17285E030FE74E032C67F0DB21B36D716142DB9604B611AC3E3E89E9E99705D2637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0463c29add79b44bd0bce8538aeb2141515ba8d3005e8102d78e4ec1f0903b22
MD5 9d8ece4b69ff5415a375579445da5507
SHA1 318c93aa3bf2b439a2f712cc09bffdf319e02e3b
SHA512 f7ba8fadfcab2a49b14ab801162a4eebd70652c14c7aaf1fc7e62921a3a7934a40dbea9abba2474633291a41286a75980e93d9776e7abe4c9fa44014600ad1a6
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH4:sUEtQevvqc2W1cpV20I32
TLSH
T107474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ce126facf973ede0b8a98a4355c24d1d4ce3b71352dd40aedf78a94cef4db0d3
MD5 26c2d1c2baf6b6851dbcd0c53ab0084e
SHA1 e153583bbb15a56813ec2024aee6c6a794aac7c0
SHA512 8554a56e10d9f9d28ad75982a1ffd6119e339ce5fe5d152a9595424edaaf3d531f2620f90fe2d151e5d8fc4f571d1df1ecf0c9c3719e2dfe088cbaed608bc180
SSDEEP 49152:WCbRquA/m2yL5zLfFiV+XenmE3/zNx4x8EVep:boq2Vjnmiix8EVy
TLSH
T194D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1dbdfa8d5407fe743f2efed3bd574ef7a5826ec87ef4ec7475cafa08fd6249f3
MD5 14c9d9a91aa5da830cd33db93f7c726b
SHA1 083ba5d1d9f639b52e49c4b589351523c85d2464
SHA512 62e695803793f0b22392d894118988995d4eeec71a3b32368346c8339f4a44c47a15fc1283f2adeff200daf8f51d68e93044a1f8baa1b83bb410a7c71537f2bb
SSDEEP 24576:DAhGL6IFoiwtA5l7S533yxknw4FYnshx8OfVe247:DAM5Foiq5yx4x8EVep
TLSH
T10B35AD80EBF955D4F5B3AA7899B69171EA76BCA65E31C20F1260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 50066571f2437d5e1c0d3bc04ad36f4a76638c19d550882bda3e282a3d4f92d4
MD5 5c18773865cf235214663825ef41dbcb
SHA1 c42f5f80676658cebc2e1fa9cedac69273618eed
SHA512 9478e3449e3318b6b195fb1409fc1ed03c166bb5f7ffc6ca6a689b165ad7ab76880359a98be9da44bc2e3ec0fe52749725728a6cecc55286110faeb863f5464a
SSDEEP 12288:pmw5HEjsChNrBFgl0WDm+CD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:kwumOWGyxknw4FYnshx8OfVe247
TLSH
T16075F14977E81CF9E9A741398657D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 1900db6a1b2ae5d459f9880b0f25475e65d2f22a22be20c35faa62c5309cf7d9
MD5 b0367691af701882fe880d608bfbbbb3
SHA1 36abf687a1f5403b9176fcc772ee3f949d37649f
SHA512 422ee9f82102381abd3d17d110fa8539e6adeffe812514b4a1b195d5beba82d522a7f19f68a00ffe27082c2b04d3878519261df4b50747a9196d800ad4667cca
SSDEEP 12288:wvZ1IyC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:QZuByxknw4FYnshx8OfVe247
TLSH
T14F6512AC33E870F1E1A7113A89F15206E762B4A2677183CF4768625EAE71DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ab583b8b1032f3605ec3926225ca1343a8c4f9b196893aa8df1ebd02c9bca8dc
MD5 cc79974aabe98f0375f490722dde43a2
SHA1 9af8d3e5fcf4a49a294c3305a55c405096df1c4a
SHA512 3cfd97e695690b7078dc42179a6648d616fc3ed40907509107bb952b7fe3613e8d9bf141066466ca1c62f01a490c5619c38c2f2cc67f7ff7bd43f154154928be
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UP:SQRQyi36YOcPDLvw2gAf+PN3fix8EVy
TLSH
T16B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f4763681879ff952ddd43f48c724b2b68c64c88f688cd620748b44f91efacfbe
MD5 2580509477149548e13816061816ed82
SHA1 b8ab457c521da8bdf4e8adac52f03311d0a9416a
SHA512 bc4e7bcb429f7909e294f120680d9416d09a7bd41806a48c2d1dfb00c4afdbdbe3b75b13ee9b6f7d9d04ea4aed8b0f02e8f3ba10d3f07abade09ce16ff651b52
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UP:fQRQyi36YOcPDLvw2gAf+PN3fix8EVy
TLSH
T1DF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 627f50c75d964781d74941470c8b8898537225c58150d7fcf3897745dec84b5d
MD5 aff9bbfc06ed32e8612b2bcc9bf85da4
SHA1 9c684348856246291b8599d0e059c8f2b50464f6
SHA512 f1ac2029e1ea7f3a04f900836f2439fdd228fc44e5f39bc4159a236b2f3a71439244b75c0e37321a2d2dc29fbc440e3976f9b0b2eaddf7847cbcd8d1675a592b
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0xyxknw4FYnshx8Z:g68Qg55nhkeWu7PNU3/dx4x8EVep
TLSH
T193B55933B2F600A9C44DE1769F4A973196D17C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f9af0b21391af93e5f9e5e09304f5af943739ce4bb94d9a2275f1accb9316265
MD5 6ae3fc4862ddc7a23ff5bb1f0741e1a5
SHA1 571f1ef22bcb019cfb95509f78467a05ae794da8
SHA512 c7ec5b542480842f381a42aa1527409f7867d90e2c9abf6077e0abb62aa00a08c5135aa34313abae6e4e089f823e5373f267548fabcef7c33f054da2e3f9d55f
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99V:ny5112gYy5azzVvU69nLKnhZQix8EVy
TLSH
T155167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 624b8d577ed2f4e6dfe3f368adb2c67996583ad92ca8a5baf399e80818f19597
MD5 d5f21b52a18fb0a66b58050b32f9ee70
SHA1 bac2a8673c5367f1e2a70a7cf9c2693ef991d1f1
SHA512 c74c2aec21ecad954738eb9239ffbca1d87759a4e516670671bbcbd0b0f84a0bb872a30ec06af54bda9c6f5a83bdaca5386c5ee0e83892a5401004233e095e3e
SSDEEP 49152:DB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glXx4x8EVep:1u6JmIxd2dXix8EVy
TLSH
T1FFD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c30b125dc8c7bb09193724c691743ab4f7d9f91e48f9e88dc00ad26af2d56786
MD5 9dc278b9fe2537a05e035647d63ea78f
SHA1 0dc4510efcf618f7edc2cbd7a07cad6688cd9149
SHA512 faabc2cf9403fb72db44993d9acae979fbdb79d9b935861c2236cef537d59ee22a7bc7dcc1b879e7aeded437033d2ee1de270aa826c175bf21900d5491ee1898
SSDEEP 49152:91hpsNoJpF1A67U44CwH7R4xDx4x8EVep:9mifPqRiix8EVy
TLSH
T1BBB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2750968092cf25a6dc11f890b1b6cfd18cda0eae5b49d18ca42a5d3148c6c0a2
MD5 fad166409e2abacbbac235a072e42e15
SHA1 80d9ab37690d1dcdd3a22a1a641d2fa8e2fd8103
SHA512 5e84ce062a6d27b5e91ef83560157e331691b55a252fe014c52b7e8e31a5a8e648ea6684c2caad0bd3145aed0848d56d3d596396b276ae55ef2200d8e68b56c1
SSDEEP 49152:ISuZQIY0Be2KkRVtOnks6NMHqEx4x8EVep:S5dKqi61Eix8EVy
TLSH
T1D3C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c68db7f8633b9579f27fb6eb96e6ad77d8c1de311a00b0c59d782728626e11c8
MD5 28038885fbf04c7524f05dc8904f13fe
SHA1 fd8deafc8546bc9957918de1efd24a7e0ba988ed
SHA512 11394b0a34ac4042da7f26360bb7bdce181c0e1c2b604d713b816ed8ebab5efc65358dd2859efcbba607e0838932cecb0c439715716c6eca458efe6c5e152abe
SSDEEP 49152:9htSn8EApI0figjgiDn0AP5wnx4x8EVep:sX2iWpheix8EVy
TLSH
T1E495BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 5b42b936616ba27577a17030173cdd00f2b736dfd3d7d8809181013aac5b4bd3
MD5 1556ccc3b41ab4f0c545c04549dfdc3e
SHA1 f4441b41f491f78932003cf066aece85270b11c0
SHA512 cb3f6579849be8a815476a43cb866d6c46bdb9abe72b2f82b5bb94bd0acdda055330eb2ca2ff1abc6c2be8f9aa4778f1d08db5eac028e71652f1169613107d5d
SSDEEP 12288:h9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:h9yxknw4FYnshx8OfVe247
TLSH
T1C865237CBBDEE5E2E50D11734A7133667609B5A5EAB1811BCB7DB00EF4B0C50A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 6dfeda121afe2633d561cc50749efabaaf68b3a0ddf5750893ecd56e4d6e44be
MD5 f8a6c80e981e55e2c90cc889f77eb589
SHA1 7dfbe456b7fb137c91e796d4fc379b22da4c643c
SHA512 5993e0c65828f9e1b39a3db149a677d3695411b8df2e47805d6fb89d6ea516283133713a06f31ccae841e920352e8d473ac669d358210cb9825be3de77105dbf
SSDEEP 12288:Iu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Iuyxknw4FYnshx8OfVe247
TLSH
T1AF65237CBBDEE5E2E50D10734B7173666609B5A5EA71811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 9816f657ac65044be23736d9c32ec0f0c25157ec9833c813d1e35221f8d2a2f1
MD5 731eb103d1c003852c0e90ca3e6aeca1
SHA1 9624cea8ad326733dc30ee1ebc8bba70ab4ac625
SHA512 596893ef958b14c6a02221b924676560d20558340cc24c66009453dc4db6b23a192d95bab358595efc6541584292432a8ea5fb9c1c05164cd440b7d737b5d249
SSDEEP 12288:yY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:yYyxknw4FYnshx8OfVe247
TLSH
T15465237CBBDEE4E2F54D10734A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 c2fa62891c7789bd0f4562f9dfb6016d85648b0fdb6d00f8e2a64ff8b45d09d6
MD5 5bd23786191745cdda73973200cb9465
SHA1 3e61dc54d7d179674138ce6dc8dd4e5e0b5a69bb
SHA512 2a5cdf4c45bc53c19f3c762bb38e597fb038fc753ce2d6b873ebd07fa5c7b25bb5d60f23e1961544ba46634615dda529f8450d24e7c09843dda0f252bd310198
SSDEEP 12288:6VX+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:uyxknw4FYnshx8OfVe247
TLSH
T1E065237C7BEE90D1E45A51738A716222B365B8E4E731835FCB24750EEDB0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 d60e6ac4ade47a0508c44ba0e5dbf2aea80240e611dbc9f6a3525942f03f9c26
MD5 d8bec92828668d8ff815b4194eff7019
SHA1 4253e4add8c6ab39b306445d477d4c82ca1b0078
SHA512 39652699eb784afd4db2cd60015f0a6cccc382c67df43379618347517c262a6bcd8f205e1f7e391d8b4d5149740ec5c6db56e1fe9d510c802e517dd319d23f60
SSDEEP 12288:6/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6/yxknw4FYnshx8OfVe247
TLSH
T1D365237CBBDEE5E2E50D10734A7133667609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 0f87871a18db0eafb25691c24459dbfa29caecd98928d5575e15d629928dbc6b
MD5 e129122e54e09cabb9c2a9eb2d1ffaa1
SHA1 012d41e795f33bb77dacf0c69f6148e9296f5de9
SHA512 072cb2433161f7069e97121f7bd9159145f29c4a4f77c063ccca6e7f16c503869c7f21f91af74becbf7a79d6f9b45d8dae9b9598902692e175f9583b7cc1c46c
SSDEEP 12288:lK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lKyxknw4FYnshx8OfVe247
TLSH
T12B65237CBBDEE5E2E50D10734A7173667609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 bbf5022462ee0f1138043c684a222595a3d4743e1c3c905333060cfa7b252a5d
MD5 659c1da3d86c246ddc417f9df4f45d93
SHA1 a57a42f21b4c5e62ce1172dbf508beb85a6b2099
SHA512 ba7a6faf38c61b643fcf06f32bb4a0b94fde16abb000afef4d7895816b34fbd5d6c33aa592daf59a504b3db51d1b904c03afb3215966041f6dffadd4cf934cae
SSDEEP 12288:E2+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:E2yxknw4FYnshx8OfVe247
TLSH
T12B65237CBBDAD5E2F50D10730B7173666609B5A5EAB1811BCB7DB00EF1B0C64A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 4fd9b05114dd9e21e277342f7c4ae212850c939951bf533153843e9f331d327b
MD5 8912ec42adaf6a0a0c50a87245b67d88
SHA1 7e3b60515c40d97bb85da845f01e679c8c229d71
SHA512 784f308f627a31924b3d7e0677cbf8948906346697c8017e33398861c0c105fc19d917ca28de9298ba1581e4e66a01c67e2c558f80027ee33b5dfbf806ee5a1d
SSDEEP 12288:LiZwbyzzFEoS2cPvyO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2ZMqzFVSOOyxknw4FYnshx8OfVe247
TLSH
T1797501A8B39018F4EC67413ECD259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 80df643f891facee3fc743709e7dc512ebe5bf419cd136db9bfd91f4bab8524b
MD5 92c97fe7d4a1829e2a1783a15097dcd0
SHA1 3787e3be3017950f9f7269aecfcc1e9c1980c132
SHA512 46a2b0dea0376adb74f5329ff63974b10acd23311b4443ecfcc0515a5c99e8ea3c8f0a7f3594fdbe522689a875adebf1efd8db8ae86b74391804b0ab5bddeee5
SSDEEP 12288:eR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:eRyxknw4FYnshx8OfVe247
TLSH
T17C65237CBBDAE4E2F50D10734B7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 ed4f253c62b91820be8df1913f815b38fd858e81c355ebeb52b53bc91f4338fa
MD5 6d0f96d057bacb7d0fa0550305f61d81
SHA1 0d06f3ee8ee7ff51b0a28dfbc9f5d387f3682779
SHA512 7bbdbddc22619d6ba1bcf662b9a6b997abafebba1c259e7ab8565bab8ec9d6cbc224671d376fd3d380db1d75a547fa397de3792eca28b72771f6b970abb5321b
SSDEEP 12288:1V+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1Vyxknw4FYnshx8OfVe247
TLSH
T1A065237CBBDAE5E2E50D10730B7133666609B5A5EAB1811BCB7DB00EF0B0C54A06E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 d375ba77fcf61e525f4050f3a77d8f99707946079b1acf91c34b9836125436bf
MD5 9a03addcaa286ccc42207a2cc0dd9e43
SHA1 a3c21c393422c0e28f1fb1ce50d942ce9428ed8b
SHA512 3c6826e4cb76eae1c84616b528c8d1a8b7f195c3a5db5abfc5d00b37ef9b2b47e8d789ebe1faedfb3a3cee985f55c5dcfca11785e7e6b6d5552172cee4161174
SSDEEP 12288:NyPz5L8C+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:kzyCyxknw4FYnshx8OfVe247
TLSH
T10475121B73E530F5E13A423689621612F772B8724B3086AF47A4537E6E325E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 5ddfe3aac504af1468d7d70f612e80df38880c63805897c792ad4ac3231d70e6
MD5 844e2b452c63bc149def4a84757628d0
SHA1 17646ea86efc722536b7373aaa078e10d95d7319
SHA512 464178b60f52e167ad1ab982c30b377347a007f4494e91a3f927c8b038a3ffbd641504540fd39ce3058f53d15a17e29960030d322523e2d7dc4dd3e9bdaaa096
SSDEEP 12288:hR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hRyxknw4FYnshx8OfVe247
TLSH
T1DC65237CBBDAE4E2F50D10734B7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 ae1ef189a2b62c31f23542061f86e96f937dd633056a722a13d44bc2e9016460
MD5 63ad92cb91a64c6ffeb22cb56ea15fe2
SHA1 4fd7409c4db90da46d8c84ea2d7874bcd0a3f14d
SHA512 70d87e83f916075bd3c3a295824a51575a4b345adbe858926c608fbec7ded08537c0a18e691a5605cb48b5c742d01b3e409399a2d03a204c104b2eec4d61a5f1
SSDEEP 12288:gR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:gRyxknw4FYnshx8OfVe247
TLSH
T1E565237CBBDAE4E2F50D10730B7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 1fca545e3c40c15c3e48ebd5a426701220c67f9f03ec37aa6698b05ce0cdd8b9
MD5 eb87286aa0b4ef4e9a5bc5744aaf9160
SHA1 2c40442fb09f04ed5562abfe6e3bbf5beca2d123
SHA512 d71937c807150e8c86526b1edf5619fb9d3b7b6130cbb49ea5dc9b742315e2f6046b21764463af2a8f7f86817c2fd9bbf1af8784f79794514bbf35e6b2a59a09
SSDEEP 12288:cyPz5L8C+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:FzyCyxknw4FYnshx8OfVe247
TLSH
T13675121B73E530F5E13A523689621612F372B8724B3086AF47A4537E6E325E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 260672e47b55f9d3510063a4cac30caba9def28683617fc53b77a79192cf2e8d
MD5 8189d7092026210db64c43a3a6a3a171
SHA1 ad54781f4b0714565540c98212d97ccd011b3fa9
SHA512 7596a5c4d4715b965f0667cd5b5ae48a393a12404462795aad3f293a56419562f309e5863bf04bea47efde514670ac522f30a3ac8d7ba197be6f548daca8eeb3
SSDEEP 24576:KTPaLl3z0zDIyxknw4FYnshx8OfVe247:KTSLljmx4x8EVep
TLSH
T1877501A8B39058F4EC67413BCD659516D2B27C6A4770C21F43B8362B9F336A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 7c431f045a8e2d6d1456470bc0642eccbac1b3848e17d68abeaf4062c09ae2cc
MD5 4ddbecc12ac96886758ee98272db9734
SHA1 9c76459069dac1043543caa79d2df2271d9426f4
SHA512 9814d3ef5a4f83901f896e161e5ff69b6c60e8e2a44454a89284936f347649c1e87d492aec3b73ae0c86685c67d8ac2eebe521b81fb5229b1bed34d5563db1bc
SSDEEP 24576:A30d9CHKy7GZkyxknw4FYnshx8OfVe247:K0d9CHKya1x4x8EVep
TLSH
T16B95DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 275c7b7ac6472f91f7ba1261028a06b76486e658cd01f605a10cb9da62731203
MD5 85d5081bb9c205a4b295a84c16ceb06a
SHA1 d49fc623a1b81a2977bd862b56956f7e35159b38
SHA512 0fff30768258bfa9c31601df44d437d2174ef033c842dbb93500162f08513d89fcebd3a692c9ab996511c1380b5fbe8c3b4da1116ea72f68fe9847fad79b4db2
SSDEEP 12288:K4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:K4yxknw4FYnshx8OfVe247
TLSH
T1C865237CBBDEE4E2F50D10734A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 1fcad1f0b29b07d40b58befb8d1f6b2c158a0320b4dce8b3b8070a0cb19051db
MD5 d8b20385bd9292bf302c0cf97fbb0254
SHA1 07f1fdad2016f48fe348ab000939270e39217dc9
SHA512 767d4b83b0ca9900e3fa02f4bc7b3a1f0d763389b0af6f8577c5bc6bcddd373f5ff8c9fa97c57db065f1597b037ec6bf9c2d2e07209214b66a12f7737be713c5
SSDEEP 12288:2i+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2iyxknw4FYnshx8OfVe247
TLSH
T13365237CBBDAE4E2F50D10730A7173667609B5A5EAB1811BCB7DB00EF5B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 8e3939225570e9cc22bc2a844339c6cb3281a0b796d590e9a37f29327b5e6bef
MD5 dfdd37dab06779a7f633b0e1dd481f5d
SHA1 98cd9fdd5fc5019655bfe739bcfd1b1026617903
SHA512 4bff8cec8ad0bea0f77bee3264d672c6c432c9b38b22aa135c1247ed0d57851a6fd3459950e3cacfd2000f431809d92eca1347085fc36e4c5510d2b22500c64c
SSDEEP 12288:mL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:mLyxknw4FYnshx8OfVe247
TLSH
T1B265237CBBDEE4E2E50D10734B7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 ce1d4487780db6517885ac496244808ecbc7626fc88920a1b24d2f689b7278f9
MD5 b7c6a5382881b5b48fb9153cd34ee8c8
SHA1 9a266b185481d49a139fd5367c87daa7d3539065
SHA512 683c965553eaff4b7468812bbca4ad5bd925fae016a63f8c58eb4a09546295b326f6a2c2e2a484b1a53cf1eacd8b5895f9bafcd572d69abfe8dc0b98073748d7
SSDEEP 12288:PR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:PRyxknw4FYnshx8OfVe247
TLSH
T17C65237CBBDAE4E2F50D10734B7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 34ee0da1a324c12e4a633e38cd4ed2cade6e94c25cf859aae218cf9ba6992504
MD5 e249c40951c471cd464bb79823b0f359
SHA1 83b1ef22028ca9eb6b2ef88364f91b514ab9616d
SHA512 8ab12b688b0094b6a7537d9ffef7e251a23a2317f0d7cad8b8847634fd9190eca317ecba92ac887e1f0f0f574b3b4d85454d98227ca3ce58abf7fbb8217a2a3b
SSDEEP 12288:14+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:14yxknw4FYnshx8OfVe247
TLSH
T11C65237CBBDEE4E2E50D10734A7133667609B5A5EAB1811BCB7DB00EF4B0C54A06E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 596f2f956038e05d2bb5c7242a1f9feefa2f5a5218c4c81f96d4e7c5ad61de79
MD5 0a384ca6bc875240c602aae631dfb9b8
SHA1 4e4bc92b2aa36e690285d7927ea921d040edc531
SHA512 861da22990112c06dfc30f7771c3af1007f9ee2cc4a08036edb4fc4be96f56f1baa0b8ec11fad151566842266625394d32659e7a7ddd63182bd3a758628bac20
SSDEEP 12288:DZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:DZyxknw4FYnshx8OfVe247
TLSH
T13265237CBBDED5E2E50D10734B7133626609B5A5EAB2811BCB7DB10EF5B0C54A02E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 d818de176b145402937c1f0bf81f549624a67f5b0c1c7e736075acc10bf06350
MD5 afb2a02daf313102d1a64e424f88b8dc
SHA1 f5028f9617688bc08c49fa71ee9d871bdbb7a01e
SHA512 45d7c88637d16bd9c308e16b75032381b7e29c90f1acff7772237d50a8f71d74324305b446e4d191a49bc6757cec1bb80cbc2c7bfdba8a13eb7b36aebb701922
SSDEEP 12288:n/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:n/yxknw4FYnshx8OfVe247
TLSH
T1F665237CBBDEE5E2E50D10734A7133667609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 8f3719068e5543149fa9ce733ab3b4e0c497776e7e02f64fe6fe2faff122b384
MD5 769b2fc20af9648060143767821dc77f
SHA1 50f6067121c3d367f54e29af69e0ae6e788c9880
SHA512 8d0c424a63282136916c5a61538d0335defeddc16477f8715e8cf428e4e679b1fe14ec5a777d521ce2728a017b8165bd2194ee308476e90d8c869c2a41b0147d
SSDEEP 24576:ofwvgk9RX6wkyAIlyxknw4FYnshx8OfVe247:IMnYIwx4x8EVep
TLSH
T1B095CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 47c9d20f80cd31fcaa9654808a3f749822a34fd65e847d2901a6a678814bcfe9
MD5 f654d75e8f3acf8eff8c60bc43e51253
SHA1 566e21e1e33b81da4cb4571006e343896dd37450
SHA512 173bcf1647d5ab206d415a9966f25a1f2e4cbc700fa9be4bcb9edd1ea6f34ffd4da349cdaf2ad68d3f318bbfc28a6f76f92d90c3e396d759698b87da4a8a62a7
SSDEEP 49152:XYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Hx4x8EVep:6ySzP/ix8EVy
TLSH
T1FB066C96A1A841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5aac3e464cda4062173efca44bb0dd77e3e7fea8fb20423a237e8dbfe64dbfad
MD5 a632a105c3803c6957714a205116548c
SHA1 5c064a0701f9165e94fb87d893917f86edbb9df8
SHA512 5a4597e93ab08cbcbb31dacb52feaf74dce671f98b16daff99da48e3b733d86da05d82e61314f2689054df09d83394952343e386855d9208cfe5eab323eda023
SSDEEP 24576:n47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYeyxknw4FYnshx8OfVe247:n47JUQjqirIhCnDHUPfF/Xx4x8EVep
TLSH
T1BE65AE1DA3EC01E5E1BA927885154A1AEA71742E5F31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 39c29b5f5e975e47056e56e59bdb68d839cac74bee25460dfc73ca8b6c29df3f
MD5 c61a870989129f065be3e41f78d3deac
SHA1 d6a2f2d2b537e97339b07b74756cee74120a941e
SHA512 f827d055731727e9c8eb68e89d6f82a82fa11f2f3ee67e8dc2c73511399324d66e8928e0927810798bfad2ff7e651fd1b94a259f253275e479d4caa9ab3f767b
SSDEEP 12288:K0sfB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:oByxknw4FYnshx8OfVe247
TLSH
T18D750128E29852E4D06E2176CB625641B3237C6597F1D3CB87E0F53E1F71990ADEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 3bf133a304ab284493477059f715c00a81eda6b98a5e2e4ccb78f62901e4ad06
MD5 0ed5f7d1aab3959d8b446e1af3234606
SHA1 7e215a1ba3300c1524239433826684ef0a6d1129
SHA512 e2799254cb8594ba9e2e7f8a4f3ff187dcdfa6aad69d9ac7faffa342fbec05b749969582a52a38caf8ccf29ebcd40ec412bfe30ed84c2310c950d87956f48038
SSDEEP 6144:JsBC2na2IK+zrERJfKDexHG4Ky5Bkv+kf9xxC+DsEICXX/GWkCTggKsmnbumZVys:ejvuxy5Lk9vFn/WCTgg8nbTZVnpn
TLSH
T1BF350711762BC75FC6A940325E33D1CCAB707D45EE45AB0372C8873FD576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 374KB
SHA256 f2ac9b020aa6b370e1e269c47309bd862e97cf93952d988bf0412fa7b2b36975
MD5 9a73c3995e660346d56a5ca4561e5801
SHA1 b01e05bb7302590cea4bdf20ba4ae017c8186407
SHA512 0d37cb31ba77ad7c7d6e29fe102a2bd4559b4b7671250bb7f3b904b24ba4f2f717374e77e65cb86cb9ac8d34835bff18bb87ad5f2ed2e9856e6f2ab718df1f7e
SSDEEP 1536:eBI+egBsZa7yxch1Bo0axoFYisVHnANt7Rf:kj
TLSH
T1AC84E811B728B32EC4B680779870A59BDB3DB5138F1256013BD81CE1CCF629B76B6B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 b44742ac8a1b7b344b6a8c8715aebfb7dea4925f4d58ab8561666c2bf2494320
MD5 7eb4e9205e4aa2ee46d9efab07878c9e
SHA1 5182991680df6564e52dfc9dceaf28bab13ff180
SHA512 2c39f1fe07c0be81c69fc104c65dbf52a6c7769f215a2a9457c85c6039db8bce1ccd1e5d2a3ca6fc02e199a185160aff874ecf65826a1620046431b589e86f9c
SSDEEP 12288:XR7J+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5Jyxknw4FYnshx8OfVe247
TLSH
T17D65237CA7DEE892F46D11730A766231360AB5B49F70C19BDB28B14EE4B0CD0987DA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fddbd38a35cb97da5f3ae3ce0f8a7ca9b69b3a703bacaccd8a8d62dae0311598
MD5 d387860b98d448cb4d59a931410e84c5
SHA1 1be2d4282b0f2d97d1d7de169780765814f79e37
SHA512 e825fcd022ac731d82cba6b8d8bfb4f03717c600773f9f693e00a57bd529f70b44d5d965f2c461096856da2f462bda56e53173b2e09ffb0876fe4b8322793e55
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bYjyxknw4FYnshx8OfVe247:vgb4mBIBhGFRx4x8EVep
TLSH
T19665AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 82e0f9142ec881c7bd150c94313f2a197c7af298e5f5a61783f1cac02b80eb4c
MD5 5c316786addb67ac3d6732545d58135e
SHA1 b15af68b6ced53c777e5ac5a65cc56498396c7d9
SHA512 90ed0397140b73eea4c7bfbc5bfc6d7be9acdd799ab6965e9ca9c6abe2f5dc179cfae8f447abea1fcb2038715bb035ea9ff31ec4c50a5f057f27a0808d86fb55
SSDEEP 24576:xG88u8FpJqH1Izria7/mOyxknw4FYnshx8OfVe247:U7ZFPqV3a7/Ox4x8EVep
TLSH
T10E95F16577E101F0D47BD1388A924663F6B2B4250374EBDF07AC8A561F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 77bb05dc39c3b97ea7ae2edad2a05a12ba0d003ec2eed877f8473466b4cfd039
MD5 90efbc87507b6e518a30d85dd04adb3e
SHA1 ac7adb5be156f734c549e74a66c1aa85d7453e62
SHA512 b2339d62df980ad8b98ad39d9a5a6f989c56b280d763e5e2eaabe054895dd0d1f2591ee54d93956ee3930aabb6e55b55b68810e7bb2f932e53a7aa13b99e34b3
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjlx4x8EVep:dG05lO43b4ix8EVy
TLSH
T1C5D5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4f67828052685871235c9d087ba612c7c1b9f5101bff29c69b07c109ccd4d790
MD5 303ff68404a5bd0e5daa5e21c55b84e6
SHA1 b02dc87393c019a45f4dcd6831d56003abe7e615
SHA512 8d0399ee9028ccd689c7f87c5dcb96f8cbd8315501ee3671e3ce6652d32bd36eee0ceb1f836283d16f05c585a6fc6d7231b57b9aab9d1bae220ac1e7641169c6
SSDEEP 24576:qfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnsyxknw4FYnshx8OfVe247:ia5POZ3lJt2pasx2+mdx4x8EVep
TLSH
T1AF65AF5DA6FC01D5E5B9D17DC583461AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 40cdb653ae2c866fbc825980a84c5c4c6e80353d801d94d04d4662351faed8a8
MD5 313a6ac2e40cc652409b2f7a8569bbdd
SHA1 4dcfa5fb57510f69bf09b0b6b7f1889aee76a342
SHA512 fe261dff2ecb1ee764d1d5b79adbe407e551fbc5065d3919eab888a0a1f6021abc1ceeca32c783de1236ee783679894de612e8fcbb44db90b1cea40420d91803
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7Fkmyxknw4FYnshx8OfVe247:lNc/zEOVHFux4x8EVep
TLSH
T139857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5fc92cbc72fba47e07c3c6a8139ea2c1f04e1d440651512e0a82a3868d02f42a
MD5 fe2ada969d0a31907da150ba611e7dbf
SHA1 6a2344ff70cdcd83f5187d28cfa9a86e44c3c6b9
SHA512 b2a86e9972017946193cdee54cca84ebaa699ed7f74aa6e3c9fdb3674aecc21b84baff51cbfe7ea5a080b13e0916ae3284c113d57710bbab821c895c5ad1d305
SSDEEP 24576:gzkNvNnaFeYhJNtmZBmwyxknw4FYnshx8OfVe247:gzMwBtOmzx4x8EVep
TLSH
T1CF55AF6EBAF846E4D1FEC6B58D238112E6727461073293CB8390C13E5E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 fc6c98e43040ffe6ded086411d0927ac9a50fc0ed6b3c2ff739e6c15e1f88f9a
MD5 d03a4dbc1c304562a9bbcb6d21aabdb1
SHA1 5e8d552f30fa08869b82436d39d9c99364a6056c
SHA512 0aff8d77a6eb121cad572be6c1a37f04e690a48baa341c769aedd0fe3051ed7c5eb17b4c3adf9d4bfbdcde571d22fd4ff8fe5b7d74ea7a7bd39482c04a007aa9
SSDEEP 12288:2HvUrBFrEjwaQa+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2PUr+NQayxknw4FYnshx8OfVe247
TLSH
T1A875F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 b00168f8da2985331f0ee71205a29d8939586950ef1aa1460b74e4cecf61afcc
MD5 f6ffc156d464753703d2b8669c25fa01
SHA1 640706b4abd4c6e493d0259fde4c7572496c7aba
SHA512 863381034ec33b96156dd63f1f20dd97f457f61c7992cccb5977d3bb28418b800e7bfafec2447d350c414b0f3576e566076503603a64daa8a2ec2ed3a44a7a1b
SSDEEP 24576:wD3FHshBIYQgAdyxknw4FYnshx8OfVe247:wDVHeBIAAIx4x8EVep
TLSH
T1E185E17DEB9C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1100-345-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1100-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1100-95-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1100-343-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1100-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1100-89-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1752-313-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1752-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1752-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1752-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1752-107-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1844-78-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/1844-84-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/1844-309-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/1844-83-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2764-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2764-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2764-127-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2764-135-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2764-133-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2988-47-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2988-50-0x0000000001780000-0x00000000017E0000-memory.dmp

Download

memory/2988-52-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2988-39-0x0000000001780000-0x00000000017E0000-memory.dmp

Download

memory/2988-45-0x0000000001780000-0x00000000017E0000-memory.dmp

Download

memory/3196-304-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/3196-67-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3196-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3196-65-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/3780-0-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/3780-7-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/3780-77-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/3780-6-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/3780-8-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/3940-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3940-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3940-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3940-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4284-113-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4284-312-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4284-121-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4284-115-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4728-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4728-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4728-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4728-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4728-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4740-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4740-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4740-54-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4740-279-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/5704-23-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5704-15-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5704-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5704-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download