37ed08d8606f2c98c084e981601edf1ba3b63a6a6d8bb63b52bd288f9076ce94

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.4MB
Sample260924-e2kbsayeqf
SHA256 37ed08d8606f2c98c084e981601edf1ba3b63a6a6d8bb63b52bd288f9076ce94
MD5 100065d639ed9ce9a0196653f078ae5b
SHA1 bf9a260409de4e05d75ca4dc034b7fbb60e39d23
SHA512 25ed5b7ad28375f69305a2283ea9f1b77f643536b85231083491155e4a4303869d4cf3bc58eb4950a7a26aa1b099c4c218618dfcd10062ec039ebeb0b3b2ccec
SSDEEP 24576:ZN0DL//8jVxSjyffkJ7G75WmLr/HdmAaQh7mb57GBiOl6a8JTth/RWZvR6wQQ92b:ZefcmKcJiLr/9mA4b5+Pl6bJTIZ5jdgb
TLSH
T19F65D065A3E100F8D87B9139CAC65663FAF1B41217346EDF0AA48B223F276E5177E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
884	elevation_service.exe
4840	elevation_service.exe
2604	maintenanceservice.exe
3624	OSE.EXE
5024	PerceptionSimulationService.exe
4648	perfhost.exe
5572	ReFsDedupSvc.exe
2356	SensorDataService.exe
764	ssh-agent.exe
5968	AgentService.exe
3024	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c76ea89ae4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007df8ededc4bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8152b22dd4bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005fe70ae0dc4bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061db70e0dc4bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8cd56dfdc4bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007426f1dfdc4bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e72ca21dd4bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
884	elevation_service.exe
884	elevation_service.exe
884	elevation_service.exe
884	elevation_service.exe
884	elevation_service.exe
884	elevation_service.exe
884	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeBackupPrivilege	5572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5572	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5968	AgentService.exe
Token: 33	3024	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3024	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3024	SearchIndexer.exe
Token: SeDebugPrivilege	3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	3872	2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	884	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 5332	3024	SearchIndexer.exe	102
PID 3024 wrote to memory of 5616	3024	SearchIndexer.exe	103
PID 3024 wrote to memory of 2368	3024	SearchIndexer.exe	104
PID 3024 wrote to memory of 1968	3024	SearchIndexer.exe	105
PID 3024 wrote to memory of 4760	3024	SearchIndexer.exe	107
PID 3024 wrote to memory of 1116	3024	SearchIndexer.exe	108
PID 3024 wrote to memory of 1204	3024	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4840

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2604

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3624

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5024

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4648

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5572

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2356

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5968

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5332
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5616
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2368
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c16093e13496c239dc1fb0aeef564c099a99cfb9797bab467c4030a67d36b2cc
MD5 a6048fe8502570bb94ccedadf632eeb4
SHA1 6fb1f7aa8e0296f9197bf38b6b28e321e33b62e4
SHA512 154a9240d99bde11ac3b70014ba60aea93b7656f6fb381c7b613825ca87328617aa2b0bfc5e8e181543f15a95fed1ff59ebe47640cf70d80d5b8d441ca3cf03f
SSDEEP 49152:eb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnob5+Pl6bJTIZ5jdgpd:g3q60jBXslgJTIZ5Bgp
TLSH
T118D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 feeaa0fd879d991a40e829a06c02fb5a8a5e37a3e3f2931e583a1029fa4d605a
MD5 5d24995625b57a1b1c8f9bdb553f5b60
SHA1 d4e69d94c7974f0b212b0ff6235798094a30dd5e
SHA512 b7a49a63d3cbc41b9435482f8965496f7e6f6c5b7ce365d5902658c39da595298f4b18fa1962d87f663c5854ef381b00d0b9490766b222e7934f0cfa9f6a2151
SSDEEP 24576:5XYfDtczAomb57GBiOl6a8JTth/RWZvR6wQQ92pN31:8tc+b5+Pl6bJTIZ5jdgpX
TLSH
T1B485F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 1927cd41e07e806f018cade71c1583e6d171467316ec85471753fcd6b1b0c313
MD5 9608ae70697400b7548c5bcd7fbc6ea7
SHA1 2813027fbbcf9b693b624b1455d6142ed902e994
SHA512 b47ddeb7b4170d36eb9b451dcb89e33412e7948b2fa43f035aea03816ee41d458ed410d861cfa8714c9ed858b46d6fc1aca50e43163d1f7057fb40c7d96137b5
SSDEEP 24576:H0Le5ji0hmxqrM9mb57GBiOl6a8JTth/RWZvR6wQQ92pN37:HPji0Achb5+Pl6bJTIZ5jdgpJ
TLSH
T19B95AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 77c5b43830ea87fd561f62d4e727332be27104e3ea03857bb992b19eea04f868
MD5 33703f95ab0813c6d56d8c348a8265a9
SHA1 c3cccb5e28cf12e27a90869118fb3d0cc66bd4cb
SHA512 f16230aea0615ac7cf4bcce1d0b8a84d00037dcd1f476a08a7d96269cd86627a1f93eac11ea0b4bc7588d106c9a707eee8f2c590ff9d41a3a054512fc40a8df3
SSDEEP 24576:fa7/ezSC6vUyD/aqgrvWr6q8wyuPmb57GBiOl6a8JTth/RWZvR6wQQ92pN31:S/ezSC6vUzPviHjydb5+Pl6bJTIZ5jdW
TLSH
T198756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 04a932e29220f330c18fcba35d7ed681e5557f35146b8af0f203af388ab77c98
MD5 4dd7599ca3bc6459db11e9a5ebf766b6
SHA1 ee28d9a813316592c4a42ebf45c21ea1cce51de8
SHA512 c9a6210ca09523ec08a48e25d5825ab40f2fea875c34ba155a19abf157eb2d58dffa9105dc339652b9bc66a441c1067e3c28b3034b288aa753f0a32ea084b2f2
SSDEEP 24576:mVbqPb88hv/l+bUmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:mVO88hXl+nb5+Pl6bJTIZ5jdgpS
TLSH
T10B559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 71d0b89e6cacc5c351d0f3c4380ba50f720300253a6234efced746c2727acc03
MD5 aa92e3296a6ace6f7c9f646948465036
SHA1 cd341e2fe947b8498eabe098b8e73c5ef8580b33
SHA512 46650016a2f5c0180aa7d6c54c32dc152427dbda5be25196773c77e06176297710ae1ae506921e3bc08663b733e124f84d36c16cd350a215864cfd09f4b85796
SSDEEP 24576:RMpmb57GBiOl6a8JTth/RWZvR6wQQ92pN33:Jb5+Pl6bJTIZ5jdgpp
TLSH
T1086523834B6A30C5E5AB1739D9CDDB00F879EF55CD866BB6C579282BF034349B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 6d2ffe14f0d53e1e0db56cd6521e1fcd6e6d93d5a452f611712f0481a90fd27b
MD5 c1cf1485bc4d6173041d3170402e4e4c
SHA1 d24bc3ced83c10571bd9888e80fd6f90320ba318
SHA512 fd9585f6948d5a2aba22f931b22a1062767a7df9025f5097fc65e086fbdfa352ba9eb2f54a08920db8bb4157f1b419eab9daeade56991539e19fe9d2385d976b
SSDEEP 24576:3JIUsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3M:3JIU7b5+Pl6bJTIZ5jdgpi
TLSH
T1E885CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a825b89aa8e816aefc0c9928601d9696de42b8b90c7bf50b6a176c06439c6a33
MD5 78902a23ee63ad51f767577fd842cbe4
SHA1 257eab85966964d428038c3b2b22561a364ae283
SHA512 b6f59ee8da2c22f54ad442510669683e86513bb258220bd009df2ab7e80d38564c00d837210a90f2e1662c1a3a8d9e0c604c3a20d2567aa22a7e1baffa1acc3e
SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THy:kQvGAdlCEL8c/RRNw5CkslgJTIZ5Bgp
TLSH
T184266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 c5b3073267e26a236071239ca49b11b54870aa046e7bfae7ad8ccd796da09c0c
MD5 1588373b8f7fd11a9c6b6710c65acc69
SHA1 f09c9986eaf99a2204a074cf34f91bb8b8d5705b
SHA512 21fea413036828f5910ad460a94f363fa10b911be1eec6597f6625de599cfb41c8903d4ccce4c74fa4177f9ab5a5063c9101e8dcddbd24a263260cd87b294708
SSDEEP 24576:GrewsAjOmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:Qljxb5+Pl6bJTIZ5jdgpn
TLSH
T1DF85E031FE75E036C2BB0DB65B65C706647DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c6001340134019ec4e03ee9d4cdb3a28560efc300cf204eed69aac98fa1c0662
MD5 4a3fd8a6ff74a194a826ff8ee947483a
SHA1 326191751709f00a24ca476ca727ef044dd86cb1
SHA512 3eddf659686be47c5d7d8ef1e226eefbc4caedcf2cd056abff8d1b4f7b3064d046d7144f387fcb7742d3c6368fb0c691265c5c62647dbf12f96463198df8639b
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHlsT6p:vUEtQevvqc2W1cpV2RI32ls
TLSH
T10D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0af798258e6b7bc4bd705a34002dcd5d2cd5887c3ef9c7cb6a293544065605bd
MD5 990bf220ddbcf40a43314146cbcf68c8
SHA1 319d1cce6b85082710b332ec311613ee0ed73e73
SHA512 917bcd4cb11749efe210f3b22b1732c000aac0e68bb2408b6b54fadccc31434d0973b1c604b9fda125f951454c48f7edda5df345b2def612cad3ad259f6ce03b
SSDEEP 49152:bCbRquA/m2yL5zTfFiV+XenmE3/zRb5+Pl6bJTIZ5jdgpM:EoquVjnmgslgJTIZ5Bgp
TLSH
T13ED58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 350948a7d40ebde0f50d1306b1b9baacde18d899f2ff1b04c7575d62c326139c
MD5 8124196cec6d6848a309a153d7145376
SHA1 5a7ba2219077f432d468d2da112e162c9f78e036
SHA512 92befc25fbc5f60296674c9d07904de34a6b7065cbf353fa53d541a43532fd27e28ee2ee64fc9df27c29539b13b7e279f04f52e3341b34d8c402e437467fca18
SSDEEP 24576:AAhGL2IFoiwtA5l7S53zmb57GBiOl6a8JTth/RWZvR6wQQ92pN36:AAM1Foiq56b5+Pl6bJTIZ5jdgp0
TLSH
T133359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 0ecd08babb9af72d5d10e540ed3f4d1fa337d8d2112ba5425d74f0dc1446e7a4
MD5 2aa27663cd5e62f321068e8daaf942d0
SHA1 e6185a8eee108531ad021499446babd0f5364514
SHA512 ba6364e0a8fa04e2e1ed0f19b2c548cf750d9ab04f0b40a5dc1d465e361337f462dc3a88fd6e6a2dda3c5da3878ee3652d111ec09f6b2fe1b116dda7d2122b9a
SSDEEP 24576:jwu2OWymb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:jwZOGb5+Pl6bJTIZ5jdgpQ
TLSH
T18D75F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 65d15621c51bb9861bfa4a644f2739e5d7b9d95ba12945f4a4ed2e628c834f74
MD5 de1ed3b62dcb96e02e0c2de29e43bd19
SHA1 00677e0e82d1b73bd1bca240db357cf8d9ded991
SHA512 2f50e095216951d46256abc378fa6d1e5df6fb9e833c5dc12eac2a213ed3d3f4c169a6cd7004a1ee52f4045fac37bfac3711bb6e0462aa2d42c31c700ef27955
SSDEEP 24576:9Zu1mb57GBiOl6a8JTth/RWZvR6wQQ92pN3F:fb5+Pl6bJTIZ5jdgpT
TLSH
T17065128A17A830F9E0A7523DCCE58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 42671741ec58e6185e8cf42f5168497127751f0c94de0425dc5c47a418cd8f22
MD5 1b7279c4a8cf8c7092f0cb5676a53586
SHA1 3f105ee1de103a2b5d94399f08f13aa86f1b8606
SHA512 d19489ffdc5fb3f389c5061f973753cc06c724475e90e91f60b8fbb4bb7b4ec3e546f5fcde1250a6f368d7da7e8582194463e846fa9a1ac1e6e5001a908e87ac
SSDEEP 98304:MQRQyi36YOcPhLvw2gAf+PN3LslgJTIZ5Bgp:TQyiKahX+PNbsT6p
TLSH
T15E666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f4967a0606b044a6c967bca078effc8575c568cfbc1e4588dd22a24ddfe0cf06
MD5 49dab7b6e4e571accde95e9014fe3f21
SHA1 2b24496207d7cfd77484c6ff8dffd99be54d5951
SHA512 4626f6f0cd0475fbfdf5755225b11674983b6bcbbf4a383a49baf398b78f1d7e88552b0bafe5b39bbbc48899ba505f34bf29adc9e84325b54337c9bc181187c4
SSDEEP 98304:MQRQyi36YOcPhLvw2gAf+PN3LslgJTIZ5Bgp:TQyiKahX+PNbsT6p
TLSH
T12F666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 78dea22366f0afad343ca8a81033cd52b26b5c6b22d8efb1a4b2822455135056
MD5 2c391e905ef96808c7612938b50c8fdb
SHA1 33ff6e0b518fd5abfed89faa25b716e5b7a6f1b9
SHA512 a59fad77ed20f5cff555cd4591a47cd0524952a65025bc44d4ffe09edd5a6809269e4bbecf7dd67d09b3160635f5b880321692cf66ff2e4fe050448ccc869a74
SSDEEP 49152:j68Qg55nhceWu7PNU3/hb5+Pl6bJTIZ5jdgp3:dthLRc/9slgJTIZ5Bgp
TLSH
T177B55A33B2F60099C44DE1769F4A872196E27C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 410672116977f7d0b27d1df9ecbcf42819f2bf5a4ad4fcd4e746feeb8c7762e9
MD5 d081075517df31b85fcd5add9088db07
SHA1 df32d61c0e855bafb3c7dd96e72575c8cda83b69
SHA512 eae40e8c15762da9b6e8ff4d2d89ed424440b713bd301a989e1ff16cd033851346f5b964a9c20f10a798b034a6900cebc0bfde0ecd12079e7c48195ac22f85bf
SSDEEP 98304:Ky5112gYy5azzVva69nLKnhZyslgJTIZ5Bgp:zLIHjWh4sT6p
TLSH
T1BB167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e699a9c2052da7a01de46bec8b1af667083a80e8a558c9699f23cadddf4a1fa6
MD5 7fb6be8598ceb9ad1e2aef578473b7e4
SHA1 ab53acfd37347e423a99ba6085b5dca31bae0b43
SHA512 bd0a4e1e9006981413eea5e126f80469d7910decf7b03cfff8c45ea0558afbeea9615cf49d5d2a75d310375d15e65df1035a97cc944aa184af6dda18b025da65
SSDEEP 49152:5B+taZ3usBWOBr4tEG20bqx0z+n217aau1glPb5+Pl6bJTIZ5jdgpo:vu6JmUxd2dzslgJTIZ5Bgp
TLSH
T1FCD59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 21226a431c0d6ab36985490ff080d5168b449df01f2eb0bf88e8e124947f5194
MD5 525aba2866ab76e23a18a8c9c2b4f9f3
SHA1 36c467831cc1d9caabe8cc0e8eedb3c333192685
SHA512 843a1f4c1437c93f573a0dd539b49e7259145b2baf361f28bb067f572a25ef40a2f21337bd5775e545996f765c9ff4cd15109982d66769c54158529de86b6238
SSDEEP 49152:V1hpsNoJpF1A6BU44CwH7R4xbb5+Pl6bJTIZ5jdgp5:VmifPkRgslgJTIZ5Bgp
TLSH
T16DB5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 86232f1b0e6a7216bb3d275a3a76caebc5fcb68b5ea76785dfbcae5c842dc132
MD5 6cdc4ad00134cacd9dca6d447f3d337d
SHA1 3375e842d3c64851f97c4fb77257151102912523
SHA512 5099bedf4f219eadff1b43fbd45e94629835cefefa9bcbd1367882219d338c42824312722318d41ceaf095c778fe151697f7ede0db3597ac3feea3ff04b49253
SSDEEP 49152:VSuZQIY0Be2KNRVtOnks6NMHq4b5+Pl6bJTIZ5jdgp/:75dKvi61WslgJTIZ5Bgp
TLSH
T1DDC5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 eea2c87a9f2ae9b1cdb90e629016720dd1860827eb14e22c6db0e09cec795461
MD5 221e8b5f511ae2e5780f903f33a0a55f
SHA1 79a9a8410e4eeff6fbac106634da4e75ec7c9d6d
SHA512 73fd0c13c0a4906e593f0d1417f909f6a105e32d929235eef62378ba3e10646fa702863137a69394d0a9c3d61eeb8e2764fd375f3a175f9a129041b51b845427
SSDEEP 49152:BhtSn8EApI0figXgiDn0AP5wfb5+Pl6bJTIZ5jdgpI:QX2iyphcslgJTIZ5Bgp
TLSH
T16295BE13F2D900E8D05ED178C7468632E962BC164B35B6EF0A90B6561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 9519845bbc7276efecf0d036cdf276d424d3ce136719ee366311dbc055078e7d
MD5 559f30d61940501a1de847ab0162d7dc
SHA1 93f2837f6bd93ddb497777d2c9929194a0d3f26a
SHA512 0e34898bf123d19c1dccd5d0194bc5b72c6b5a2f20fcc1b55b58effc9652d21adab3bb575fab9ae905c22f22f2ca48a46c2c15dcf373ac64e168052006ae2ffa
SSDEEP 24576:oBmb57GBiOl6a8JTth/RWZvR6wQQ92pN3d:Rb5+Pl6bJTIZ5jdgpr
TLSH
T11B6523824E6B20CAE09B5779D9C9DB00F87DAF96DE8727B6C57D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 f7b28ca73ad9ba7704802af579db087c84f5641bd00dc37371eeaba72142a263
MD5 a8119fa4312330c8e5a588693cba3557
SHA1 cb8a5bdc3a3827b5da6b56005a10898a6aa682b3
SHA512 6baff0acbcc18e98f99afdfe5bf46a0f5dde59e38d936d15960347321be5f47af0f2019402945913dc897b7e402a5b1f0a066e1fe98edd2d3535c34254fd95ee
SSDEEP 24576:76mb57GBiOl6a8JTth/RWZvR6wQQ92pN3d:xb5+Pl6bJTIZ5jdgpr
TLSH
T18B6523824E6B20C6E09B5779D9C9DB00F879AF57DE8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 82697d4bda51df6550ef69de9fed4d9f19feefe1a923f6995342b52511fff665
MD5 0c96f553a61af11354be6fd2e881ebfa
SHA1 5fd9944cb4c972e806d153f9ddde0710a69686c3
SHA512 33c64715e149a3b1e671d93d7f12e63db946623aca58dbfb4f392255ac780ca6c5be999b9659baa7660d86624e688ad2f9356332aade7f6f39572ff30cd64296
SSDEEP 24576:bEmb57GBiOl6a8JTth/RWZvR6wQQ92pN35:Xb5+Pl6bJTIZ5jdgpr
TLSH
T15A6523824E6B20CAE09B5779D9C9DB00F879AF97DE8727B6C57D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 fcf44a3268a9d54d85433f6f71583b65a8fe9c6d7e0303d3a154e7db4050d34c
MD5 0fbbd5484f88149c11fe34f4e23fafea
SHA1 4509f86de9bd5dbfa0d7ca8cb0641530aa053b88
SHA512 ff7247c9ebdaeee47d805d1965f18956bca9833d7e43e41400d465c08e661d1c3ef072752ee5f713adbe89c72d3b28c8791156b29cef97d23dba565799659a61
SSDEEP 24576:Tmb57GBiOl6a8JTth/RWZvR6wQQ92pN3x:qb5+Pl6bJTIZ5jdgpT
TLSH
T1166523424B6A20C6E4A79379C9D5D700F4B9BE96DF5267FFC675082BA9313883C3134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 bd419b020a95d201013baef53ee0755425405199ce89881f02163f4a9c774b8c
MD5 d1c034609ece54031802cd85a39ee8ea
SHA1 35e7c674cb07d85ab48a9951181f050129d2d31a
SHA512 b9c79999dfdbacf30cccb661455e79eb83eba9686c7cb2ee69259065686a82064632a977c4ba3e804fc03102a45e63b10236528b015cbe5962f323dc8f5c9556
SSDEEP 24576:p7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:gb5+Pl6bJTIZ5jdgp0
TLSH
T1406523828E6B20C6E09B5779D9C9DB00F879AF97DE8727B6C57D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 0909554ab20a7f0dde0212f6b55f0678a9a76a9cdc687500ebd4cf47e84151cb
MD5 6dda5be42aacd9d1ad1f0516c5e0b3e2
SHA1 e75e90b22a51039737d21ca1671f4875c485961e
SHA512 4d54891543fcb5c583caf30bad12b03987345e3016036b3ee106883adfe0c31e695425b004105e515536bfd30eb9fcdfaed9440eeb1918a393db9f461fa4456a
SSDEEP 24576:ZGmb57GBiOl6a8JTth/RWZvR6wQQ92pN37:Hb5+Pl6bJTIZ5jdgpJ
TLSH
T1D06523824E6B20CAE09B5779D9C9DB00F879AF97DE8727B6C57D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 21c657ae72aa703c987ee35be811a4c2f9be5da508b9da7d9f13fff7549225a5
MD5 b008fb9f90e1c8a9620ae2d0445bb488
SHA1 55cb9add1400e0b550c2bfb80600100fc706e1e3
SHA512 0555fcf31942872ff6bc6d339eb601a4c5ffac21708e0818be00c2b40d2d8023a3d1fc907b38c1d0aed76cd79355576fd5d7863a2ace9954ff33542ed8568427
SSDEEP 24576:9imb57GBiOl6a8JTth/RWZvR6wQQ92pN35:zb5+Pl6bJTIZ5jdgpv
TLSH
T1176523868E6B20C6E09B5779D9C8DB00F879AF97DD8727B6C67D0427F134789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 826698b3cba1d5875c68101fad54e94692278c408ebdcb003229d18a667e806c
MD5 b316be42bca7d6e1d1486d7a5ea88600
SHA1 79d7dc47fe354fbf443961b2731d64ba98a93d09
SHA512 dbb329b1b304d4ab4dfec71d92dd044f78456ed0d65581b616bc29c5818a43e6cb4d8d036fa8beaf7beedd3e9ca1c29d11145f76bb4c538b701d024035e85c0a
SSDEEP 24576:vZM/zFVSOamb57GBiOl6a8JTth/RWZvR6wQQ92pN3W:vZM/zfZb5+Pl6bJTIZ5jdgp0
TLSH
T176850295B39018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 67904ff82506fe4e78c63d7d9188973e29f04aeadd8312f46fd34404fbb71786
MD5 c6369af0441f540350b5f1469598e4e1
SHA1 34bea78c8b62c79d8fc266ea6be557fa2c111ee7
SHA512 fbbce6f37c7f30f479813f34200e643045fc36d95ace05f0e81f7e8af6aa1e0ed87b41ddc71827476ed9bf69e600fb81c462ea7436c2c347b912a99b5f76d39d
SSDEEP 24576:CFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3k:db5+Pl6bJTIZ5jdgp2
TLSH
T1F36523864A6B20C6E09B5739D9C9DB00F87DAF97DD8727B6C57D042BF134789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 bca1faab0cea3365ac0aea4ee49310666e7549b991c4bac8b52d19d19c71b044
MD5 e979ea13410df0b6e1f2d749e10be43b
SHA1 cdc11fb78e6d90c3410c39a276216ff9b4483de0
SHA512 3fad32e5ba8065350848dfa4f6c05a78f6417745af3a35cf883f44b15018b26b897a1360d799e19cc26d50739d8b9dbcc8381e0cd5d86171deae269e6e6187d1
SSDEEP 24576:u5mb57GBiOl6a8JTth/RWZvR6wQQ92pN37:Bb5+Pl6bJTIZ5jdgp9
TLSH
T1896523874A6B20CAE05B5779D9C9DB00F87DAF97DD8727B6C57D082BF130389381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 c061909d6ebc4f50a25278f542bb162e68f19a166d5aaf5ebe8d329433fdc974
MD5 eeab343cd2efb41ceedb35b742786cc3
SHA1 a69d6387032245fca5adf42409ee7ae449886139
SHA512 e8cffeaa7a3c2934f20810305ce64cc795ba27af18a20f888ab81aa1bbd49569d341be49ed1e2ffdb0ece908bf22450944c47b2b5548bc4939d5bef2d2bfb50b
SSDEEP 24576:kzyemb57GBiOl6a8JTth/RWZvR6wQQ92pN3z:kmb5+Pl6bJTIZ5jdgpR
TLSH
T13875024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 ebd957cedfdf311b5b11f70ae11defbcb25bed67e2056e85a4f3db96b5b32eb2
MD5 82961f297a861bba2fc45b62883da0f7
SHA1 0a8e0fc3f0b5551088830f3867c667a25b144140
SHA512 e8e196ae35dfc448811e3b73fb34849dabcf1104a3ed94545c05f225730dcca6f8ee3eb32518e9c8afc740e29890d64056d8132cd6ec91fcca15cf08398d587c
SSDEEP 24576:mFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3F:Zb5+Pl6bJTIZ5jdgpb
TLSH
T1F36523864A6B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D042BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 601d4adccf434482937ba353230888a010a2a7043a7c41346dda4cd10210165d
MD5 d549b2814c4efb42e38010f112923674
SHA1 bc4b1b230185721e46094a548568ca5ed873f822
SHA512 c642c709f0b1ce00f722faa159edc1ec367d92311db8d50200abd68edc217f282309d2f2e91181e4d094f407de30eb9247eb738c43bff53bc40cf0c87fa3b7ef
SSDEEP 24576:wFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3p:fb5+Pl6bJTIZ5jdgpb
TLSH
T1C06523864A6B20C6E09B5739D9C9DB00F87DAF97DD8727B6C57E042BF130789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 9cffe6d4fdfd2d01acefbdd5e5fe02ff967080d9a07f3ddbb3417241393ddb53
MD5 805b53fc80aa66bdf909222774e5780f
SHA1 0f44e2750d9199d761b8a09df9be7b74c70d6542
SHA512 f5689ffcdc682ad19501e4082aaddbd9bdf29716083d8f0f384fe6ea7758a56965bbb0b8942d16e8e1ca7c119e1b018bce379379479e39db8f3faa3e4dc7476b
SSDEEP 24576:Izyemb57GBiOl6a8JTth/RWZvR6wQQ92pN3L:Imb5+Pl6bJTIZ5jdgp5
TLSH
T11175024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 ef9fd713194256d9f7be5ecf31ccf006b2b6d760eaef88a2f88c74b5ec499322
MD5 f9f4bf33359b24ede28716ab6c92345e
SHA1 f0520f9524f986504fce55fedd8994d449a567c2
SHA512 a8f9a467ccafd893233cde182c22bbd66a70ebd1b1c5760d2857e3e366fecf48a100b4afe0804782a832a600285625eeea7f8a80aad30b0f2afe39b84d818aa5
SSDEEP 24576:dT0aLl3z0zD0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3l:dTDLljOb5+Pl6bJTIZ5jdgpr
TLSH
T185850295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 8a541cd853e4e7829e972a0a299df373fb2fc28eda46ad1908edf7e5ac4f725d
MD5 f783f48ed8a472bacbbd71bb76950b52
SHA1 47300bc3c7b2e9e773176a7d3781fd28a41cdc3a
SHA512 5d1f333958a36fcda2c81517db30d1df768f3b4cef12c38191f39d3732ea3bf3734a4c835e89fdcb1aaacb7d0ad3efdf2cf51c8d58072b1b3b21318919585f2a
SSDEEP 24576:+3Id9CHKy7GZgmb57GBiOl6a8JTth/RWZvR6wQQ92pN3/:AId9CHKyaZb5+Pl6bJTIZ5jdgpR
TLSH
T10095CF90F3E410E8F0B79A35CDA68611D9B67C5A5B21DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 c6793a358af5d40b16590823ed8a2bf2e6992d5013b8a0a6788183f344c141da
MD5 e07e24ca844b9cb74da72ba39a8b94d9
SHA1 d9b52bc488252a6302a4c360e94c010ec5be6521
SHA512 a64ee0a450849fcbe35637b65d00204ca32d2e5f376e9d44a8681791cb8680bac9059af98f9f69606bf759a7762c99bff0d86985aa7b2f96f03866647d54589d
SSDEEP 24576:7kmb57GBiOl6a8JTth/RWZvR6wQQ92pN3x:Xb5+Pl6bJTIZ5jdgpX
TLSH
T1B36523828E6B20C6E09B5779D9C9DB00F879AF97DD8727B6C57D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 34b4cdff7f451d2ceaf2da26dcb7402c553b6143353945fbe0b9c0b0a9e25212
MD5 a5595ce322fc81ee652d1fde70eb5ebf
SHA1 e257aea972243e6d3d9827a27d91b05adb4f5c27
SHA512 3757d823f7a036027e9fad23d7534dc88c1d2f79fb3ba9a40d488932529f10de95fe8458a89167260a95e912fdf170f285e194c3a17d9bffd36947a28fe9afed
SSDEEP 24576:h+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3Z:bb5+Pl6bJTIZ5jdgp/
TLSH
T1366523864E6B20CAE09B5779D9C9DB00F879BF56DD8727B6C67D0827F134789381220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 6dc34226efad7c90e38997cff9db0d68084dcece2307daef0cb3d3a365f66b8d
MD5 74e6600c13c891e8feb9ba64472279d3
SHA1 d93f945c7429549e01d1e5896c972b38e025826e
SHA512 0f70cfaf7590d75219187474534fc11b7365c51b8a1fb7ac28d6debdb045b76f044878dcb44934a4efe5a793eff960b12507b37e4636e09b32d2b45e3dceec69
SSDEEP 24576:P3mb57GBiOl6a8JTth/RWZvR6wQQ92pN37:ub5+Pl6bJTIZ5jdgpJ
TLSH
T1BD652386496B20C6E09B5739D9C9DB00F879BF97DD8727B6C57E082BF134789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 82bb7b3d28c33496bc4a0503c62bf69d0d703d24d6713e4429537441b82f25e4
MD5 dbbcda89c46d3abd7611ec137782bda8
SHA1 57ec109c3615621db3fb8e0468bf7726a5f968a6
SHA512 6698ed4ef70a04767679d2d271b287d567493aafccb511ae1b9fe5f92e390667c18611f86f26611e5750040f80c22e9bf67c2b68281242e1a648a45d2b90f28c
SSDEEP 24576:DFmb57GBiOl6a8JTth/RWZvR6wQQ92pN37:sb5+Pl6bJTIZ5jdgpJ
TLSH
T101652386496B20CAE09B5739D9C9DB00F87DAF97DD8727B6C57D082BF134789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 2d47677c99c01b3ec90d5f0afc4916a514fdaad78986e6dde1ba1f949e8fdb3c
MD5 e88dbf3dec4c7412033a18c279d0ede0
SHA1 0445045cb6a933ffdfaa9a3f72faad1014ca6020
SHA512 d1eb99e16962fbc0fcb86ec9f2a32d9005bb97219493e7e38d71e7ccba2024ecaeefe6226213fdc46ff6fa89db5232d06f16f8ef20c4712a258ba77a31ddf493
SSDEEP 24576:6kmb57GBiOl6a8JTth/RWZvR6wQQ92pN3L:ob5+Pl6bJTIZ5jdgpt
TLSH
T1B26523828D6B20CAE09B5779D9C9DB00F879AF97DD8727B6C57D042BF130789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 7bbdc93a2adb23244801b3c621c27f83f7e07d94ebff782e3034ffe4326d024c
MD5 578cde300da26798b53a134e4e1a86fa
SHA1 e1a9ee7f62b44ae7d33ce04ecee893ee2a42d08d
SHA512 d2a6c8a5114b8f171da04117e48a91df853e9f01124192dfca43aefec724c4258e2ef60587517c57ddb0ac06ecd82983c3b7596b78d61802857d45fb9dc914e8
SSDEEP 24576:Ltmb57GBiOl6a8JTth/RWZvR6wQQ92pN39:sb5+Pl6bJTIZ5jdgpn
TLSH
T1566523864D6B20CAE09B5779D9C9DB00F87DAF96DD8727B6C57E042BF134789381220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 1ad915558db19b3df817c43cf7bab31f0d0b0eefd359c4b149941814906544d4
MD5 bfd6204629c0d77b210ddc2675789092
SHA1 ffc69b2227adfd692394b14057c501b1845da9c5
SHA512 e1a62ae2dd1a1793a213eb72ab0a18b0901051ddbf29763392907ac0a964a0d4d27ebcd1b64ef3f1580dd754bd775907b9d860e665312f147806169826ffd504
SSDEEP 24576:t7mb57GBiOl6a8JTth/RWZvR6wQQ92pN34:cb5+Pl6bJTIZ5jdgpi
TLSH
T1AB6523828D6B20C6E09B5779D9C9DB00F879AF97DE8727B6C57D042BF130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 27e5e8241f168a6be75d59ffd0a4a8ca6b3ad9859daa2dff90b3f9c2f2514fe3
MD5 6c8d02537aaf848801841dd8689bc0dd
SHA1 24f8304f7135ac3cde493165ab31d30fdc727ef5
SHA512 35abe142cad6c35a0fd7afdde66eef3f966aac41ac27734b4fc1ee7fa474613eb76626005ff7de6435c4bca25c42889c081c336174769152fe7d171fb43bccda
SSDEEP 24576:zfwvik9RX6wkyAIJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3c:3MnYIEb5+Pl6bJTIZ5jdgp2
TLSH
T19A95CF29EBDC04D5E0B7923C99E7460AF6B178595B31C6CF02AA536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 333b846cd30767ba1babba3c961d2a58d14c648c127d86a996dd90cfe7ca6f3c
MD5 27f00f944ced60ced04f1ad9dd7f86e9
SHA1 d846cf1e8a27074346ac129177fa7e8d8f6e1ab3
SHA512 97ed8d3192cce65830c8ada56742f474d7f10763e258d3b47637db5eeb3fb4a39b38721b4a3be7d1543901b49d168eff8d620f73e2ad244db02fded9ef032afc
SSDEEP 49152:iYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0/b5+Pl6bJTIZm:eySzPrslgJTIZ5Bgp
TLSH
T1A6066C96A16801D5C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5b7e475c75e657757e9a067b0774b2bd2ec74c0a440a3309f9af2ea28ac29d0a
MD5 7e3dd7d164a0eecbafffff308603c3f7
SHA1 a5dd9b675dec807c4fed7ce084facd345f37433b
SHA512 445de83ccab1d0bd9c0f4051ad4f714e9e3d6a2eecbf0ad67970d3d741b9d80c36c81f92369fc06a4240fc42a619649034a841c413f0b5e8f4ba949462a7d601
SSDEEP 24576:l47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYqmb57GBiOl6a8JTth/RWZvR6wQQ92Y:l47JUQj4irIhCnDHUPfF/Pb5+Pl6bJTc
TLSH
T10565AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 402540d13b42d24c3d48c6d211abbb79450f3be252b4d8d2738758075b133b78
MD5 55b0d7f42baaf6ff0ec7cc809c054936
SHA1 e16f39a28887def7bc0e1c5d7da26e5a4fe97a22
SHA512 bd59178a60182fb80df5e1ad9a9616c81a948941fbdb2b179a82a29008077d1e6693b8ca53f2d970b80ff2bd127d482ebe150bfd19815b379c4b9f8f60519f1c
SSDEEP 24576:H1mb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:Yb5+Pl6bJTIZ5jdgp5
TLSH
T17775F14AC29811D8D06F6279CB858A00F7777D658BE193DB86E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 b7d529a8a4dc588d8c8c6c970128048469f53463246bbd51dbced8bec2e3de7f
MD5 e36d3259ca1c0f97beb487150c61f829
SHA1 a0b8eaa21218a9b5be8855d473ca097372561ed8
SHA512 a320ee50e0c425b37f9c55b7f579b2596163b7322f5abccaf387f79270ba2de58c97bb8396a476c0bcadfd6c10da0f10072c9cbb9d835b1f7d445ee54c34c785
SSDEEP 12288:GGMzhU3fjejgqBJSQ3JrPLONt/HyZdOSVuowSPVH1rJQ:GGMdUPjefTNzOL/HCdjVuowWVH1lQ
TLSH
T1EF5528007626CB8FC66A40325E36D6CCA770BD15FE446F1773C9873F9476658BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 e1a7f28b3caa79cc18c571ec4ba69420baaabfdcead0faf46230562d74c3905b
MD5 dcda6211ade0ead6def41cf7e6e2e42b
SHA1 daf055137eed07b32716bb24ec33ea10e0fbb175
SHA512 282bb1dd53b9cd8338d274e4ce4b2706a901b49f7b203a901c74a9afb1bc517ab5b2cd26aeda9d61f42f41797aafe8b8ac7d4c85d0f46c99a5bc9d56d126cf1a
SSDEEP 12288:urKRjCcIFBAQWcFFkRJD55u0sXpGlZyS80xQgQh/wg5UqNCfkWT:8+jiFo9zNogz5uKT
TLSH
T1C7551A0065B7EB4FC97A4037433296CEBB746C06B7893F0573468938986796EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 87bc4a644e7d35fae4d5c089e1b7b8acdbb804d7166b7110c811fd7462bcc905
MD5 973d283fe122c33a6c98d0a21007743c
SHA1 dcee9db54cfb32a35b75d194d3214e5a89fbc71b
SHA512 bf9b7c14e00231f557f003701897466c8573cd82359958f9ae146eb7099f9300bc4b7d735ad99c62486120474cd519e3a17e54161dd47e274576ce596ea52914
SSDEEP 24576:Vdmb57GBiOl6a8JTth/RWZvR6wQQ92pN3f:Vgb5+Pl6bJTIZ5jdgpF
TLSH
T1696522428A6A6086E4BB5778D8CDD710B83EBF65CF8566E7C529142AF1307C97C7230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7563d967d37603c30949d035e13e29c71dc17115d43b61405999952ed134a006
MD5 8493bd88bd8d58c0c6bbb2b235d67036
SHA1 3f9cee260e53daabd4f49a41a41947c19680a7ea
SHA512 14a24f059ca6466003bcfcf95178ace8f20487d41df1de5513c78470e292fad1900642bc1387f44ebccff43273336b8b33a41b38c5174db99999ed0f6b213ea7
SSDEEP 24576:cgb6bmBIi49WNNFpg1rSvFv7bYPmb57GBiOl6a8JTth/RWZvR6wQQ92pN36:cgb4mBIBhGFVb5+Pl6bJTIZ5jdgpQ
TLSH
T1D6659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 9697c670b0aa59016aa5519cf5bff945ee0301343d5c5f158ba58a7819e65a18
MD5 2ea5a67c562f4ae6918badd3d52bf093
SHA1 11f15647d697700eb63b7584a2249ac8a895de00
SHA512 ffa6d8c7800b0e8a81eb3e008e3d89afe2991c25695c63a974a9aeaa707a948b42f6b363d409adbee022f6825478f712b44617b2e3d1642ab6274e6f0b07b214
SSDEEP 24576:9G88u8FpJqH1jzria7/mamb57GBiOl6a8JTth/RWZvR6wQQ92pN38:Q7ZFPqV2a7/Wb5+Pl6bJTIZ5jdgpW
TLSH
T16095F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 914e3fdb8bf9290be0dbd17acc4aac8e8b0ae83af2ca0896c4c7f3f5ca9eb6b8
MD5 59871fa210023c5a73f06076069581b3
SHA1 8109c879b92466193f198c851624efa3e889e0e4
SHA512 ad0f6e82a8fdbb33ae24c098280c7e9384f79f53601100a0d52ff3ae3e38cdddf7c1aeef4a1f24883c639e284ebcdeb3473fb810b1f2ce691edcb2d881c26947
SSDEEP 24576:JPUr+NQWmb57GBiOl6a8JTth/RWZvR6wQQ92pN3M:JJQZb5+Pl6bJTIZ5jdgpG
TLSH
T19975E11F26AD18D5E67AA17DC9C68709F771B8624712A2DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1baa944edab998c043019810524933cc7c2ca9c86cadc6babbddbe017785bbaa
MD5 827dd438c298f7babd894c85278fc549
SHA1 52f6f76c92014aaef76f3862a6482016e99f1bb4
SHA512 7643db959fa48d62b60b0ac3906feb8f8a1e3ffdba319d00630a0bf35f3e928e7a6a3c91920ede2a1574560424a6cb2add05a30dcf32c895c225fe64df28af1c
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJb5+Pl6bJTIZ5jdgG:GG05lO43bKslgJTIZ5Bgp
TLSH
T126D5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9e670fca76c5ef2bd1aea2d25d6da344ed8fbcd42203b3e651c92ae2f3a3f508
MD5 202c14d1d5b27c80c176d386fb100000
SHA1 55435fc4924d56e7674e320050e016e838636378
SHA512 26253659de5adae4801cb19a0bc2ae00bbc6873d1a1575fac4eaef48521799866061340d7d699040c7a511532abc944a4c11ab75155f1be02bc951f7d94986fa
SSDEEP 24576:Bfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnImb57GBiOl6a8JTth/RWZvR6wQQg:Ba5POZ39Jt2pasx2+mhb5+Pl6bJTIZ5G
TLSH
T1CC65AF5EA6FC01D5D1B9D17DC583861AF5B1342653329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 143a18f808c8acf52d51ce2d34932c52d0f8115bc8d5a0a2e44a1dd0592ed7d9
MD5 69378ce36425b65d8c3b17cc8e3ba39f
SHA1 6cfa2ee469a25b54aead7e948f70cb153a9a43c6
SHA512 8c3736739feb2094faaf867f32f2c2b8f1a14e4031636422f04c740db5eb751e7bbcd34d4f0c239ef9d9bf643144f89d699fc30d8c1c967a579c9a9a8d092c42
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7FkSmb57GBiOl6a8JTth/RWZvR6wQQ92pN38:JNc/zEOVHF2b5+Pl6bJTIZ5jdgpu
TLSH
T122858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c8c6fd6b1732075c820d254a5da3a718d4a0eea9e721d2dc2fff1ac12900934a
MD5 96eca9f4e1601f7d31c4ef50060ffb91
SHA1 3a56231c81b57de6c5581aafd55fc3cab2268d0c
SHA512 edf821ae267c05358da85e528027f6697ab31eaf807c7b7256c3ea3421480b5725ba65f20cc1dcd862793ab6d4fd6a5e298dc53295aa8d804a70f66338383472
SSDEEP 24576:mtkNvNnaFeYhJNtmZBm8mb57GBiOl6a8JTth/RWZvR6wQQ92pN3N:mtMwBtOmLb5+Pl6bJTIZ5jdgpn
TLSH
T18255AF6EAAB805E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 681830997568cf6c018dde07caef7461714f5c9a7972b8182c27a28d19a1d249
MD5 1461c6c4daed6ddf56026024ceb7d43e
SHA1 5949acad3ceacddbde9bae34a33ab8c74ecc080a
SHA512 a5cc1fbf798ec20c5a1f814233b9f2d4ceb780b11d0f64c0148c9157adc7bf8f844f88287a1d3e214e5829fa5cdbde469835bb853b204e2c5f53ac9509eb3979
SSDEEP 24576:GD3FHshBIYQgAhmb57GBiOl6a8JTth/RWZvR6wQQ92pN3i:GDVHeBIAA8b5+Pl6bJTIZ5jdgpU
TLSH
T11185E17ED65D00E4E47BD27CDA938A06F67138A9472266DB02D481BA5F2BFD43D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/764-104-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/764-304-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/764-102-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/764-110-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/884-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/884-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/884-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/884-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/884-156-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2356-86-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2356-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2356-302-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2356-92-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2356-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2604-45-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2604-39-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2604-299-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2604-49-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/3024-132-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3024-305-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3024-131-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3024-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3624-100-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3624-58-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3624-52-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3872-1-0x00000000021C0000-0x0000000002220000-memory.dmp

Download

memory/3872-7-0x00000000021C0000-0x0000000002220000-memory.dmp

Download

memory/3872-8-0x00000000021C0000-0x0000000002220000-memory.dmp

Download

memory/3872-130-0x0000000140000000-0x000000014018F000-memory.dmp

Download

memory/3872-0-0x0000000140000000-0x000000014018F000-memory.dmp

Download

memory/4648-97-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/4840-284-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4840-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4840-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4840-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4840-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5024-69-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5024-63-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5024-96-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/5572-300-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5572-75-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5572-81-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5572-316-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5572-318-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5572-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5968-114-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5968-115-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5968-123-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5968-121-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5968-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download