ce1ea25181ada082a02e10a2ca1b09151b7c86bf5595253b8f2a852d709ef816

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.9MB
Sample260910-fx9ljs1wev
SHA256 ce1ea25181ada082a02e10a2ca1b09151b7c86bf5595253b8f2a852d709ef816
MD5 63c5d387b9f954eb60dd155d94f3e75b
SHA1 4e498e364ebe4055810296a46be9f20be926c7c9
SHA512 1846d59335b91cb19ec5ae67571458dcf93d646eb85e1fea5cb3e16c1d9eb1c1cd43710d00f8ba205fe27ffbf477e013c16f178aef683336ce7e7bacc216644d
SSDEEP 49152:S+AeQDh2Y6yr1fKjffYUAkiiQ72H8s+GpHs8ix4x8EVep:RFUKjffYUAkiiQ72csPaix8EVy
TLSH
T11395BF1663A801F8D1ABD178C546560BE7B2B445133197CF07B88BAA2F63BE25F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
3276	elevation_service.exe
5604	maintenanceservice.exe
1752	OSE.EXE
3744	PerceptionSimulationService.exe
1924	perfhost.exe
3988	ReFsDedupSvc.exe
2904	SensorDataService.exe
4228	ssh-agent.exe
4648	AgentService.exe
4584	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fb6e7b8de62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b116f68ee340dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003c7eb92e340dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093f0c190e340dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000079ecc590e340dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae81f3d1e340dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000974ad78ee340dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	4648	AgentService.exe
Token: SeBackupPrivilege	3988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3988	ReFsDedupSvc.exe
Token: 33	4584	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4584	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4584	SearchIndexer.exe
Token: SeDebugPrivilege	2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2108	2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3276	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 1748	4584	SearchIndexer.exe	99
PID 4584 wrote to memory of 1556	4584	SearchIndexer.exe	100
PID 4584 wrote to memory of 5932	4584	SearchIndexer.exe	101
PID 4584 wrote to memory of 2760	4584	SearchIndexer.exe	102
PID 4584 wrote to memory of 5300	4584	SearchIndexer.exe	104
PID 4584 wrote to memory of 4108	4584	SearchIndexer.exe	105
PID 4584 wrote to memory of 1380	4584	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3276

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5604

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1752

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3744

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1924

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3988

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2904

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4228

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1748
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2760
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5300
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 886a64dcad81ebdaf850074aa7bba54282b56970b9e6bce8d56d472af76b5cd9
MD5 b4ccb6716f33d540b0ecc00bdde0c07c
SHA1 28415cf5bfc4d0cd8c73aeea0072ded03317cd2f
SHA512 dbce909c69a15aa07f5799f2ef8b20b6c5dd1f0a1b4496e708444624ed1684743bd9666808b1c39f1b7825bd654c3e52b04e3d04049a8be7434b188f528bdc72
SSDEEP 49152:Cb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnAx4x8EVep:k3q6mjBLix8EVy
TLSH
T109D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 bd263d280c311c580636b31ea602c0fb1c3808607cd09a9305a600336be3babd
MD5 c906b2a3319b65f10c48b09fb37b795d
SHA1 5a2b9d91f176bdd3fc276e44d66fbb9092d14108
SHA512 3b03c8c533fd7bf40c6d25dc71695c624876b4dab3d07b456c55bf8cf577f58d0300c548fdf86e8b8fd4bfe832749ddceea6881bab0cc759a8dac19cc41eec34
SSDEEP 12288:e1XLsswWkxy2lRq2czA8+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:sXYfDtczA8yxknw4FYnshx8OfVe247
TLSH
T10275F12877E548F9EC6B8139CDB28112E633B8554770E38B03E4952A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 9673b96024e23132de1505dc0c0a8e9e4c2fc8a3b8c97c96e8c26465564edbad
MD5 fb1e899fd21146b1bed389193b579c06
SHA1 f86dfd64df59c0ed0e8ef707d20310977203a6ac
SHA512 4cad7209bbda693330229b6418139a25af87fc52ca21b62906c9fa9c2bae4a52cce8399d344e5170fe00356f572c424bdf392da28e14e02f1c12acd3139d4ed3
SSDEEP 24576:20Le5ji0hmxSrM9yxknw4FYnshx8OfVe247:2Pji0AoBx4x8EVep
TLSH
T1B795AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 50a38388d876e98d77738045e37444aee6e90b7b63933962857feeb9ee24275e
MD5 e813fe68032891aa97fd8c55e394d0eb
SHA1 929b4e38b14c05133151817d18df7f49d567eec7
SHA512 b1a590b641933872f02b44568bc38d9042d97c0213fd3a8b96a423dc744b01dd3f9426e82b08cb8ad68cdaf490a1dbef70a2e3b1636ac2af239756901cc05c1d
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWj6q8wyu7yxknw4FYnshx8OfVe247t:Q/ezSC6vUzPv+Hjytx4x8EVept
TLSH
T14B756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 753cc6fd225c690a0dbce31950d172e5feda98aa6f845989e1f23d154fb89267
MD5 5163fc55ba04c3fd34de542e17b8d94d
SHA1 48631904bb3d55d97c3ac7d327de22b457e53855
SHA512 b5890f8dd5c19ffc4e44e00c79c0871f47d88b05b3dc02292f94fae1e245806e69fdf602cd88c35f0c43c86ce60a1a4735d340c48942fe463ff8ba5ca15172ad
SSDEEP 24576:mVbqPb88hv/l+B4yxknw4FYnshx8OfVe247:mVO88hXl+hx4x8EVep
TLSH
T1F3559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 ed4b5698e39a09b4c596b2bc8667cde59bfe07d4d70610364723cca8bf5ca774
MD5 2ee65a5abf15420759f0ab16f22c3160
SHA1 2958c2d9edf2472e995ef577ee32d2f977bfeb8c
SHA512 7ff04106e9c2a20c084b7ad53a08564037d2868b30e400e26912fb4572d522d67fb0752af6c455d9e44d3862c86b263381356175686f517d59b261f3bcbd2a47
SSDEEP 12288:VaJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:VaJyxknw4FYnshx8OfVe247
TLSH
T11565237CABDDE4E1F69E14331A7172623605BDA0DAB4C11BCB78B54EE4B0C50E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 0c48ca321ce77f226ee203cb539a7363c40769db50c9e72f8f5f02f23e427bcb
MD5 2aca12b46a0aa9caaa6d05eb6b8813e4
SHA1 288681cb9bacdc25e0a50e847ea178c9779d5d39
SHA512 05ebc019de9ac3d5cf2493dd7d8bf1e82bd143665b2afacdff98770e8b19b351725e25bb02f87dcefaf83ebdb00d480d51e679ded6fb14eae32b36614a4f0a4c
SSDEEP 12288:CeBNUbTVO86Ug+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:CJIUgyxknw4FYnshx8OfVe247
TLSH
T18A75CF7BEE28FCE2C27E5DB95B918200A77274704B6193CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0f8ba32fb155006cb26afc637afb14d84614b35391ddc2a7be4c3809b609c2db
MD5 fadd3779605dd5b60dd6da535a5e6741
SHA1 012f77fc1b7cf954bcbd2cd195dad26054a814b5
SHA512 0e3efd041bbe5d5fedbae3344bfa6e37bbc6bed0f0fd028e7707679d2f9570e58eff6f9dd3561e97e6d67d20ad2154cf6a4c4ceff3f0a944c69934727d982f87
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THb:zQvGAdlCEL8c/WRNw5Cuix8EVy
TLSH
T124267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 c73a16998fa0f184a35318f792f492e3b15662f392d960c0c4060286ed15956f
MD5 e18e5c7cc909fd626070c8ac7777d396
SHA1 e49647cf20efd37d721bfb4af06d88b387f988c1
SHA512 79b63e3ef3d0926946e267e6e8a63daa6ce8b0c2320f1a34e7e0dd347562fe397aa058c4294794ee19e22a4a4d628e6892192a2e2875127098c68aeb7f79d7d9
SSDEEP 12288:+AwSfxL/2Dc3zDLLmt0LDQewsAje+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:j+ewsAjeyxknw4FYnshx8OfVe247
TLSH
T1B385E030FE75E032C27F0DB21B36D716142DB9604B611AC3E3E89E9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 99296d56d3dac92f8e40b7ac6c14075b58f0700e872bf160894486391fa4ab61
MD5 badfe5b810314917ec097935051e9eab
SHA1 ebbf50895b21900838d8728938c55ebe6ab08552
SHA512 61d2ebf29414d80c7099130e664dc8b91b7d5d7b822fa35d5fc365255b7309e014e8117a4d6b80d5275e1dbe23b55d1a3d949a5e09b38341f6a1148b72f86e86
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH0:6UEtQevvqc2W1cpV20I32
TLSH
T1A7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 985537be68d153054997719a51110ea5496bba851bf95c777aab9b77872ba5b4
MD5 31d4acf378d4cee717c9572384359fe0
SHA1 e2c2965feda7e927d89de3cc6f2628bafdfc20c4
SHA512 ee1a774615fceb426f3e00509cbc0389b82d8b945db8417b4fc0b1ec205976a8ecaa99e4d247ec1d4f8059b6559649ebf2e6aa2a5b40ba9f4d8dd02b45819c33
SSDEEP 49152:bCbRquA/m2yL5zLfFiV+XenmE3/zxx4x8EVep:Eoq2Vjnmaix8EVy
TLSH
T101D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 27d16b7330dffe09f81761715b562c4a98918c536a2533aee4a8d977c71da3b6
MD5 d2058ccfad55abcefefe5b903cec83a2
SHA1 8da2a70a6bcbb055922182fbf8fcca82e1c4cffb
SHA512 e35fef572d2b000f3adbb1ae3a58e5950b4643a86e2cbc89fb2f4b2ab67dd911171e651eede93f17cdedcfc41c774aba2aedbf2f7105db2efb0797f1bedc552f
SSDEEP 24576:JAhGL6IFoiwtA5l7S53Pyxknw4FYnshx8OfVe247:JAM5Foiq5qx4x8EVep
TLSH
T1C335AD80EBF955D4F5B3AA7899B69171EA76BCA65E30C20F1260D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 ebf4c045c9c5317c4dc3323c10b7d61a7fbfc14d78a80ed3dc691b915859f5fb
MD5 caadfd51c550bd7f9d1e32ccf1ee39ea
SHA1 48b22041003dd0fe08c561b2f5129c016fa68cf7
SHA512 778e1d1e3b73481f767f90a409eeed69ddc6f317dcadc65cef3366baad450a2674d0842ca44c3f354701f9b9cd35184e1e6d0121987a6b7ede439abcdbafcf4d
SSDEEP 12288:Smw5HEjsChNrBFgl0WDm+Cb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:LwumOWSyxknw4FYnshx8OfVe247
TLSH
T1D075F14977E81CF9E9A741398657D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 a2e1e716579a04847b48c5b3a9506fb493db1299e1a4b7f93c45ec0f4dcb800e
MD5 aaf2895e8732813bf8fe7068aa026396
SHA1 49b42a56d8a93aa2df2c8a4cacdea44559c73b01
SHA512 54cd5a40989fb7397448c45a11441544c87fba56c0b2ab61acf854e33999752e9fcf1feb43a1167fc490b936477e9d5429ef26b8cebe063a58d90bd28f08f578
SSDEEP 12288:ivZ1Iyu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:WZuFyxknw4FYnshx8OfVe247
TLSH
T1586512AC37E870F1E1A7113A89F15206E76274A2677183CF4768625EAE71CD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 de68c0f7b1b0f778e33c7eda4d62b8e7966a0a92da310e98bebc5613d5377cfc
MD5 e6efe177c56966765841fbfccdc66f46
SHA1 0962bc0c7f660e945a09a13aaedfc5fedcfeead5
SHA512 391cb9387ce46d61b744417a70b49774f7fbfd9edf92d4887ebce6854a8d9cd51f0b998d60df335c239fd2cfbee86c916f5092a762aef6f46ba9fe0df0b0187f
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U/:iQRQyi36YOcPDLvw2gAf+PN3/ix8EVy
TLSH
T1C3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ae7cc7ca1f34988ed9e16f31e5ec81e5947b7dc5e78ea0fffad29eaf6d1f7562
MD5 d0d4119724dbf508996fad778eb644e3
SHA1 cbfec7bba0ad050807854d3430b37405b5085c14
SHA512 f2952c7101d910fa09ae2af015723c6063df531f2c0fb884fc6448f8a5efd7117ccc2e06f3b452f4d59f627eb49eb413c63c7f16a6c353f1817ecd617559a019
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U/:JQRQyi36YOcPDLvw2gAf+PN3/ix8EVy
TLSH
T100667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c6aa221e1781147b133b607ff10db50bccc93da9e6fb49a32f60bb2cb57466ed
MD5 297886e3f183b09841f5173ad3512ed6
SHA1 5cd2598ec9af95f4a37605a313a2a842c9c60588
SHA512 68c94e7b87b2594b89c134b8d460e213def270e1f6566598ce8be1cc2c7d4da226ebff4128758e13f8653b2f673ba082481f0bddd6c0765ec287e9787ade1b81
SSDEEP 24576:ywvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL01yxknw4FYnshx8Z:M68Qg55nhkeWu7PNU3/Bx4x8EVep
TLSH
T127B55A33B2F600A9C44DE1769F4A973196D17C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 95c9add0a702c3a55b5a3522e53ce403cf9b0258e9c4d1785a09449c67676261
MD5 ca4292321e7f1086cba471a2b6aba56d
SHA1 50ff05eb0752e87bcd0f6cc2bda6c8144e86da11
SHA512 6e11bd2fcbd74fc65cbcad4a79eaced94c91ead52d6265b274317494ca2da1e7e651044d963f4e301e92314f24f48f65bda50d1b9a01855ee0cd5abc39700bfb
SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99h:py5112gYy5azzVvU69nLKnhZMix8EVy
TLSH
T134167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8817f179ce8981e0f214837caa9c99c212dc548222b6da42d22a1fe395b6801a
MD5 88563f4abb6087b0ee664110a16dff2f
SHA1 3dfd6d0572fd6488adf1b56dca17c9d156f0567f
SHA512 569bd3696f5a480d412070f86ff180edd6ffadd861ebdbc6662307f0366ae0680ec3b6b48e4644a7a9f9668377b0e2a7d39f849ceceb770e4fb194c2a365ceeb
SSDEEP 49152:H1hpsNoJpF1A67U44CwH7R4xDx4x8EVep:HmifPqRaix8EVy
TLSH
T17BB5BE13F2D900E8D05DD17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0485c545993161ee63775ec54c30e6d5b30540372ee78fb2668499637323d1b0
MD5 dad530a4cd678cdfbd8cc758258e411c
SHA1 e7eb44533e059ced7b3f355e6c59c5750bd620be
SHA512 2c6fd21ece046aed8f0fd802b845d7c90608071d84e6371ec42cc6043930c13443fe8077304a253a0ae9c3f173bb59cf14c83af9f4af860162c2c54acc5c65a3
SSDEEP 49152:FSuZQIY0Be2KkRVtOnks6NMHqQx4x8EVep:L5dKqi61Qix8EVy
TLSH
T131C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d2c0f814c458acca0be410202a60245b450046bc46c892ab66f8e91b4bbaf76f
MD5 4a114851700fb2d86c52b37d92fc6e75
SHA1 7a35ce914c67b23da36019506ed77dddf036097d
SHA512 91bfd63856fb2cd44884ef11fc77ae771a0e70896daf248200578d288ea382d4fe91d5a331ad62a3bbdeccfe8b8b6ad53978b54933e06d2cee13d6c2cff43759
SSDEEP 49152:RhtSn8EApI0figjgiDn0AP5wXx4x8EVep:AX2iWphGix8EVy
TLSH
T10195BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 7e52339ed788df9a056f69ead3425aeba89e128876833494926a126e928aa788
MD5 7b367cc8dd63242205a6c354a5383168
SHA1 6b2e0fa7cf3bdd9082f8fbec57373ea178fb0e3e
SHA512 07b72306dfd9b36f132b6a490fca965d3461df05b14c003a01e3bf355f5595dbd15f312cd1e7b01dbf88ec6fc12e29f6f15cd9f3c2bdeef49dd5a9d472b76818
SSDEEP 12288:2x+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2xyxknw4FYnshx8OfVe247
TLSH
T16665237CBBDEE5E2E50D11734A7173666609B5A5EAB1811BC77CB00EF0B0C90A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 8c14a810a98dba79666a8c0a557e6d00393dd334bee283a52a7e7f64a018420a
MD5 2fa7f5cb6aecc0eaaa4cd93c354b6837
SHA1 3095462568b0ea573bccc7a74ab7123f0d50a7d2
SHA512 1f2af1926f3a361a5aedc0138a30f49b8c7f8154dfa020e0211587bb02a88373349ef2e5c754decaeff4c62b2d3e9127626838aea99567ce1263a3271a48af84
SSDEEP 12288:gq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:gqyxknw4FYnshx8OfVe247
TLSH
T18465237CBBDED5E2E50D10734A7173666609B5A5EB71811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 ffe4e2a814bb885f183f2fa535a7c3d2a1ff99a57cbe8a47c4f08ab5ca21ddf7
MD5 87225337c99e6ec4ab0fdef8895ea9bd
SHA1 3920ae14083484ae5a3230a725fc6c32a804fdfe
SHA512 46ee0a1ed993331cde5b91d00d63fc81169253fc06a735206c1cfc399a8332bf9416ed228b6342a4252a5f1b7d541420bb344e4d90ecf9cc9bd02b4c9b7e8215
SSDEEP 12288:7o+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7oyxknw4FYnshx8OfVe247
TLSH
T11A65237CBBDFE5E2E54D10730A7173666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 8034b2116fd8398e3aaff2b1f9064c875040f18d7a16cd28f3380ca7fdc0fdb9
MD5 4d712f4e1811bc6622dbffdc4bf65c3e
SHA1 72695a41cf178df9e845db0d989d483bd78af08c
SHA512 f574a548b56e626a86bad6dbef406c0a5fd3a463ac073e04d139b21bb66799cb1d1adb8c07f16fd431a7674ccb9359c89576aa09e87d92643048eb84fad63174
SSDEEP 12288:jVv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9yxknw4FYnshx8OfVe247
TLSH
T1A465237C7BEE90D1E45A51738A716222B365B8E4E731C25FCB24750EEDB0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 fe29922d8262deb9a94ecaae422bc3769c4269af0fbb87532829e8c0a57c5c7c
MD5 8076e3825f2241332a04bb2ab1a04803
SHA1 d17ee45264a0e30f7e48be485bb8dd349d1dfcb7
SHA512 5f5296605248dd1a6d48a359b621b8344407b0a020fbcc6a56648d3914c6219e87e97d5457e66af2049b409bd64c970c564775088d0552d47f8b42123b0c0633
SSDEEP 12288:RH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:RHyxknw4FYnshx8OfVe247
TLSH
T1A965237CBBDFE5E2E50D10730A7173666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 449c28965a499902c697ea134de3a25be025a563520feefc43ed396dfdb288de
MD5 dc86c019044532466ac4fbcea7cde244
SHA1 87f9c6b93777ce705a3213972e172fdece1549be
SHA512 6d11fa9a32a39dd4e27fac16385de1135234c3be247276fb58c470b42a90326dcd8e537b4153343d9b78226a07e9bbabb7fa91806c047f3646be67b4d11480bd
SSDEEP 12288:fG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fGyxknw4FYnshx8OfVe247
TLSH
T11365237CBBDEE5E2E50D10734A7173666609B5A5EBB1811BCB7DB00EF0B0C50A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 a16b8b86056685e5fc2fd45a336d234ea3639ffcb55ee3c269b27768256734c9
MD5 ae18a938071890f647cc8625bd0a3a11
SHA1 9b665d26efb242b3448ecb273d9cbb86ce6a1543
SHA512 615a7f09ac33c73b3810b037d9b26db1ee5b5393a8e16b10fccad71efe9a42fb6c3c6c9b49405196e946ebff8ecde8244b24d8fa4194448504643d25903b9e8d
SSDEEP 12288:lC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lCyxknw4FYnshx8OfVe247
TLSH
T1B065237CBBDBE5E2E50D10730B7173666609B5A5EAB5811BCB7DB00EF1B0C60A02D963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 760a1640625e1f6f67790754af15b087fbe1dcacbbd63d0acddceecb2f590229
MD5 fa0d68c6d760579b342ce583511e03d1
SHA1 91ad2a2e063c0e627e3be59796956b04ddcd5949
SHA512 77c5c9d42d5aaafaeb45e83ba735dd847b2a19741d185566d9435dc547fb337f6c22ce9487e6430bf699b800ea3f9f333a850cd07c9832a3e1506f11f33d586d
SSDEEP 12288:eiZwbyzzFEoS2cPvyK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BZMqzFVSOKyxknw4FYnshx8OfVe247
TLSH
T1497502A8B39018F4EC67413ECD659916D6B27C694B70C21F43B8362B5F736A01C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 81b2404ae64ba141bd6a672be65c3383e1054e8e5a2834f0d8fe9b291b7dcf42
MD5 a0d6d7e31126f2f49ba86b4b93b801a5
SHA1 fb37ec38b65899f961f1aa4bc3e8e722e57a6a10
SHA512 93322bf5cc77f9cee3f74901f619820a9f17e17b390fae84f0e9997b8a3f6e4d6b9e5c0d489dfebd4b9102efd1174411b84199d1169304bfdd14af27973174aa
SSDEEP 12288:cV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:cVyxknw4FYnshx8OfVe247
TLSH
T12265237CBBDEE4E2E50D10730B7173666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 a3922ecddc551e7776ca1dc504f03c125f375bc3186523a951d61a63565b6904
MD5 52ec99e55ec305763b073b5180ab126d
SHA1 26999d38946f570a6b278dec27b40166c775435c
SHA512 994cf85342f1f59115de327e3dc01a9c993556fee6831761bf3769b60bb06b2e09d32ff998b45e2f0eca21aba2940256dbabe4116622f2c6b5e3e631bd921dc9
SSDEEP 12288:lZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lZyxknw4FYnshx8OfVe247
TLSH
T19965237CBBDEE5E2E50D10730B7173666609B5A5EAB1811BCB7DB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 5434c3e4553e18e5ddd150121c767e937e0731b753f64b9beed78539222c19f7
MD5 3f1304182dc6b14b1af4f6281ed88d04
SHA1 c69d13ed8767e6f78495ef45756fb42b4a066497
SHA512 95875b770bbe6b76c79d6ac878a3b3ef37f6eba5cee98f69d69e25e7566bcaefd9b9981a8211f0780f6f8ba73ee727c16866b51d3d64609186012762fdd5d15d
SSDEEP 12288:/yPz5L8u+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:yzyuyxknw4FYnshx8OfVe247
TLSH
T1B675125B73E630F5E13A523689621602F772B872473086AF87A4537E6E325D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 dc54552f1aef605cfd33c96ef9b2788cd6e135ded18cdb5868ffb24c24d30069
MD5 2f426b5f8d36aa2484029c2ba3a4f8bb
SHA1 64877e49d0698e64397f8e753e07d7526d416046
SHA512 cb63e0eefd89aa8401bda041fd37d1445cc72cb3186c6d90214e93abf81d58435ca3dea062de9fd4651cfe9a291c37439795ff50d0f8cd4d929feddf4be9081c
SSDEEP 12288:tV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tVyxknw4FYnshx8OfVe247
TLSH
T12B65237CBBDAE4E2F54D10734B7173666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 6d2d3ea3b4705234459a90c28d006d51943ce95e8e52eb635af48e88246bb018
MD5 49be0bbd01960369569c4e587e913dc5
SHA1 9327bf34b088e64780f9bd8a09c40f135db609b6
SHA512 fe8cb93e6a7c12d4d4a6493cdcdf914d155ede24b455571ed6178a7d32684bce5bdab422be03f7b174ce5ea1e357c5d607ceb93778262f3325ae676f068722ec
SSDEEP 12288:BV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BVyxknw4FYnshx8OfVe247
TLSH
T17665237CBBDAE4E2E54D10730B7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 2e2c93cd51bd52f92eda685dc859d6c41f7ba4491720bc20848e06e6a1ce1c0f
MD5 c949a1fd34a0a49fc5482f3613883f29
SHA1 f4ce5e196bcb57527f87caa978e3608420a148e3
SHA512 8fa27df8412a2055e491c26df5eaa9e634af4d0c9e0616721b1fa21cb4092d9a7e2a4dc2ca2d41131a84c872af3b83be43078009da6db33bd43dbcc78b26d610
SSDEEP 12288:ZyPz5L8u+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Yzyuyxknw4FYnshx8OfVe247
TLSH
T18375125B73E630F5E13A523689A21602F772B872473086AF47A4537E6E325D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 a5bfae9e2482c8005c721c39e5c60b44db56315e06069ecfae6b68f5801dd8eb
MD5 d80fc61685669969a64c0bda04f99b01
SHA1 77c1ddf11e6fa4e74eaad4f12713c4a7424fffde
SHA512 0394d5ad42879948c6b383c6edc1a5a0ffb0037f7f37ade1a642e4dbd98cd5c3add1c6a72ad9f0e5a0fa568f65f9e5127dae21e47977e36753b93c0849bda2b6
SSDEEP 24576:6TPaLl3z0zDYyxknw4FYnshx8OfVe247:6TSLljex4x8EVep
TLSH
T1997501A8B39058F4EC67413FC9659516D2B27C6A4770C21F43B8362B9F336A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 a5e43e1652dff0a799bac73952f26be47d969eba452cf967ce569a16ff814ef1
MD5 9ea7a65c90c2afbb4fbd2d8a8a28dcda
SHA1 9fa45ff72964ec646f39be178bb5bac8caa9da65
SHA512 283b0bd53e2317440dd1da51ce275dcc9cbaebd5947c8d98255ccf8024440f3896faeee007381c93eae501518ce735aceaefdf9b9e76e0d6c6fb2ee03d603c14
SSDEEP 24576:P30d9CHKy7GZEyxknw4FYnshx8OfVe247:f0d9CHKyaJx4x8EVep
TLSH
T13195DF90F3E410E4F0B79A358D765512DA767C9A5B31CA8F03A8661A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 1f59770c94a146fb500765d860e42e8182af5391fc1f4d6f00faacd50f59b279
MD5 760c2b60611fa14368418b9566c3ab00
SHA1 f6849c60c21dd04c46c61cecba6012dba9bf6c04
SHA512 d11ff078eee051fa50c3cbbb7ffc1296af980099e40724f4861677e2a72c458396976c9a3c420218594a2ff464a3878484c322543e747119e95077fa1260a7a6
SSDEEP 12288:hI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hIyxknw4FYnshx8OfVe247
TLSH
T13F65237CBBDEE5E2E50D10734A7173667609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 822fcecefc6874da799ec0f26e018346d52ebbcd774af30859c5d647937bd660
MD5 d0537b98b7aa95af04f64501fbcc3b4a
SHA1 30b76191009baf24a53973fad06f655e1aa4e9cf
SHA512 a56e0e58b44698e6cbb85c23fa1f8a18a011edfe06063da8e94b1ccba1080d37f07ed3de248938dafecb006f030cabc5d4c217d172ee0a0dd29d377a96ba1f37
SSDEEP 12288:nO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nOyxknw4FYnshx8OfVe247
TLSH
T10065237CBBEAE5E2F50D10730A7173627609B5A5EAB1811BCB7DB00EF5B0C54A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 2777dde3c5618286e2b9e8d9269939295c9e679ce23aac63334a58c5da64a86e
MD5 4bdd163795bc35a17e17e1f1a5e0c079
SHA1 8367a8b788b9f2f2ea6101773d80602eb40670c2
SHA512 68e95ce025e4c54f43486c1f046a6c6dd9b0a34bae09bddf385443ec998f82726041f68d8dee702d5eac1a8648b660782bda60fd3efef4f48e07aa9e1402d616
SSDEEP 12288:rT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rTyxknw4FYnshx8OfVe247
TLSH
T1FF65237CBBDEE4E2E54D10730B7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 c4101b36fd8db5cd133cfcd8577b4a560cc5f28082b5397d5507a086e200c38d
MD5 e6d5062f42143653253d5d9a9114fd33
SHA1 e27d3719a7985a8d2c2f2ed6a2b73c6412847d4d
SHA512 437d8b43e81e952146b7eb8acee11dea98efe86d0c0f7054ac96b0c77f81ee64e51e52c08d332b6946e2e849e5e219d6c05f2821c286d167b058dce006ddab47
SSDEEP 12288:EV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:EVyxknw4FYnshx8OfVe247
TLSH
T1B265237CBBDAE4E2F50D10730B7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 775777c6caa517441c8c544e27ddf132b05cd49ddf7fbaf762a3af081882c127
MD5 dd6218bca41ada8450ce7650fb4f6e5e
SHA1 aa7ff5d5651dbe6d84f169e2158911bd019c47a4
SHA512 cbf3455b9ab88b3380d51a584e65191879ef73bbfbe6d7c392a2ceb3e0b66f09bcbeeeea1b35ab9525214e7599276656608cddbfef46eb282f9c4be322a823ea
SSDEEP 12288:vI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vIyxknw4FYnshx8OfVe247
TLSH
T12265237CBBDFE5E2E50D10730A7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 8258e69b431727b0ff5f26ff4ebd75ee3472551229eb9dba0ceda4c9b9103eab
MD5 8d5309c39de497f8d59c96b4bb5fa2b2
SHA1 11b9bee1e132ee0f4b4e75a43dcf7cd5159ae7d9
SHA512 f4ae39cc30dae74983eb640992e9fe3b8b1463f289a522f1effbab7317d8fd5c5a45383e8f837025263fbe51cf89488e6c486cf66a7bc3a4aebcca06fc97ec9c
SSDEEP 12288:5t+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5tyxknw4FYnshx8OfVe247
TLSH
T1B365237CBBDAD5E2E50C10734B7173626609B5A5EAB2811BCB7DB10EF1B0C54A02E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 dae817f6b4cf526d5d5168eff80e8927e77ec1acecda9674e35c63e90f08c7ed
MD5 35e2c7bbc37d7fda53f0f6ab79f14975
SHA1 57e1dca4d593488475e2337d62ce6f30a540aa22
SHA512 cf8abfed0c80d086fd01d1973a657a12eec0a6c3e85974574a9444ad88acb5ece5716487b2747b6eafb4eaf7c194620d9c12b28ebd9f51d0ac6340efe7027cc7
SSDEEP 12288:YH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:YHyxknw4FYnshx8OfVe247
TLSH
T15065237CBBDEE5E2E50C10730A7173667609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 4cc4f328daae02d553b475d3f5578f96fc559a2ceca36085f09c63f8fa709a61
MD5 caac376df068642c48224d43207ef7f3
SHA1 e70837fbd1481d542b949ea90cd2c121b504a350
SHA512 274165c203fedd27e89f764953111f2f71e2179d5eb104ba05bcd3e00765d1fb9c0e81376cf74eacf81899d1266e7aa08fff59aef507a02f033188aae7c7d6af
SSDEEP 12288:8w+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8wyxknw4FYnshx8OfVe247
TLSH
T17165237CBBDAE5E2E50D10734B7173626609B5A5EAB1811BCB7DB10EF1B0C54A02E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 83a042ab0710f252fa9776ff8326e6b8426b85e3adadd510a34946fffa9832d9
MD5 c01185915acec52c1ed58feb4c672fcb
SHA1 7340b7100032ae1118e590f150b3adf791182622
SHA512 46efd5c5c26722414b211cb30466c09e620559efe032117b842c91be223bc0ec3546184cee8910763755d2e3807824cbc8f2aef50de0f9b5d2f02e2ed35713ca
SSDEEP 24576:1fwvgk9RX6wkyAIpyxknw4FYnshx8OfVe247:XMnYIsx4x8EVep
TLSH
T11195CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9a7c71633d4c14033594ff64005443221930142985202e75bb724779cb721a36
MD5 bf3f87141a9003641c70a63ba5fd7781
SHA1 318cc3cc13910787714f75e890497a1513b40336
SHA512 389dee7b95a86cc75359d8f736eed729e8aefedde0d046acd434ffdd63c265be6fa6b670e92c2dbb4ec361fb2cd70a9dcc23918341aa937e8df5d243ef3e9d86
SSDEEP 49152:QYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03x4x8EVep:vySzPfix8EVy
TLSH
T1CE066C96A1A841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7f3686a09214384107a68f487891c9bc1fdca003ce21c9312412c493a9826970
MD5 6dd00b1df63427020d4b38b87afa7486
SHA1 335e263014242ac1f8f29df69b34c96ab5e09164
SHA512 114c0cc6e0a7f5559d91351b4ca617f87b6f499f946932bb424860633a74f5bce536344c38527dc7747d27ee7831fc926b7999c1e26a55fbadb4069b7b8ea7de
SSDEEP 24576:x47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYayxknw4FYnshx8OfVe247:x47JUQjqirIhCnDHUPfF/Hx4x8EVep
TLSH
T1F965AE1DA3EC01E5E1BA927885154A1AEA71742E5F31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 33f7386cf72cc7a112ff2579a2448478dc43b782c860809a42dd2369ce172edb
MD5 68965438be085561b22bac1f5d459bc1
SHA1 729a210c1fd732de0a23bace20e0ac35ad277792
SHA512 1083b677c1d11fdcfe14fb01e422f06de64e096b4a00f1fd94e1a68ea4279e5fbde07e256500aa8c9704ff07655808b47a53ab0660b115b1310c29ae6c37eac6
SSDEEP 12288:i0sfF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:gFyxknw4FYnshx8OfVe247
TLSH
T1E6750128E29852E4D06E2176CB625641B3237C6597F1C3CB97E0F53E1F71990ADEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 94b2171760bbb487b9017fcce3d4ea7450ec2c90816578c87dc20d44e4cd080c
MD5 6d58d6e961bbd1d76264a9a7b9613da5
SHA1 f7d0c58128890ccaa17992489aacc3dc32193278
SHA512 0ed337f22ccea6b75d2eb889f62d399de59180d959a903dc038f196ac60a06a9a7d7343aa2a2f5febf39cb9cc1ce7674bf4671b43434c40f3af76dccba8c7e43
SSDEEP 24576:qsRGUPi0CAW0xQgSahL97bKUhqW3uIIRpMkT2h:DGUK0CAFQgSahL9/qW3ZepME2
TLSH
T1B64517417626D78BC6A940321E76D6CCAB707D01FE05AF0773C9873F8476668BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 c7e8733b909e512237344c41b9e1f9d4ef33af9898b287b665bee8dd0f03f61d
MD5 5cbedae1a0df8c8a8324275ea8f7e74c
SHA1 4a32b921f5d5df8ccabb9f077943cd8842dad2b4
SHA512 4c5c550d7ab3144dc487aec48ea1ae1ae97e7f1067ab78a2db13adc1ff61ce2bcd67c03e469d16bd34755610ba1bcf86c0a506fb55e76edb8f2a697a1ddf4fb1
SSDEEP 12288:+Pm9U49AAjuVq1fgQJF5z0Rg2rOOJ1ZNNcbSPU0CeyGvGA:+PmSOWI4evid1vNcbScleyGvGA
TLSH
T131452C41A5B7E35FC9FE50330632868DABB45C07B7452B0573448A3C9877A7EB6E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 392166264ce8002ca051ceaffe90c1917271524f625ae93a1fde828a7a0ace3d
MD5 246688bfe50a127cd49e5e0dbf5eb02e
SHA1 e50db51d2293b27a60192ae8ad59b7cf5fce891f
SHA512 bbea282fc78658eddbc48ae4da74e3ce7c7651492f5c149e18859838486523ac28003449f6e018d451a4d752078226fb8e46c950a517c9561d18c5c276e45d9c
SSDEEP 12288:xR7d+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ddyxknw4FYnshx8OfVe247
TLSH
T11E65237CA7DEE8D2F46D11730676A221360AB5B49B70C1DBD728B14EE4B0CD0987DA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 26ed57188f70e5c88cf6ac06a38ffbfab6b15445d7ecc98339cf2c989a0d264c
MD5 e12a13295cf871be2f3ff3444cf0d5f0
SHA1 9f541ae3baa71c8fc60be80fb4649bee1b77f7ba
SHA512 6a54437385daf454204b330490a41eb7afb63ad581da08f2896dea60841f9d5eef14a98b0cc7747adc9187bec32a0a25f9e0cbe835a32a6253394eb5b86d932f
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bY7yxknw4FYnshx8OfVe247:ngb4mBIBhGF1x4x8EVep
TLSH
T1BE65AE1E22EC02F5E0F9E2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 972a4450b1b1bd8f902ecdd79835d5734a3b95b9efbdf6817a65d84f6f0ff6f9
MD5 52fb9c824c0a243dc4931f23e881f421
SHA1 c81801eef1d59497f85332911b5b142263f92f7c
SHA512 ec674be851416c049ca3c24cfa365ba2556d0a08c029db2b2a3293483079830995662c9c70a9b14256afbad16314e942c3a914ff0c4e9093095441765155da2d
SSDEEP 24576:TG88u8FpJqH1Izria7/mKyxknw4FYnshx8OfVe247:i7ZFPqV3a7/2x4x8EVep
TLSH
T13F95F16577E101F0D47BD1388A924663F6B2B4250374EBDF07AC8A561F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 f6573a26a8b74511795e73a162a4d50a1dbf467361bbaa6a06e7e88190a5299d
MD5 f502929fe9736a9546b177b898075f9c
SHA1 8944e68d8be8855b143277424cd467aea8adc861
SHA512 bf8a0068b01507770df757399f3597a3930ad71e492f66b5bff00b842107af7211300d7062d364617e18b261a8004ef4d268eab633307a52b706ed4558c4b2c7
SSDEEP 12288:jHvUrBFrEjwaQW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:jPUr+NQWyxknw4FYnshx8OfVe247
TLSH
T1BA75F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b37bb59277a0ca0250aa40a9e516bf40343aacdbc9634982045a108e4de54c9d
MD5 4943742e25b35360730ec28b70654acf
SHA1 c11f78ee9829a99201139f954b35fe13e04c2153
SHA512 54fc83391aedacef27d93b4b37b5104e5b82affd45a969fbcffa09138a48805e27f204fd62ac6f1d8536d48f64e57287159c49a3552966e870603e2adf4a9df0
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5x4x8EVep:pG05lO43bEix8EVy
TLSH
T19BD5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 54a61649142e197a8bf9ae621c0c54d5da1cc29dfc2b7ab18f21c9e50bcf7c62
MD5 c1032e88b916a793553d74823be9d7b7
SHA1 797373a8f50c889b1d271039df87a71b15309c0e
SHA512 6a995a721d3f910588ed045e1187aeac30f1c483e2048463b93eaebf43d0f5f45ac357eb5de10e55ab45d2931772934f9a1cb7635e47bb3e9d47e60c8a247930
SSDEEP 24576:gfa5POZ3dpyWVM50JicR2hG0lasx2+47eidncyxknw4FYnshx8OfVe247:Ya5POZ3lJt2pasx2+mBx4x8EVep
TLSH
T12065AF5DA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e954997a43f8d45115f937cfbd44294379348dd3be91aa4644a30a0b276b7625
MD5 56594b22d8ec91612357346da5de5a9c
SHA1 1b5ba4b351d55530bedf7a9651f01825eb11d807
SHA512 a7a47c798a05e20afba62e16bf184f3c9fa8356a7aeb8b8dfe30d6d8befcb444cdbe0c8cd519e2a9ac57794afd717f0c6041a045ad140236311c1bc635c69368
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7Fkyyxknw4FYnshx8OfVe247:PNc/zEOVHFWx4x8EVep
TLSH
T123857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8888d180c5619e21e1d01e7768ab14d4a352bfc32efcdbb4df8b65b3e53fe82d
MD5 aa3b72f86670fbdbe6dd683d2f82ef83
SHA1 34a96c706a5e2b5dd3deb284ac20f95a7c7860aa
SHA512 b7fb45e302f8b4c9b0a71b1ad13bc1a4ee5a4284869a04e7c6a7c7c9b24e31f41b5b7a031ca8885b38796166261e9610a8e2d3d29fcb1700ba7f21054a5cb773
SSDEEP 24576:IzkNvNnaFeYhJNtmZBmwyxknw4FYnshx8OfVe247:IzMwBtOmzx4x8EVep
TLSH
T13555AF6EBAF846E4D1FEC6B58D238112E6727461073293CB8390C13E5E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 375b8c00b8e4ec364f817ffe74b4a53da0459a664242520035ecaa11d6d7292b
MD5 4e22fb1bfd7038e47fde13225a816f2b
SHA1 9565eb68cbb16327fdc18df368ed72dab203dda8
SHA512 e5d6df4e58156aa2ec662a1a4de351d9fd8fabf3c50425461e33151b486e005cfd86cfa35655a75c85713035bcd0294dabf1d328984b0822346f0eeeab082db9
SSDEEP 24576:WD3FHshBIYQgARyxknw4FYnshx8OfVe247:WDVHeBIAAUx4x8EVep
TLSH
T10685E17DEB9C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1752-53-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1752-43-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1752-238-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/1752-40-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/1924-300-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/1924-68-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/1924-74-0x00000000008A0000-0x0000000000906000-memory.dmp

Download

memory/1924-69-0x00000000008A0000-0x0000000000906000-memory.dmp

Download

memory/2108-78-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/2108-1-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/2108-0-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/2108-9-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/2904-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2904-304-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2904-91-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2904-302-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2904-98-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3276-15-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3276-104-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3276-14-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3276-23-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3276-21-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3744-58-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3744-64-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3744-57-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/3744-299-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/3988-301-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3988-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3988-85-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3988-79-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3988-319-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3988-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4228-105-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4228-111-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4228-114-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4228-303-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4584-133-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4584-139-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4584-132-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4584-307-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4648-116-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4648-123-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4648-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4648-125-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5604-50-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/5604-49-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5604-36-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/5604-28-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/5604-27-0x0000000140000000-0x00000001401A1000-memory.dmp

Download