ec7ff95dac6dac5395c5df8a16afae4d719360c0c1ce84095b9a5964b4e890d3

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.4MB
Sample260924-c61s8acd22
SHA256 ec7ff95dac6dac5395c5df8a16afae4d719360c0c1ce84095b9a5964b4e890d3
MD5 fb1974b543cf88c147aab7c4de7d2ca4
SHA1 ec0a20599380bc15d771ec12915aeaf3ce050c3b
SHA512 08894194100b3eb4694c22e3eb884a3c889a4eb0f9a3aef5c39bb354bb7d673c2b1b0f54ccc1425d4b6caa7e0d19a6c5ffb24c7a57018279209aa5c8c42e76d4
SSDEEP 24576:wN0DL//8jVxSjyffkJ7G75WmLr/HdmAaQh7mb57GBiOl6a8JTth/RWZvR6wQQ92T:wefcmKcJiLr/9mA4b5+Pl6bJTIZ5jdgT
TLSH
T19A65D065A3E100F8D87B9139CAC65663FAF1B41217346EDF0AA48B223F276E5177E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4112	elevation_service.exe
1200	elevation_service.exe
6000	maintenanceservice.exe
1852	OSE.EXE
352	PerceptionSimulationService.exe
4460	perfhost.exe
1256	ReFsDedupSvc.exe
3032	SensorDataService.exe
2788	ssh-agent.exe
3948	AgentService.exe
2272	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d6ca90c631e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000097872e9ace4bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6c24d59ce4bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093d7bc5ace4bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000150dc758ce4bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df7f6b59ce4bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017e13d5bce4bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e896a9ace4bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	3948	AgentService.exe
Token: SeBackupPrivilege	1256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1256	ReFsDedupSvc.exe
Token: 33	2272	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2272	SearchIndexer.exe
Token: SeDebugPrivilege	2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2316	2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	4112	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 3544	2272	SearchIndexer.exe	102
PID 2272 wrote to memory of 4248	2272	SearchIndexer.exe	103
PID 2272 wrote to memory of 1572	2272	SearchIndexer.exe	104
PID 2272 wrote to memory of 4912	2272	SearchIndexer.exe	105
PID 2272 wrote to memory of 792	2272	SearchIndexer.exe	107
PID 2272 wrote to memory of 5152	2272	SearchIndexer.exe	108
PID 2272 wrote to memory of 3360	2272	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_fb1974b543cf88c147aab7c4de7d2ca4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1200

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6000

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1852

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:352

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4460

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3032

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2788

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3544
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4912
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8cbfe57050e02aa9816ff09d00ba6c7779e3e9495dcf521a5d1c3241e39086be
MD5 27c21f306c95cbd265452f080b96473f
SHA1 63a4c52b74af271ac489942ef12e0ac7a6687c63
SHA512 634522b5b0549f274ab153472a515a0364c6882633d0d3eab1e3a88663f352975d89bbf82e767cc3b955266d0dc53417daeed78bd5b930c17991d62349b96f6a
SSDEEP 49152:Eb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnHb5+Pl6bJTIZ5jdgpe:+3q60jBCslgJTIZ5Bgp
TLSH
T176D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 ff0844e28f0c7d8ba3c0b06a3e90e772f7459abf01879c524d4c0aec14d94722
MD5 50a17096573de3b3da336d2aeba5bb52
SHA1 3d0d3afd9f411dae89898e5270c367a990c2fae6
SHA512 d5ec1613cf59e500ac33356c4de66ddddc2fa47d56ba8772574e5a407566aeb716c53216406bc3dde32627435e27fc756e7dcd152d6d80f7af103868eeb7aae9
SSDEEP 24576:GXYfDtczAtmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Z:ltctb5+Pl6bJTIZ5jdgpr
TLSH
T16C85F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 a911c34905cf274b080158eb872573807271998703ed5fd8e1d23423ce8556bc
MD5 4f079d5f3d96ce23139db03432f2391e
SHA1 35af2106c1b42f179d1618ad77984497a0bec1e1
SHA512 15a809576111502c1ba30a685902dafe8b8b71b746dcf92f79d50f733984dc562629e2b10d72a0d72042e5285c694b5d9cd607eb7956d3f4a5a2c3153990df57
SSDEEP 24576:d0Le5ji0hmxqrMImb57GBiOl6a8JTth/RWZvR6wQQ92pN3s:dPji0Ac6b5+Pl6bJTIZ5jdgpa
TLSH
T14C95AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 04782d4896797751a30ebe8b4e2df8c1d0c83ae16aad1d6d0c77fab0f4cacad7
MD5 2a6ba14342fce966d09fdd2e138fb9a3
SHA1 700cbaf4148580500363590e9d8e852947975f40
SHA512 c97dde5e5d9ba8f6e0f65326f1bc681842b684a7a72d3231d8bfba1585c1854977b3a523ffae815462c2d8c448255bbf876e62c9a6cc167ebb9562e7ca12b9b3
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWr6q8wyuSmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:k/ezSC6vUzPviHjymb5+Pl6bJTIZ5jdN
TLSH
T199756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2ce9d7d1219d36f9785042f9b83778c853b52a4e8b35166e2a74a804a2753013
MD5 b84a68a111c237483c9c77bbc8edf946
SHA1 e56ab2f51b7a3739729b9c23c0105a49c02ec4a6
SHA512 ef988945dbd271c661ff58af58444f9be1eeb17b2d7facf001ae7f30cebd1678a377d7729dd8a1d535e534e43e682e2604f96e7a4f5c09b56cfeadf0ddbb6c20
SSDEEP 24576:bVbqPb88hv/l+bJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3x:bVO88hXl+Yb5+Pl6bJTIZ5jdgpj
TLSH
T151559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 1339a441beafb5736c60c1b81816154f5fca12f2e1959780fd2d3f2416d1c0b9
MD5 2628f10b9cbad2f1e634ec5561546b19
SHA1 f72e9c286a5de77b83b9e31a4e0cd4eec78aa489
SHA512 3233a27ffd3e71a30352c497353fb8a9bc2e6b8d648051fb2336aa2e1566eea2f89d1ca91f04a0afc2e2e5b107500209847460192b3a7f368b0046fdfb476c96
SSDEEP 24576:pMUmb57GBiOl6a8JTth/RWZvR6wQQ92pN3k:6b5+Pl6bJTIZ5jdgpq
TLSH
T1DB6523434B6A30C5E5AB1739D9CDDF00B879EF55CD866BB6C575282BF034389B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 c943208599c732eb50659ceda95a33bf991acc82270e4eba964d8e48098b9b00
MD5 474e6da2da2f3cf21a2b8272eb91e71c
SHA1 fedc570d991ce2d03d98b27dab355c9a7f81b59f
SHA512 b9e96581ccd0840cc2dcf85cb10fdc6bc6fd2fab5617f054292d7d7c78b1a31be82aaae70fc6a46520a9841df72952aa9962b50ff4b875ca8b1b9e4a18abb7fc
SSDEEP 24576:hJIUBmb57GBiOl6a8JTth/RWZvR6wQQ92pN31:hJIUcb5+Pl6bJTIZ5jdgpf
TLSH
T1BB85CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 11e552715ef3a6f865666bdd04d1b444fce51772c62dfc4d0ecee93bb6e5f060
MD5 94cd8536e200e2911b4d6994ebfc9ab4
SHA1 83011dcb451b5ecb9c4f402f97c101a3caa77d5b
SHA512 68432cbadf7eff2c7b8dbf7f89240f83098136e9c04cdb8d8d786e80e5bc8f47eb10d31e492602d3d71f319963e15d438c5850641a381bd4ef7ca092925b6841
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THl:xQvGAdlCEL8c/RRNw5CZslgJTIZ5Bgp
TLSH
T1CF266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 ee61d63bef5d4cb6be8e306e07116ba8f6df7f612cdd4af9956f3dbacf659437
MD5 d5e8817c5ac385cbfccb3bb46e496942
SHA1 dbb8e0fc407fa73cde72a3cae4e0ee9a9b90d9dc
SHA512 b34dadf100690a32c346a6291f51610565abf4a07b688e14c4a2c416c85266cd25d3aac3bb88b5ed47e5b856deb37d0e337c07b5414d38d4f887de07e38d44a3
SSDEEP 24576:FrewsAjTmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:Rljqb5+Pl6bJTIZ5jdgpn
TLSH
T18385E031FE75E036C2BB0DB65B65C706647DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a2a18e7b979dafd85712855b1b6e26922313082dc90cb0815b249c496b0b3a94
MD5 6ed0d2082f70a610d3240de349226fb6
SHA1 9db72dc1f24770412bb08940e4d2ab75195ee7a7
SHA512 f2652e8b5c2287966a4dc12dc3930bf5c72fc4d8d158a64986b62d9e8e9b2d97614197f39c47c3db3759ce02c6c15d14ca2b8996f1dc5fe41ad8f5c1aa970750
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHYsT6p:gUEtQevvqc2W1cpV2RI32Ys
TLSH
T182474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b879ebe132cc1a4423638dfcf08c9b0706432376c4d7ee78ec54568b2595cd58
MD5 3421ec95aea2a34f6961f58bc8e75ae8
SHA1 2cde0139ac187fc5b434b6ce890231fab1915f84
SHA512 45fd425aedd4e5623c0859af0408f348f67fe2cc1247723e68336e1875934908f66242576579c6fbcc5a1c5a071b0d3c856db395f00fbd33a8b3fa4528ad7fa6
SSDEEP 49152:ZCbRquA/m2yL5zTfFiV+XenmE3/zKb5+Pl6bJTIZ5jdgpp:2oquVjnmFslgJTIZ5Bgp
TLSH
T15AD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b469c72ef1a40fd68019152f0368c247123d1018dd90482a6729bc42e850ea0d
MD5 b1da150898128ee7024cbd98d177d85f
SHA1 2aca7473f5e42aeb5e8fb95118b14d811455ff7a
SHA512 204784d297a8b00f31c436f650e79f555c286eacb7ed5e0e5c3046a6abcdc9a98cbc8a03116a1616f57ea8547a86de7501bbdb6df6ea449a70fa965d96f1ecbc
SSDEEP 24576:zAhGL2IFoiwtA5l7S532mb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:zAM1Foiq5Jb5+Pl6bJTIZ5jdgp3
TLSH
T10B359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 b5997a991edc6a42192105521b25cb1c6770549243f9f0795b8916d5c479a0b7
MD5 8dc8273fdd90e96e9fe832180f8cdda5
SHA1 db5b5ff0e94f3fefda0fec7d1daebf17dcade33b
SHA512 0441765416c16610195425cd7b0789260e5af4c15b295a819051edcefdb824943bfcf107651d64e615e891819583d50e9a4cb88e217a6bf54083b2528214cf6c
SSDEEP 24576:dwu2OWHmb57GBiOl6a8JTth/RWZvR6wQQ92pN3o:dwZO1b5+Pl6bJTIZ5jdgpG
TLSH
T10D75F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 54a1244e92e23a91e8b9bf893e74f2eefa1feadf5051403b8bd9a35f5b1b5084
MD5 235bd37672fb14c264d11b0d66100054
SHA1 e73ca21cbad3ff28f0265b049b4e290cee8a1ed3
SHA512 a1dbd2b87bdb4a20bc85f791b168c197c227684d1c68be32821e81a87a6b4284bd389b38d477795538a5580e07af9daedac5b33d2effee161b2f3b5d61376c99
SSDEEP 24576:JZuAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3f:kb5+Pl6bJTIZ5jdgpl
TLSH
T15365128627A830F9E0A7523DCCE58B00F772B8529B7653DF4675056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a49791c3d9f1af7bb3eeb741f62f27fecb99bdb4577d33c9deb9954f03d064d3
MD5 85c056d9c0ea35e994b0b9c48216f22d
SHA1 869f44a4f29af97227b6e53fc7e963e3c61d1be4
SHA512 a4d4d34efefc912e84a94bf4d904ee268816081dc10d9d0c93a298f0581e27c6e5a56d1fd11abb6f127d7d4d8e74612a1990076c7566ae7f993ffa4e3a573cf8
SSDEEP 98304:+QRQyi36YOcPhLvw2gAf+PN3GslgJTIZ5Bgp:lQyiKahX+PN2sT6p
TLSH
T1EC666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5ed9cda7a3971acb57782404d6106b799eef58205100ba3985a5a73d874d8f4e
MD5 85139e787318bbf613a87b2eb33f6890
SHA1 468f0bc0d798361732c1b430ae392c9c08c3aeb5
SHA512 a136ba2397b89bf2ccfdd62831eb46612d0a4868eb886d1cd3acfc98dac81744588a85f38bd243df0c01d7812e6151f157c9e8fb56c2295d706fb3429224dab2
SSDEEP 98304:nQRQyi36YOcPhLvw2gAf+PN3GslgJTIZ5Bgp:2QyiKahX+PN2sT6p
TLSH
T1C9666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cd0c015af7348faf062b66c7b097a17649ccc0683827dea51a9471324a2b2e13
MD5 90aba1be7c7a85686e754da1acc6d646
SHA1 a73ebbb8fc105d5014414ff9f5ccfa2e9bdf4325
SHA512 9deea3235d598476887629a581e64c18c4967b6ae2cfe0b53c31a5f665d43a9bac3e2a570334ca5a83fb2f7d5c13134c441e40644f2489f2a49f1a79c28803b0
SSDEEP 49152:W68Qg55nhceWu7PNU3/6b5+Pl6bJTIZ5jdgpf:0thLRc/QslgJTIZ5Bgp
TLSH
T19FB55A33B2F60099C44DE1769F4A872196E27C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 662d67e9c11bd2497725c8dffea59ac617bdb56dc12083511b2d0cb2321b0bab
MD5 5323277b04b6ad380ebbdcfdddc89de3
SHA1 fddb98bd0524665cda21eeee4d272d3248f2989a
SHA512 8c60721547d60503c609698f672434f725c4c7ef97b681d8557cd1f0ff0c5987e22f82c3672bc39baebf855a59196e8ffb3c5217a4479b65a7003d55f7959e4d
SSDEEP 98304:xy5112gYy5azzVva69nLKnhZHslgJTIZ5Bgp:MLIHjWhdsT6p
TLSH
T1B8167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 80cbc78d512062b8a9644840932b9a6014ae9730dfd5959b69b28ab4476b56ee
MD5 ddf660c301ea818ddab7c0894277e4c5
SHA1 4e11da17a406093f20dd98b8fb04cf8c854d69f6
SHA512 a213962274dbc58b1402b3b2524a7c3b27a373199e21c44b918cce49ce07072efd8384a94b7ed6cbf2c93445afc4bf0b8b16ec16863bb29177eb1d0b39018c4c
SSDEEP 49152:WB+taZ3usBWOBr4tEG20bqx0z+n217aau1glAb5+Pl6bJTIZ5jdgp+:ku6JmUxd2duslgJTIZ5Bgp
TLSH
T199D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e0928114e2408b04876e1cda23bb445809d23c5ccc7a08d57ddc5bcb0033a4fc
MD5 3346a11c5e3505a36808a622fa2db1cd
SHA1 68813eb2ad7acea84b84f7aced8bf42a99d96328
SHA512 c1644af512ff95e850f0934c3bae4931ead57598aa5cc20eaa4fef13e618f865358794fed8860b4d5cd6645d581b2f8c762e3ba26e591efdb75c5f0e4184e2d8
SSDEEP 49152:11hpsNoJpF1A6BU44CwH7R4x8b5+Pl6bJTIZ5jdgp9:1mifPkRFslgJTIZ5Bgp
TLSH
T149B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e40551da654b549c98f63e40ef6d21bd6497436019036069d723301c75d704c3
MD5 5378367c9a617531162fd5199455523d
SHA1 b73a70743e8f4a7192f4e97711a416231e696fbf
SHA512 9526c627160b14d63b7dbf6a70aec4bf2540816ccc17668fee35e0a265513e8ad4dff32d4d078e82f96d9a8c20bc181c8bb5471fb7ce028f68b651191850288f
SSDEEP 49152:vSuZQIY0Be2KNRVtOnks6NMHq3b5+Pl6bJTIZ5jdgpp:V5dKvi61LslgJTIZ5Bgp
TLSH
T19FC5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cd61fd891fed698bebfbba3925281465e71b380f53fa72c58e6247cb768296e3
MD5 3dbc7c49672f2220cd5a053edc6fec5e
SHA1 7d24c09a260e32d2435e612d6e697e46323b690d
SHA512 9efbde0e47bfa9e440b6c28692c962c16ef18a782ca02493124aa5e50c28be931b2fec4d1edbc001d3f1a900bf979781404399fbbeb17dc30f8e08395391827d
SSDEEP 49152:XhtSn8EApI0figXgiDn0AP5wwb5+Pl6bJTIZ5jdgp0:GX2iyphxslgJTIZ5Bgp
TLSH
T12095BE13F2D900E8D05ED178C7468632E962BC164B35B6EF0A90B6561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 6e90433abfd4a2000b9013a459407de8c53d2b0f52505be588cbec1a5596ddb4
MD5 ab0bb529c122acb489f3f21ef83a3929
SHA1 e97962d51879b82424f97935d4b3360134636a1c
SHA512 cfb497a191aedee503bb1ea30225f99c67f3516d62517ecc35c3766ef4e5e10bb6cb2daed68e449429d693882f49f4de71c32f4c56cf85df8a984909b1e2a485
SSDEEP 24576:Nsmb57GBiOl6a8JTth/RWZvR6wQQ92pN36:Rb5+Pl6bJTIZ5jdgpI
TLSH
T13F6523824E6B20CAE09B5779D9C9DB00F87DBF96DD8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 eb00fd3ea2eb8e4755cadfe6c6ac846218f9b0d6b141fa197bb3a8113b27147a
MD5 76e7970ed6a18e4ceeb85ad7d02ba415
SHA1 203aa9e2ba731c82d327d2610f805d58fb26b0b8
SHA512 0dcb93f59b887965b116041e8a03a65ad1d03b0630c813a9f13fb7671bce48e153a01626d1d03345afcf68ea1548c110a68e375c08f898ef2eaa7e4b2f734b6f
SSDEEP 24576:9vmb57GBiOl6a8JTth/RWZvR6wQQ92pN3N:Mb5+Pl6bJTIZ5jdgpD
TLSH
T1936523824E6B20C6E05B5779D9C9DB00F87DAF97DE8727B6C67D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 fd4ce96dc1c0846f112d8ad163a117da3f0634e7865f63169603ce11b7592ead
MD5 9a88aae06dd4a1d999515b4a62569ad4
SHA1 9b8ecb4f90d5b88e00fae1dd5969539eceb5f88c
SHA512 51dc570b53697c27b6d167db755d0ecfdfcf5862e2017660c7131e431a6f65a6497c4b320b8eb537b4b4a392f4e62b7072a2e34315031d25e69fdd7079574608
SSDEEP 24576:IZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3N:lb5+Pl6bJTIZ5jdgpD
TLSH
T15F6523824D6B20CAE09B5779D9C9DB00F879AF97DD8727B6C97D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 cdddb4dfdbf007e9f7607a7a3f71428a50906d715e2e371068fcf5bbd47ac3b7
MD5 3b82cd2271e0d5be27cb4160a4040f7e
SHA1 f9bbda4ea834bb971937d09fad57ce17d1b94794
SHA512 3a0dea04a68235ace42f5b2fa62b3f380e66ba047bc55a8f9a6981f17a66e64f378e74e313c83d8a00edc9f467d04ed444c3164b2342aef7a75be87a9ec5fbb9
SSDEEP 24576:Rmb57GBiOl6a8JTth/RWZvR6wQQ92pN34:sb5+Pl6bJTIZ5jdgpi
TLSH
T1926523424B6A20C6E4A79339C9D5D700F4B9BE96DF5267FFC675082BA9313883C3134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 f7ee5c3156f730604b7a2a2692107809d7e7428e0864537dc4aceaef95a21121
MD5 1de5c0eddafa3b9d45ad0c3798b7d87a
SHA1 244fda0ca8913f1788209fc863d94743c57f28ca
SHA512 31e11b48100d9f37a43334b5c84b33080818d975a1c6f8328ea65f4b3c7d60e23b6fec5730fa8d503f5618885d3cad9d0e927348f78b0c79a0a6534b981856ff
SSDEEP 24576:r+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:9b5+Pl6bJTIZ5jdgpt
TLSH
T1086523428D6B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 c2ac9657aee1c9a00a7d62264085d68c6752dc28de0d90f498ae428a06dc4a5b
MD5 fa2a977e377c7a0d10c387df2c7b61df
SHA1 c4a439df3f8990feb356ad6a19edba53445ce8c9
SHA512 4396b4a2266ce1529119efaa3789a92ac3f123c89f39dcaac326b5a364d34e64ee4536b86927a767335b575136db2d9bc7e3722a94eed57f6e693b3f8d492b2c
SSDEEP 24576:wrmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:9b5+Pl6bJTIZ5jdgpo
TLSH
T1166523824E6B20CAE05B5779D9C9DB00F87DAF97DD8727B6C67D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 fb2d3414110fc28a9ce4b264dd30a4df93ee5cdef93787799f4409de394e34b1
MD5 36d9d2d8c5192522d62b3f1c1054340f
SHA1 ad2cf9156dd7a0beedacee25be544884e723fb45
SHA512 822479b8aa7e3e933ebd96a6a8fea48b3277ca5b5a6c444e20972b44c56d4ef796dffd8799314ccf70e7ccd9e92cd8f2c5b9347e0d29d2e2746f04caf4cfe9b8
SSDEEP 24576:jXmb57GBiOl6a8JTth/RWZvR6wQQ92pN3s:6b5+Pl6bJTIZ5jdgpe
TLSH
T1B46523468E6B20C6E05B5779D9C9DB00F87DBF97DD8627B6C67D0827F130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 fc2588701eade1ee1773b3201f56e79401cb4b689340d6490ab58e7be4b10867
MD5 4fa78200c75cd2bb97588048f7187453
SHA1 ef2f8336b2ff78fe17283b9e8c26998d1f63a223
SHA512 b5ac50746969030880ce8b28f214ad80a6bbf33b37cc1b830b1fff37c89996109cd8074f8f2f9684af7c1e8bb48ef4133f4007c4f4b918bf2d98a32e5b7a443e
SSDEEP 24576:WZM/zFVSOPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3u:WZM/zfSb5+Pl6bJTIZ5jdgpE
TLSH
T145850295B39018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 5c97e6ee822698ed749028672dc7fdab0480dcfc33441929c72bbe89df084984
MD5 03431af4b00a7058dc8dc04ece827f40
SHA1 d3452cb81ccb6eda2774812f4ad5c6ad3659231e
SHA512 80d74488b07fce4cd9c5b01f7e059a9ecb3938799e8a246a9b4b656680bcef71e875547cedac78cbdcc46a7394916d3fb180e6b92e63209d5f2a2798224c8e23
SSDEEP 24576:Ywmb57GBiOl6a8JTth/RWZvR6wQQ92pN3X:Ib5+Pl6bJTIZ5jdgp9
TLSH
T1416523864D6B20C6E09B5739D9C9DB00F87DAF97DD8727B6C57D082BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 933cfc1dfc277c9326a21d837fb69b99733dd19a2d55e9e10d6867015361dc1a
MD5 bfb1748469341dd8341a25734f9c65da
SHA1 2f404f5a1a66bc2417be096cbef41e0d3523c907
SHA512 4239a6c5254acddf81095c4b4cf2a1eafca2f6642eb84994edf885e87a0ab7d127186b4cf2fa81327a5767f86c2b29464556dcbf0899ca8db50da6bed3bb9273
SSDEEP 24576:mEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3L:Cb5+Pl6bJTIZ5jdgpl
TLSH
T1886523464A6B20CAE05B5779D9C9DB00F87DAF97DD8727B6C67D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 9a59c289f68a46ed44e381d76fa59de86699b88ef798a573be05ab35efb69945
MD5 409fd45156a81f7e4d01981c3b5a2366
SHA1 38d06bbe32e159daa25d359067ffbfd76a94f229
SHA512 3fda5d036a27eac6acff6e993eea2bf053aacb6e82c8ab66c9e01d0540beda514841b57789cef80336acd0fddcaee1ac12540d1a3124980651ec0e2eb92b83d4
SSDEEP 24576:GzyDmb57GBiOl6a8JTth/RWZvR6wQQ92pN3l:GVb5+Pl6bJTIZ5jdgp3
TLSH
T1B175024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 35e491aefa5d1d39a0c9287913a4c4bcb4d7011e73349638c84db6609aa83d60
MD5 8edf54b5a4631de87731d4e089448e43
SHA1 6bd1c9bf8313dee2106f304431a21ecf55986442
SHA512 8847890ee9f5acca4a1d50d4c45b8fda60c3182631cb96d245fd439393575afb48c136a60ea88c86435ac09c71ec8144c3689dfc57cabdcdd04b8c2284b694cf
SSDEEP 24576:Dwmb57GBiOl6a8JTth/RWZvR6wQQ92pN3g:rb5+Pl6bJTIZ5jdgpa
TLSH
T12F652386496B30CAE09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 c40c6b20ccd4652225ad0370b616f528fee7bcdd3c6ac958f923f4a942b84bdf
MD5 629a9f8e02040d268921be525ddaa35a
SHA1 1a10af45c9cf9f1f522ebde83613a7c044391b07
SHA512 87178a6939505da76d3180118d25c45433c06ac4b39237cf34bad30bac3897a5c251b1a4e590479ca7d373a2a538f89f22c206f862559847417f8d20e7b5c44c
SSDEEP 24576:Jwmb57GBiOl6a8JTth/RWZvR6wQQ92pN3O:Fb5+Pl6bJTIZ5jdgps
TLSH
T140652386496B30C6E09B5739D9C9DB00F87DAF97DD8727B6C57E082BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 3280d070979c4119376069c9fbf6b61c32e46edf46ae7e9c3db5a700dba61519
MD5 702ee9c2e84ca90fc7a9d854a99796fd
SHA1 e09caf758ba35ac3c3c143a9cc84fc3b679d58a8
SHA512 b0ae066e7894fddb3bbc116b4cf43e8d61cfc9dbc40d44cb58071f4c522d785b0bd3e58f617c4331f3dbdf2cd753f01d009dbf67986fb997942f9936d85ce0b3
SSDEEP 24576:lzyDmb57GBiOl6a8JTth/RWZvR6wQQ92pN3O:lVb5+Pl6bJTIZ5jdgpw
TLSH
T11375024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 aa567e428399883de7e710345efefcdc4bc426c1b6eeeff519b6b6230b7bacc5
MD5 b69c5fd7c4591d3f39fe112f0ad37be2
SHA1 70f1c140fc92a624dcc0c310190822383e51285a
SHA512 5bfe66d109755e1fb36db14e7dc4d3c2cbe8a66d460fad0d6230909d7238f338632562afac7ddb11e94e47860264230de59964e7ec46621d01204326298dc77b
SSDEEP 24576:VT0aLl3z0zDpmb57GBiOl6a8JTth/RWZvR6wQQ92pN3c:VTDLljdb5+Pl6bJTIZ5jdgpS
TLSH
T1D085F295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 dc47835935c29ed7b7162abb48adc93850c46233160c36a73985b803f9b83b4d
MD5 2dde2e8eff34d97e3223fac54d487538
SHA1 0d5f0c222dff1742e959a254355366e2fa095f1e
SHA512 c0729dcefcebf9f17694a4e7d86cfac2e3f291c445a35cfda12f4a1865de83e516e42fa4dce1a22b220f813ad9bf1afca7aff49f788b86ba46e8bb17a262cf4a
SSDEEP 24576:W3Id9CHKy7GZlmb57GBiOl6a8JTth/RWZvR6wQQ92pN3m:4Id9CHKyaSb5+Pl6bJTIZ5jdgps
TLSH
T1BC95CF90F3E410E8F0B79A35CDA68601DAB67C5A5B21DE8F03A4251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 c192b404559746a29be0d3fa7f4fccf952fa23b043ef3c4b2b08416a6a107d57
MD5 5d8479ae8cd5b2b482e8cab348cbd9b2
SHA1 a6e69d78d8b616e33ebeb596fd7770b28c42428d
SHA512 4408c555a14a4f56e010b881e032ce50d1465d796f31767f2cd59059085a0b1b3ba287d21ba6169d2588fd5ffdd6f52f8536fa8a7990c27892c77cf3219c773f
SSDEEP 24576:05mb57GBiOl6a8JTth/RWZvR6wQQ92pN3V:Bb5+Pl6bJTIZ5jdgp7
TLSH
T1136523428D6B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 e9bb0ff99d496da575855f853a011c80f3863012e15b5e6d4e644d79373ab159
MD5 82c64e87898ca5362235db78aeada4a1
SHA1 098a5dccfd737a422618f205cd7c45b60cb0ce28
SHA512 ea63e150f61ae45114caf781e55b455acf991750729d5361a424f75e5f8f5cb49e780466d64f05dbb89f53410986ddfd945054058c60cf2c72f3f7502afb6215
SSDEEP 24576:fjmb57GBiOl6a8JTth/RWZvR6wQQ92pN3b:yb5+Pl6bJTIZ5jdgpJ
TLSH
T1B86523824E6B20CAE09B5779D9C9CB00F87DBF56DD8727B6C67D0827F134789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 33a739a33cee4eed90f9422fcefdbf60ee0528a1f5670b6d3acd3d6bef0c52e3
MD5 7d5c772c089fbbac84be75d3f85e44f7
SHA1 ec729437c55a7ef8cb6cd86cb40dafe9d3e6c862
SHA512 f9be0c03ad434bf50030f0ac9e68743f042f1231281cdc542e7046c89ea5df9e520564890fb086b2a503afd834dd386cb5a360aad2e931ac0bd9d450d38aad12
SSDEEP 24576:eamb57GBiOl6a8JTth/RWZvR6wQQ92pN3Q:Eb5+Pl6bJTIZ5jdgpC
TLSH
T1EA652382496B20C6E09B5739D9C9DB00F87DBF97DD8727B6C57E082BF134789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 3ca9d623df00a409102993ed7c810c35b9b5e29af31f0a8c74b4721d87377f36
MD5 2b8003174fc4be7da3bcebe46be994c0
SHA1 8c61e0e32dbc48242434e263616f4b8456041c96
SHA512 0a50c35d4a08dc3ead736969f1b15a34bbd462a9dfdba5b05766c0781286ce94a2ad399b1b0a27516377db0596eaa0f8800a58fb25e94824bf5c103acd386767
SSDEEP 24576:0wmb57GBiOl6a8JTth/RWZvR6wQQ92pN3k:8b5+Pl6bJTIZ5jdgpq
TLSH
T1D86523864D6B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 e2cb32a8b420c0c11c2a110868651efa482bf742f6f4eb7062dbc7ce026e00e4
MD5 71494ed26ddc7d4fcb76e453ad16a888
SHA1 d2f2ad1b05fd60db90b5adb5aaaf393363407c20
SHA512 ad876610ea2a3ebd2de16afc0cba7b5fab723032ee7d1e02b5670b4ba5bf3998bc7e9a5aa025b4f40a2c8d03a30e48d547f85b5bdfd2587b937702802f321825
SSDEEP 24576:R5mb57GBiOl6a8JTth/RWZvR6wQQ92pN34:mb5+Pl6bJTIZ5jdgpi
TLSH
T1A96523824D6B20C6E09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 9029dd84d6d5d831bcb42e8d54d21eff5d82e7c9538750e21599cdc5260dd789
MD5 d6bae33d9ad833036e3ca1415b110c9b
SHA1 a843a4e5cc971e374bea148d7c58efe6e5f9a24a
SHA512 ea5e085e25910cabcc150b3e42a0c4219eccc44d9706b025a2e0c9c19c1beffa50babeb6a747522a62b5541ffe2af112fb280c382b79d4a5d3d7c37187edfa4e
SSDEEP 24576:EYmb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:Ub5+Pl6bJTIZ5jdgp/
TLSH
T1756523464D6B20CAE05B5779D9C9DB00F87DAF96DD8727B6C67E082BF130789385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 ecb46ca02ea777c10bcab21b62652d35b49d8b7c71ebd0c18068209206d6d1b8
MD5 72fd181840aeba955df5ec0d1f452bda
SHA1 84c6de662940ba79f66327d160417a72ad72730f
SHA512 efbbf6dd06223f4c4beda7e7e288080025469a54a9e85b47bb302df27bd557dc3ca21936e006de37359106c7712f190d3459cf6c8859480280b370d876305b31
SSDEEP 24576:U+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3B:Cb5+Pl6bJTIZ5jdgpf
TLSH
T1326523824D6B20C6E09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 d2d4e99b5dc38ca9a16279899208e43a0573768e4a0b2efae0439277f10975f8
MD5 c2cd3ce588bd597c07b0006b35c29700
SHA1 a634123569c03e761476fdc714edcaaac2dd6a05
SHA512 826652abb36038ae540e56846c2d30267db9aa95310a7a76488c21f2fb1294fc36889d18f17c5dca7a458973b044122e9470af4962a7adce11bae876087099e0
SSDEEP 24576:Gfwvik9RX6wkyAI0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:YMnYIDb5+Pl6bJTIZ5jdgpe
TLSH
T15D95CF29EBDC04D5E0B7923C99E7460AF6B178595B31C6CF02AA536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 90c0f08192092bef9cd218510bc71536d38857ada055aa65b95283a5e2c5d470
MD5 cbcdb1e102ad7e25b7e9741582ee499a
SHA1 604aca211ef7d693da2684d56490bef977e7d0fd
SHA512 6d2bfdc7e9b38039ab4a1370022b6d2f3ec5017eb2c8fde0b0ac5c3e2456cdac1c245a3cf84bc6e23b778bede6e7d14d5339035122d0e87307d10ce903805da3
SSDEEP 49152:5YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Qb5+Pl6bJTIZP:HySzPmslgJTIZ5Bgp
TLSH
T101066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 85c2d969ed967d0aaadfdb501c81bb3e57211f90f03c19861a36123772af59a9
MD5 30fde02f64294c984710a580346de76c
SHA1 577424132db7352cbf424c9bd22323a3017deb12
SHA512 09ce54f5c5b5c071ecf15f5626dc3fa1be1f9f7c65f817e91d5138b2ab67605cc6908c7936d40edffa4b42915fe26bc685da139b897b005fb3ec74bd72717ad1
SSDEEP 24576:o47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY/mb57GBiOl6a8JTth/RWZvR6wQQ92U:o47JUQj4irIhCnDHUPfF/Ab5+Pl6bJTY
TLSH
T16465AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 7d8ba1c9ecb2bafc36e50656626094397b9a6cbd07c9bce1a0e5a705420cb125
MD5 3c7507f2761840e8a34f0e9d8703711f
SHA1 62fa1177103a26ddb9bffe1d70b4f4a63fcfacbf
SHA512 53439361c35d73e8064079dee8995bcecd1c0eb938ffdaeb8a9a652d4e1b54758448f686ea16551cf25aed5d5c005118ecba8214e5a456c919502bfd7e7eee88
SSDEEP 24576:VAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:5b5+Pl6bJTIZ5jdgpM
TLSH
T1CE75F14AC29811D9D06E6279CB858A00F7377D65CBE293DB46E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 0eff4b0ef4e8b1d536a837eca86e801456dcc02a6c636846d7db04bae5c332ac
MD5 4e4302d64b90e9e27c39ef94cd3e9e46
SHA1 76621751911dd8df9385d435ab4db50bd0009c68
SHA512 cba3b3b892c4ff2587cd9d7e98b8f7f1e63739ecf6b2a0d934a4b46f4ab8da56aa2ccbb1163c7dd707cb851130f33cd263c840f0ed0250e25753f2867693b351
SSDEEP 12288:4x2fYU3fmLX9nrCJNoYPEIc5yaKd5aR4UYG5646Tf+RC:4x2wUPmzINoYPEIVPaR4U5564LRC
TLSH
T12D452840B666CB4FC66940321E37D2CCAB707D42EE446F0773C9973F9576658BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 1fe519c4e8c6ae409106e21a06403c2c354ddb71515167813cdf5e1d52eee533
MD5 3a383740e7e4ae1905ca01cfbc4d0685
SHA1 c6de375185589bb42906680b15f12cc112ede63d
SHA512 d61a40917f6c940e490e051cd88dd774717394ec91b9947ef7c8d42b14fe319cf0ad0d6a4114501b44568ca04570a9c2ba7ae0387353bb2c451f3909899966fd
SSDEEP 12288:ovzsoL8zMYPyYPeYPRh0IcIo2nsEnOS79AwSIK:ovzBYPyYPeYPRh0RpEnO62V
TLSH
T13465FA416136E78FC1F76032072A5B8C77A4EC0BB7496F26B3C9453AD86A711A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 e8fde14001dfb57d000d9265b65d8d030b6256e81caad68ce0ab5d2d011b5185
MD5 d543216d18adc11f3538643c583d1896
SHA1 0d0fd1965510f6126afdd9bce56dccabf2062680
SHA512 550dc1972d03291a6342767fc27285ba247f6b8d91cd29df467a324029cb9f63904d3fe29c6d4ba6977b897fc96e002ecb872a0cb71d53a93f95c36f2de01d65
SSDEEP 24576:tomb57GBiOl6a8JTth/RWZvR6wQQ92pN3f:tfb5+Pl6bJTIZ5jdgp5
TLSH
T1696522428A6A6086E4BB5738D8CDD710B83EBF65CF8566E7C569142BF1306C97C7230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c026c50dbffb5b7103e550d82060414bb1cf01a87dbe428d7a7f9af4a57913dc
MD5 6ed08c02d89a3f34f640a908515ff30b
SHA1 9c7fbf68e37b20bd01669a33a17432a0618802a1
SHA512 1937b618e226c88da841661eb8ee18f0181bcd3734ebb3c401becd36d7e5438753fe2ad19d8f2e980e8e1a5542756336b70f211c165729064ec93dd3b91aa8eb
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYSmb57GBiOl6a8JTth/RWZvR6wQQ92pN3T:5gb4mBIBhGF+b5+Pl6bJTIZ5jdgpN
TLSH
T1D3659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 e0842ba3bed348e4c42a9f7c4dee52f76f9f840fd747b4ab27ee67c6cb5ccc86
MD5 ae93aedec96a4ed12141a42a7b487acc
SHA1 8ec31f96afdd3bcfabfde08d89beeebf73134cb6
SHA512 77a9dec53c732f9b28b054ed835aec09b374b2790107a8973c86b0d5dad6bdde18b0aa53a138dc008e5293bd53f3bf19be764e432a7f761579f2a08f67fa376a
SSDEEP 24576:JG88u8FpJqH1jzria7/mPmb57GBiOl6a8JTth/RWZvR6wQQ92pN38:c7ZFPqV2a7/lb5+Pl6bJTIZ5jdgpi
TLSH
T12095F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 07b9a47f0e5f5e7157a6d3bef00767a3a2672f9d643abba0b3453dcea2689a25
MD5 bbcd25a253c3a9b6621601d27c41c3d3
SHA1 80b41d08eb9d141e44304f1af2935c0ace511f35
SHA512 01228c32016a963ea3a026b67f0d234e9cbb1566e91e5d3098cfaf09ed177a78800ab16c81aa3a8e8aa8f1d620b87e8bf5ac7ca79a90d9dc77ca54ffaf853206
SSDEEP 24576:XPUr+NQbmb57GBiOl6a8JTth/RWZvR6wQQ92pN35:XJQSb5+Pl6bJTIZ5jdgp/
TLSH
T16375E11F26AD18D5E67AA17DC9C68709F771B862471292DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e9d4d3616defc3152bfbeb4f860fc7cb316459580f821f5dfcdcabecad33336a
MD5 6ec23ad7a6ed7c9300fce9440f0c6c44
SHA1 ec161ba3e4cf81fc10c7636e59ecd49fb3949ac2
SHA512 a4023707b006a36f1a0eb7bfa31fcb52c6dd5530a43b52db1f475185feeba223e07e8371b99401cd98b7ca7211b77d0ee78427c2dad68a64d79c56e2e5a3b53f
SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjib5+Pl6bJTIZ5jdg0:LG05lO43bfslgJTIZ5Bgp
TLSH
T110D5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c62d43595833ba5cb7fa2ed62e08bc8167813b3f93726841dbd1a88f6d1fcfce
MD5 5db2f9b4bbd170960de2d13a576d0ac8
SHA1 55735daaa6248cbe48a98ffb7e80538b8b438c4b
SHA512 b1a24cb9a62c4706004daa38cffe8f879f0fc19faca32522207a2733f8e72d895eeb27c3714d6a108a37eaec21bd6221f54e6d90aff035960a93890b2bcdbfd9
SSDEEP 24576:jfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnNmb57GBiOl6a8JTth/RWZvR6wQQ1:ba5POZ39Jt2pasx2+m6b5+Pl6bJTIZ5/
TLSH
T18D65AF5EA6FC01D5D1B9D17DC583861AF5B1342653329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d06506e53defc298102f0eb7d960046dc148a08f364ec0d3204020290895031a
MD5 a332ecdc09a180710aa1d87706809243
SHA1 29a1404db5a6e7087d319e5ea41ab46beb553711
SHA512 7a48164830e475366d7113b09d59f185499ebca5d6459851f47df7b55ec23294815a0ead0cbad825b924aa91a410669e3651da32325fe370390325c0a7b8a479
SSDEEP 24576:kNcwHdjbyQ4nLC18lb/EOjowL7Fknmb57GBiOl6a8JTth/RWZvR6wQQ92pN3M:kNc/zEOVHFFb5+Pl6bJTIZ5jdgpO
TLSH
T17D858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8e26cfdb229e43308f03605ece8e583c1a4df156d1c2ac6b92fd97a6b4291b1a
MD5 25066672f8f14a0185a7530c51350586
SHA1 ce5aab83573f003361afe96d657e2f4f983b7d80
SHA512 f30f061d2598f8b243177393598da941b6398b00b98c29cb8b5baec8aaff9fd75aa605b1507f0ef2cd1078d9dcb46cbd7ece985d2a7ba68e1b132dea95b12b01
SSDEEP 24576:GtkNvNnaFeYhJNtmZBmxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3h:GtMwBtOmMb5+Pl6bJTIZ5jdgpv
TLSH
T17455AF6EAAB805E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 43a5d683c3e115483676d08246d121cda72b853a572ad8110a4c44301082cae5
MD5 260d26ff8a1b95a381f6bebed2c7fdce
SHA1 4e0ba06a78728a51a8fc3c5207dc493d086cf5af
SHA512 5bc8f249183dd21a8442f4fd8e29b57b28bdbf713cbe7c3f43e76c6ca1f981fd4190282fc9c7dce2c357191f03854a33364a215a4359415522db606b36c9cdf2
SSDEEP 24576:7D3FHshBIYQgAMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3d:7DVHeBIAAbb5+Pl6bJTIZ5jdgpr
TLSH
T1C085E17ED65D00E4E47BD27CDA938A06F67138A9472266DB02D481BA5F2BFD43D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/352-66-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/352-287-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/352-74-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/352-68-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1200-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1200-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1200-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1200-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1200-107-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1256-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1256-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1256-322-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1256-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1256-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1256-83-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1852-56-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1852-55-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/1852-62-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1852-262-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/2272-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2272-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2272-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2272-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2316-0-0x0000000140000000-0x000000014018F000-memory.dmp

Download

memory/2316-8-0x00000000021D0000-0x0000000002230000-memory.dmp

Download

memory/2316-7-0x00000000021D0000-0x0000000002230000-memory.dmp

Download

memory/2316-78-0x0000000140000000-0x000000014018F000-memory.dmp

Download

memory/2316-1-0x00000000021D0000-0x0000000002230000-memory.dmp

Download

memory/2788-117-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2788-109-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2788-306-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2788-115-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3032-307-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3032-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3032-96-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3032-102-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3032-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3032-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3948-121-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3948-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3948-127-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3948-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3948-129-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4112-22-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4112-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4112-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4112-15-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4112-21-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4460-300-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/4460-79-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/6000-39-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/6000-47-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/6000-46-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/6000-40-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/6000-50-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/6000-53-0x0000000140000000-0x00000001401A8000-memory.dmp

Download