38918e827b5f5ae80a3c856b9fd6e2d37de04dfc16d3a75b58ff021b53fb8b2d

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.2MB
Sample260926-tkl7daxbkd
SHA256 38918e827b5f5ae80a3c856b9fd6e2d37de04dfc16d3a75b58ff021b53fb8b2d
MD5 b78c1281c06e3912601d6096f967412d
SHA1 efd09629ca3e049d8c96678a99f138965cfada89
SHA512 3b7402bc24233ebfe0bfb67852ac5cce372b8a7ca063fca0578679585e6aee52468d2d393cd95355b486cd53d3a5e9f000072c9535866d1ec7addc1682d1f2a6
SSDEEP 49152:5Gtlq0/VwASOTBIU6i0aGCHceZo4pMPKJi1oYaitV2TXa2nU3O97d6UPBX/v9mSu:e2+V+4i1oYKKiAOxPAa9IblmiIS9Z
TLSH
T182268D56A65901FCD5B7D138C6CA5623E7B17C1603B18BCB02E0BA661F33AE16E3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1088	elevation_service.exe
4420	elevation_service.exe
2552	maintenanceservice.exe
2736	OSE.EXE
4068	PerceptionSimulationService.exe
1996	perfhost.exe
4052	ReFsDedupSvc.exe
5052	SensorDataService.exe
2732	ssh-agent.exe
580	AgentService.exe
3272	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
	\??\F:\	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\99ae6f1925f2ba71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105218\java.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008021f260d14ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000bcb48024d14ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e607622d14ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4dd7a24d14ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084be0125d14ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d147b625d14ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee6fcc60d14ddd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1088	elevation_service.exe
1088	elevation_service.exe
1088	elevation_service.exe
1088	elevation_service.exe
1088	elevation_service.exe
1088	elevation_service.exe
1088	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe
4420	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2104	2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeBackupPrivilege	4052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4052	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	580	AgentService.exe
Token: 33	3272	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3272	SearchIndexer.exe
Token: SeDebugPrivilege	1088	elevation_service.exe
Token: SeDebugPrivilege	4420	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 2520	3272	SearchIndexer.exe	100
PID 3272 wrote to memory of 3532	3272	SearchIndexer.exe	101
PID 3272 wrote to memory of 4240	3272	SearchIndexer.exe	102
PID 3272 wrote to memory of 1680	3272	SearchIndexer.exe	103
PID 3272 wrote to memory of 5212	3272	SearchIndexer.exe	107
PID 3272 wrote to memory of 804	3272	SearchIndexer.exe	108
PID 3272 wrote to memory of 4220	3272	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2552

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2736

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4068

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1996

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5052

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2732

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:580

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2520
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4240
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1680
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5212
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 009369612d68606fc730be48a2e2f62332a52e703332add04627febe845a1134
MD5 d8de6fac5973c967d3ed3ee3d1545774
SHA1 15e53d22e1e1894ed2252faa4b180748252b62af
SHA512 59c862b71076fed3192ce5f5cfe27af70b548997b44bd97ce5399a0e59a3140bfc352f82615adec76e9b657ac1687fa423ff2c7d084a2a8820f1061d0f4f3215
SSDEEP 49152:Pb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnEcImA7tTtF9aD9Vb:N3q60jBQIS9Z
TLSH
T12CD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 ea962c67e92044a105ad832ea54c1b27ad55d260fc918acb9c99363534cc9e66
MD5 8bcca1cd99935cd0c15cce3ba77c7d9c
SHA1 180ab8ace621d0a468cd389079a41caf122184cb
SHA512 d764c8a563692881bcc3eb0c87ce661fbd7c6c253d2ceabf51613bfe3831be91b5a98644e00d877afee4ba5879bd194890fdb616b53c2c705d08efc4eaead0ab
SSDEEP 24576:0XYfDtczAn6jg20TmA7eE3J9oMtFL5GxDGwVb/:ztcWcImA7tTtF9aD9Vb
TLSH
T1F485F129B79408F9ED6B823CC9E28505EA73BC554B60E78B03A4D6251F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 06f51b5c6b38ea9941cb1d3592a10e949485f9af180c0f460b5240a3a9f74a13
MD5 1bce3c72e02bd08daf242e377dcd9425
SHA1 0e4f67273ccd5542683e263b74f8c7c4a11648b2
SHA512 106dd2ac90c35c7e28add5b8870af30964700cca647fb26ae740182f39ec02c2cdbd2164357cfd5ec5c2e6add120a69a18f695df991e77448a98160b21cff568
SSDEEP 24576:L0Le5ji0hmxIrMc6jg20TmA7eE3J9oMtFL5GxDGwVb/:LPji0Au9cImA7tTtF9aD9Vb
TLSH
T1D7A59D26F6748731D073C0B9C5D2A68AE97230865B308ACB4286D77C7F677E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 de912436bc1cadbebf2150291553fa8871d8f437d2d62bb3e8a1f051ed044951
MD5 de769db216130773f233fe82c8523f17
SHA1 83128828cb24804c8807e5d97db65cba82f89852
SHA512 0390764e7659b70f859311ff1c418946ca2ec58b5281ed8030f2c23c57365755032d09bf591bf48cfd1a4fd9307c8325ae76d5b8b07289f5e96cb775c4af53c5
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWr6q8wyum6jg20TmA7eE3J9oMtFL5GxDGwVb/:o/ezSC6vUzPviHjyhcImA7tTtF9aD9Vb
TLSH
T105755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7bc43f1f877c41c0be4124ce17e94cedfdf038f05c302618391f40ac8ce1bd62
MD5 cdb5d85e1b4ef454f1e6d1c49095149f
SHA1 a12012386e2c177a70eed5fa95402f93b3b82495
SHA512 5a9eb2c69fd096f1ca276fa0f8ffdee5df1b8daa52ba201dde8312a35a178378cbe7504d3d640dc9b5a3fe359075f2761b575a1e72de816388f7121061f29530
SSDEEP 24576:oVbqPb88hv/l+bj6jg20TmA7eE3J9oMtFL5GxDGwVb/:oVO88hXl+PcImA7tTtF9aD9Vb
TLSH
T18A55AE66F5748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 e2c2c5fcb9dc0ae6381897af09ccd3fe2f4fb1b644f6af6b218fd634b1cc9b29
MD5 9ab56ca4928e93d294f675a2f8244c17
SHA1 79543aa14a86d85b3129566a3cafff9a531db3fb
SHA512 b3b7483284743978e07ef9255c74ce76d3948e37ade4250f26b3ecbb3a60293be66b73137db3b1b16e97dfde509cd5204b606fbeb8c3b549f667ceeb673712a4
SSDEEP 12288:bhUb1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGa:bho6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T1B16523A7F60858D3E3FD833082E559C9EAADED688D75520ADB02F3057272345ECB0B45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 8f0ce5f5211a342198154895d3a936671ecb964a83ba10b09897466746d6ee14
MD5 dbb0f69ecca98c75167f1a9a780f09f8
SHA1 1175587bb4fd803afc02a56e15faf339bc52d792
SHA512 ec2d6727f6a1955c9765981490e0169371b58a2a2aaeae44b024ff6d662dba0156cf66fc993d992ff1af1fb23c7e44cd642851abe00ea1b7d207aa6fe07546f0
SSDEEP 24576:7JIU76jg20TmA7eE3J9oMtFL5GxDGwVb/:7JIU7cImA7tTtF9aD9Vb
TLSH
T1DD85CF3BEE28ECD2C27E8DB856918640E77678304F62A3CBD165C30E9E236E15D75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c993d63b7935aa2ec3dd2c55921020ab32202afbbb65dacebf73a562c6b862a9
MD5 990a22f4a28c0c230c2cf65ecba22b77
SHA1 9a7a41e7d641694ff002f214a0646a6c3101dbe9
SHA512 abe15ea92936b18710a3aea8867d9ea4c108944aa8bede54d8fb75967da8e8f11a4a663fe95b67e95817c52878c4d5b9f6b7212425c5879db3dad2924778b9e4
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THO:QQvGAdlCEL8c/RRNw5CjIS9Z
TLSH
T16C266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 7c384143cc5dfb34917b25fcd353c6d2f66c759a35c304bf49475db520c3a42c
MD5 a7b4f628fb0a8796110c6b7766c6e7a6
SHA1 77f632987ab66406e3329238bd516734f86af603
SHA512 b6776f5c2b564ee0ebfed963fde545f100f64be480c79aae0e19ad0ff57a832c5f3c1b0e3093c95b1c159423ff5d0bcef25ffaf8817e1a0d335cceec4d84da5c
SSDEEP 24576:a9ewsAjN6jg20TmA7eE3J9oMtFL5GxDGwVb/:qljNcImA7tTtF9aD9Vb
TLSH
T15A95E031FE74E432C3BF0DB21B65C706586DB9204F611AC3E3A89A9E59702D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b1c5f2d5504bf6ee465a0c2219be371a3028004afee2c422d058abcaa3bded13
MD5 3fbfc8fd3e1e7612d6f4a08b71d4724a
SHA1 0b6124ae3fee65c26325dca9ba2eae8de27000b0
SHA512 eb0cf97e0f61eb4b08b8e6a97ef55609725495301b561bf3142a1643f182cd6fcae493beb2b842721f473d07c320da25083f52c2f872644e0a3ecd47899cb25a
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH2:lUEtQevvqc2W1cpV2RI32
TLSH
T197474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d6fbf697b8ea93ffda58b686eaa9a6194a890cdac3dff416e6cfb5ccd3a1dc01
MD5 566ecfc06dc8a1356f130ae1f1eb19dc
SHA1 368df87cfef787ab3aeb7babdc435a6c8c8cbabf
SHA512 d4533c97b3fc2e5ac1dd4fbc7ba104a916b8c2cd4ba6a6a721c60f78df7118c64c0ffb987f1b8c16df86ad5b4dc4158ef42e2bf3a87269a88df78a5a678f6d9d
SSDEEP 49152:qCbRquA/m2yL5zTfFiV+XenmE3/ztcImA7tTtF9aD9Vb:foquVjnmPIS9Z
TLSH
T12BD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e6f1c5447804f4eddcf71daf97d43e5a4541c8a9fa6cbdb4889b0ec564a4df89
MD5 4134741a58f1838c48d489942ad14983
SHA1 7b46f65eaf65233138a4d7de0a7c1caf15d9b2f1
SHA512 590d0b8d0d749f5656c616ff6ba5f4b858175c3d4efa74b6b5acedeed8f10fee7166eb7a7d10bdb3ad76e15d7f5c5b978572a7036ac888c861cee6e29a4e9bba
SSDEEP 24576:XAhGL2IFoiwtA5l7S53K6jg20TmA7eE3J9oMtFL5GxDGwVb/:XAM1Foiq56cImA7tTtF9aD9Vb
TLSH
T15135AD81E7F945D4F5B3AB7899B68570EA76BCAA5E31C20F2150D21F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 53a63ca784d63128af6177aa2ab382d83bddd9e45a60bbf0167b56a55967090e
MD5 0f073224f7e77e9ad40be9978470623a
SHA1 affaf09880105b7d56cf3156c5e5e92f335f9040
SHA512 3a38af156838f8b37de947da9351568ba9e848d771ba356a7dcc2f5bd493158fb2b73fb1bfb83f89b6c6174e4a9c761ccc137ae6b11d4e8b2675ddb86e47026d
SSDEEP 24576:nwuVOWB6jg20TmA7eE3J9oMtFL5GxDGwVb/:nw6OecImA7tTtF9aD9Vb
TLSH
T14D85F14676980CF9E6AB823885978536F7F2BC112A21D71F5760C35B6F33361AD39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 ee6d8e68c3359647a17e787d2498ab67ba95add9987f29f4f6c5484061a70cb2
MD5 5e8a9d3f75b092ee4f630ee84feeed10
SHA1 dc6c4fce2f4b28b5ff1797d24005f89cc3ef0691
SHA512 29bfb092a458e3c2edeebc134c2344e8018dcab67e13baa4b094880817a6eff1e798b9bccad55a805ab3e040d6d6cd197890a9dc462b604747fa1f830d301008
SSDEEP 24576:qZuU6jg20TmA7eE3J9oMtFL5GxDGwVb/:scImA7tTtF9aD9Vb
TLSH
T19075129B329820F6E2AB8338C5E14A89D7B6BC665B3543CF5711936A2F337C15D34B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7ee348bd7f8b4b1e902a46371954c06d6b3a9e64709f50fbc00812a93cd515f7
MD5 e605ee36f32bf97d7de0837526c6a189
SHA1 4c6f03d71e5cdb5424428986b8db710ab0ff58f1
SHA512 25e20a4fb07aea6d35099323e97418f359a37d8e9cd67905778a7afc8462851150238b6d3aeaa9092989092825070498692e3bc89271fd9211649e0a72615be1
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uy:YQRQyi36YOcPhLvw2gAf+PN3UIS9Z
TLSH
T150667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a001586917d654af33b426ffc2a32496a5f2edd00be3978bd80ceaa1bb49883e
MD5 9b7f685a37b1cccf0bc81a5bf7bfee9f
SHA1 86170a61bcb85d441845b14539862bca08cd85ff
SHA512 263b26ef699ef6ddd4c40d6dbf477c84c04f00c730a91aaa326cd3292fdb4ffaeb5d5266c1945917d11a3f82e5accc0b45e0a7b0edda2046cea8a838271180d3
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uy:cQRQyi36YOcPhLvw2gAf+PN3UIS9Z
TLSH
T119667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a554de90b0bd63b3edeb40d5458d933f5c2a6c08439e366c6595ab4cfaa357e4
MD5 da48de47cafd240aa10426a46b7b58cf
SHA1 1794e9b8eb62a21186884f5a1f415fc1a57315d7
SHA512 3eefba1ed2e1682d01dfafdbc66514b0c8cca27971fb8d7ff993f4d9bbc6353cfcedb0616d8c1c775d0ef147a1af4bd40b2de915e41cbfb791e4ccc72991b2ed
SSDEEP 49152:u68Qg55nhceWu7PNU3/9cImA7tTtF9aD9Vb:8thLRc/mIS9Z
TLSH
T106B55933B2F600A9C44DE1769F4A872196D27C75CFE1E3DB850172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 23bf5d173c7ca22a9727371ca7f5f5574d94ce9e89ca73aa91c25f02ca2e743b
MD5 6170a7aa0d8ad920cea7b3be45c1855d
SHA1 b839e5b9e2513c4fd7860e1327afe3033cab03fa
SHA512 d0955bcdd9e30391097091c73cb5bde57969a1068f7073664e91d4cc8d4f8ca5685f3eecc176ff6532b5ca3d7e7f8a5513d8d265c975942ff1ea767b571a4186
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99M:Dy5112gYy5azzVva69nLKnhZxIS9Z
TLSH
T1FE167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 362173b1b887d618bc42360148ff847e484dd99f4ab5799396c41e75ec9f1dfe
MD5 7df4b63957065251dd98d79d99593be2
SHA1 88bf76914cee28c6c7b97e338a64c89f66c5c230
SHA512 864892d81252fffbfc4a7bb8b75ef00a2a1d72e051823ccd5db9b1c5affa2bc34eea27fa22221e34ed135001745d1aa0787de9418970ea6122c716a5f3c334f0
SSDEEP 49152:0B+taZ3usBWOBr4tEG20bqx0z+n217aau1glXcImA7tTtF9aD9Vb:uu6JmUxd2dMIS9Z
TLSH
T14ED59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e8535a117b3f24a3ff22442f68dd2cbcd9fa122c78926a0f8ea19e84954af5b5
MD5 6244588337941de75285deb7ded46e98
SHA1 9e2f29bdf0067750c3c5e8231c986602e374dd0e
SHA512 402ecbfbbdada228ba92fd41730c685a4c0a402a13910fbd1ec1f32d53ac23f04280dd1950759df79c1c8ee8ffd2b43c94a64d4a4189bb22af4818895d2368c1
SSDEEP 49152:i1hpsNoJpF1A6BU44CwH7R4xbcImA7tTtF9aD9Vb:imifPkRPIS9Z
TLSH
T1D5B5BE13F29900E8D06DD17887569632EA62BC460B34B6DF0A90B7962F7BBE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0e60baa1b8ca35caf2a24fe4dcbdf734859b2eae89879d418511307d1fc2b0df
MD5 5bce1455232120c93f4ad66f0be3ab34
SHA1 4c4ef790a85aaef0f681bbbb9659a850f30ce483
SHA512 b693dcb9944bec102a34a95777e339397f378051013edd00681886e59260c39c32ae50a12bf432c515cc4d764667634455c1b7eef4fefe9e45805e1de637f37f
SSDEEP 49152:HSuZQIY0Be2KNRVtOnks6NMHqUcImA7tTtF9aD9Vb:d5dKvi61VIS9Z
TLSH
T1F4C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c785f541d17028698927e0bbf5b2916b06f34ed4c8dfc593d3f2d6bfb95a38f0
MD5 6e1f994a58a1ca49e3e498eccb824f97
SHA1 d52dfb998e008df34ac22bc0f30e4b548484ed5e
SHA512 b8322d84670f5e3b92604725484d69972edc09d19c74eb4c53f52d5e065d90787cfba315e6058d854bef7e6afaa8833d7923d3b63f5c484c66c048aea1d38a17
SSDEEP 49152:ShtSn8EApI0figXgiDn0AP5wncImA7tTtF9aD9Vb:TX2iyphrIS9Z
TLSH
T16C95BE13F2D900E8D06ED178C7468632EA62BC160B35A6EF0A50B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 744af9cce6a3d055b847c263be24dcc725ce6cb76bc659545e345e3097d64889
MD5 1b914f9b36cdff2e00b5e62407df6f17
SHA1 b8c1df3098880fc5a38dfe93ab22342efccc5599
SHA512 75c7a41569936c5b2a902ee543ba7a89eed32fbd0de71a507cc441994b0a10ad4342c82ee54d5c9cd6e15888930055b41fe9d2f7142096290a6028c1388651df
SSDEEP 12288:IMb1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGc:Ig6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T119652397F40949D7E3ACC37082E149C8DA9DED6DEE75524AEB02F30573B235568B0E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 9a98146fe7c9076b0e61cf53b7c55614cd0859bb7c83c8bb34157639abfa51c0
MD5 5fada13499705f89ad0f80af90a67771
SHA1 7350422a53481e39224bf0c2155a19828fcf1b3c
SHA512 11788174a03bebb021f9f5927fc23b5c3312159071dc6c7155f48740b6751f4744e4201ae13bd0258733102a66f49c12ec6b88ea8caaf91b736dd5b73a831d51
SSDEEP 12288:Qfb1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGc:Qp6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T11C652367F40909D3D3ACD37082E149C8DA9DED6EEE75524AEB02F30573B235568B0E98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 c61fdd8343a16c49415cf113dd15e08e816e78976eb9e26eae003ac8424c9294
MD5 178ee147970fb484c3a51e3f4fbbe447
SHA1 0fb01d9f97125b5a5ccb364143ae0f592c0bb767
SHA512 abf13b87ecdcc3739e0bd8fa21b59cc9d8ea3f877df6f944f81dc5d5db15403dedbf380a243deb899f219dbbf74f27e3f2cc75eac15113beea8056f54ebddb2b
SSDEEP 12288:RZb1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGg:RT6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T1F9652397F80D49D7D3ACC37082E149C8D99DED6EEE75524AEB02F20573B235568B0E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 92db1f6d3eb222f2a93d9532f3190d376776380171fdcf96f9d8d2e44f4ae991
MD5 27b1ea282845878af05abed8ccc5187c
SHA1 24fb62ae313160b6a96b87bce547a2c6a0caad49
SHA512 51922988a4a950eacc1baae72baa60c54544736bdc17f1abc2d41cde7ee2db028926c57bae899d3b0897d46d30897c06d14bb3714a382a2411de3fa8a97f09cc
SSDEEP 12288:IVGb1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGv:z6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T136752257B60905D3D6BDD334C2E14589EAADFCA99F32538FEB01A2062B723946C70F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 90259eb49051be2a52c5233371008b601343215184161bcbdb9c23da3392846b
MD5 2dd6c6e1046dd84eb212d3e0ea3e213c
SHA1 e0236a0bf8e46d9738ec99152306ebd820d801c5
SHA512 899ab0776204707d3129367ec1ab9fc3ca8d603c59db89389618eb2b9fdefe939882ebc267e3c0c81012fad4b441059d3f5d1a4e954568893ceb456a2b230860
SSDEEP 12288:dOb1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUG2:dy6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T11A652357F80D49D3D3ACC37082E149C8DA9DED6EEE65524AEB02F31573B235568B0E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 08c6e5ce8b83e018d9b8bc1170ef662e40f284190630ab9bda81c51668ac9866
MD5 d118e6751af0a2a55df88961e938818b
SHA1 bd78cadf15d945d4fc80b6f6dd8e8ba93074741b
SHA512 f6d1a9cb56be4c7695ce009800990a939a0532bc12dff20cdfb2cad864470998b3ac09af1b7d967e4c1d02a6a8086848cd10e956c44c08a34e1fde96e04b4ae8
SSDEEP 12288:97b1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUG2:9l6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T18E652357B80909D3D3ACD37082E149C8DA9DED6EEE75524AEB02F30573B235568B0E98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 e81ab36c5ba0dc04f1f77f3fd5caa980fb15b40fe323520a96be3652b80d3220
MD5 e9111d36da04ff7bbf19b2763e8536be
SHA1 e1126b8f5d4dfda1852e9ebff234eed5445f4cf0
SHA512 65e55e20255d6f6ec4fc03f6f93403629e428ae2a562a41304fae46534f870171074cfdcf0a1cc65c552fdde5f91025bb4e7cd6a086d44f8f541b55fde5b60c0
SSDEEP 12288:xHb1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGJ:xx6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T1B465236BF80909D7D3ACC37082D049C8DA9DED6DEE75524AEB02F31573B235568B0E98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 e817ddaea1c4edecab04db68b5021641fe8ae3b2e0a9758534a6e459c1559f4b
MD5 28121802f4d664f55c52e49a88a76039
SHA1 57a8230c9c18a32ef2a49d2e802e0026671f9805
SHA512 75b6797be4479408e4f54cbe7e454f8e526ca249b00b09d44f6cddad3125d1d64d68975a88d157a2ede5a5286f3a01baf8aaacbe6fbc5445f8dd7454817192b5
SSDEEP 24576:3ZM9zFVSOJ6jg20TmA7eE3J9oMtFL5GxDGwVb/:3ZM9zf1cImA7tTtF9aD9Vb
TLSH
T15D8501A5B35018F5ED67823EC9658946D6B2BC6A4B70C60F13A432276F333A11C3DF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 e36fdc2a79a7fcf99ed2552f7bed00e9c72e691217a11090a0e90d8340a97216
MD5 338dc6e025dcd5921ba6a9a23e21993f
SHA1 65ad0981e79cf75a7c77920006fa64feecaabda8
SHA512 aaa617f98549394dd2ec0a4b437323aa1c3628e306e61bb7c9083dfbdeee6021004ff16b10a64c4d2618b060659c3aeffb4757cb63d4ff74af87e1c51f5d35ac
SSDEEP 12288:/Qb1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGf:/k6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T1BA65239BF40D09D3E3AC837082D149C8DA9DED6EEE75524AEB02F315737235568B0E98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 c17c3d45a742a0d6e6b44d04efe1bf69d0cb57bad7b77b8473f661e78adea776
MD5 86d4546dfda0fcdb938a75607584d844
SHA1 fac679b7f1b535c942de0a9248d6b2ba093fdbd1
SHA512 d779c079da9eb18a49296a1f414bc3b9b7587d7a17f948cdb749a475fc87607d03cf248a5e5a09b603b2404be3129521e9e2aae2492dc9a4302573101aef3b8d
SSDEEP 12288:Ckb1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGf:C46jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T13665239BF40949D3D3ACC37082D149C8DA9DED6DEE76524AEB02F305737235568B0E98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 136a311832697a01fa8b57d218752e83f48cd539423127b67b18cc1f1cd03907
MD5 664981a5a72fe3936700073ebd0e7c91
SHA1 a0536bee1ac61ccdc4f70d9bfada01f98d1c451d
SHA512 f7cd05f2adfcc1e68802d7f583c0f0d24012f9b116a046b2ba59055048db5287b301fe5672d35b345297a709be8dbe3647458ecd5e29102e491a1132cb92d63f
SSDEEP 24576:1zyd6jg20TmA7eE3J9oMtFL5GxDGwVb/:1+cImA7tTtF9aD9Vb
TLSH
T16D750257726520FAD27A8334C9A21A45F7BABC364B308B9F575053762F333909D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 0754457c8d91f81a03fc32d9c25fabda1d8656a2a42618132daad1c0f01abd4e
MD5 c08d92b927dc327f97b4134f7c3c4a03
SHA1 f9a1252dc6c178d46410d59712942b0239573570
SHA512 4240835d60bb71dd313cdde18c709ec6d865e967f49dc1865b4f4e45d1346cf8293d9fc6f9846c41eaee69c2db27dbf4cc08f5e646d009393aa95fc7cca2eb70
SSDEEP 12288:fQb1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGi:fk6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T1EF65239BF40D49D3E3AC837082D149C8DA9DED6EEE75524AEB02F315737235568B0E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 ff19fddf99e9266260b1381ad11f65f7ca7bdc7b68e2f3c94c816fc3c10dc70e
MD5 53472d929b26ec46e4cf73fc624e82d9
SHA1 c7a14c01153f45744cdbf3a31d7b45794213a6e4
SHA512 82ac7395b24ccc2d947b28fdbc97b5d2b3bf9a7ed863132cce1bd86a8f7f41fb22730102c44359b2cfebe97b78f534bec1677456193a2a7fcb597dde4a5f5f63
SSDEEP 12288:3Qb1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGi:3k6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T19165239BF40D09D3E3AC837082D149C8DA9DED6EEE75524AEB02F315737235568B0E98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 2b2d105b86e152231217ae616a72b382d7508556723a443439146b0cb8974adf
MD5 b0779ef6fd694bad6e63ea79a6b2eb89
SHA1 a363a07fc3967c218db22f236cdbfa3aeb420f9d
SHA512 447a62763b05ef85d071f615eb89067ee52a5ad8994530b9ea817a3c20e3732fbf176bb3cf89c8f15b6ebb88b0078116de3d9f1a28416288a75bac63c1a708a4
SSDEEP 24576:+zyd6jg20TmA7eE3J9oMtFL5GxDGwVb/:++cImA7tTtF9aD9Vb
TLSH
T1D0750257726520FAD27A8334C9A21A45F7BABC364B308B9F575053762F333909D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 0239f8a1d2f688c9a3b0e28cca10bfe7ec58ba36ae5f08bbc145cbafab2d2cda
MD5 7145dcd348d3623c6144e8b4769a0618
SHA1 c1ed44ede26f768c66a11ef89826fcd006b7040b
SHA512 7cb09a96f5c65d7b15cfa3b8f97b7c7a07818ee1e1fdae7487ae8b82013b78673a92b321d695ed42d592c941b1c1fe502b70fbc3ee6fd177fb992c42dc051216
SSDEEP 24576:UTyaLl3z0zDD6jg20TmA7eE3J9oMtFL5GxDGwVb/:UTpLljmcImA7tTtF9aD9Vb
TLSH
T1D58501A5B35018F9ED6B823EC9558946D6B2BC5A0B70C61F13A432276F333A11C3DF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 8d7a06ab4f6d8cdf55de803b33d0a726ca63feaed9ebc6aae172697b82876204
MD5 8ac7ded8180f7e978016fc76948f3592
SHA1 36e9569bfd5766730f6ad6917aba31ffb5d356d4
SHA512 44a1226448854af5d27ff2067eaac44d36d31b3fee90574dec2d224a8164485e9542e127f40e78800bc42fef676defc1ddec6ed9b3ec78f8995c0ea88f0f2554
SSDEEP 24576:73Ld9CHKy7GZ/6jg20TmA7eE3J9oMtFL5GxDGwVb/:bLd9CHKya1cImA7tTtF9aD9Vb
TLSH
T19295CF90F3E814E9F1B7DA3589764501DABA7C5A5B31CA8F03A4661A1F337D18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 6d7a7038498ffd299152e864a15d260475723b34c0ee11bf33ff999d1b29c1ac
MD5 c804431592ccb62825eadca731f92b25
SHA1 962e972a430982860f916ca3a734683c09428e73
SHA512 7374418cfd1a2682973371cb07e2f51a1bd3bb1e99be63e8110a347c1d7096415acf5e64ac2d2c034c06045ea0b9133ef38909fe14939299fb2f910904c0d6df
SSDEEP 12288:U5b1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUG1:Uz6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T1B1652357F80D49D3D3AC837082E149C8D99DED6EEE75524AEB02F21573B235568B0E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 0199897cf4182ecd6006bea671828e21fdc36adcdfb58f97c361c59fc1da84c6
MD5 ef41c8e958bf14e873bc3b9032a7b54b
SHA1 c1597b89f00304c984a0517cf6acea47048cbd3f
SHA512 e6a0c3ffea29fc8baa2b2899e5d85eaa62c815869fb117f6a540ecfc62fa2285fb1cf16b0ce8cdd37ed0fa5f8a257423e36948b0a0fd9346e0c7bfc2ca216b0f
SSDEEP 12288:kTb1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGd:k96jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T1536523A7F40909E7E3ACC37082E549C8DA9DFD6DDE75424AEB02F21173B23556CB0A94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 a98fa8653263e6aa0ce93d77748128816a85f6b673f75862c29fac9a1e5a7069
MD5 d7a59274aa441b0d907ba119d9719845
SHA1 000530bb03221aa00de0ca5eeb08246e01aed285
SHA512 7509baa1506e9235a188fd74f6044905c9dda1ed1618a1e4cd3142ea6e4741eb13ced599f7973dad7102cd7fd37741f8dd6e7bdb029741ca54420e7cae07118a
SSDEEP 12288:Aqb1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGm:AO6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T1126523A7F40D49D3D3ACC37082D149C8D99DED6EEE66524AEB02F30573B235568B0E98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 22433c929c6229aea08b1afbe4b6d6cd79359f502b67d6210b08e70997159835
MD5 4e31af5b7043ba875a12cd6f734012fd
SHA1 f16a4c94467a318f46500ba4b19190f2073c7b24
SHA512 42d2cf2cf00c86b8de9af8237efd97dc641640fd8d5fbed70f5a553e671b75483a06be5665b64a29c5fe377ea3327d85ab7efea18709e5e904b0eec228a03e0b
SSDEEP 12288:zQb1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGm:zk6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T1C165239BF40909D7D3ACC37082D149C8DA9DED6EEE76524AEB02F305737235568B0E98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 b29a0b655fb0fb95ed0c3318f9cc06721de460380e7c4337e4a00d2723d4506d
MD5 57da137ec1f4cded7bbde8d236c24db5
SHA1 3cbb8e401360a2066c7e294f2f89f5eb1c044a49
SHA512 8e8c5a0b39ac469eb8fda892d75bc3684437f6658cd92b5f4e70a70cf95e884c36be579c8617b2d110457cee0f34c12537e698fd41d4b4eacea898f58c8ea163
SSDEEP 12288:b5b1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGC:bz6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T155652397F80D49D3D3ACC37082E149C8DA9DED6EEE75524AEB02F215737235568B0E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 d952832bcd293f9808ff3755527976731a6b60f0e8d74a1efde37f111eef41c9
MD5 7408ae2f46594dd32333a33c6632d233
SHA1 6e73fdd1ea80c0e094af079c1be4e0ff26baaab0
SHA512 7007c7df911d94d9a22cb3481240f3ac4e33c6702f14843d4406417dc3a89e010af569b19b675a45e664c1fe685c62b61c71b50f1a15a5e149b2e35d4c8df049
SSDEEP 12288:44b1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUG+:4M6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T1776523ABF80909D7D3ACC37082D149C8DA9DED6DEE76524AEB02F305737235568B0E58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 c729c641bb75737a563e633bf4e9e998b7a1014d82da8fbb966387046195ef20
MD5 07e144e92cf0a8c43f42194d2a12005b
SHA1 21437a7ab5907f1ff043bee0ee9ee4741dbc9671
SHA512 58d4d020f4458a8c67bfc0fea1044132e5362dbd9aa5b8dec28728c9e3a3c323851f8edf4779a36a6d6e316452aba0c85876c95f0c84e244db1ebcb084a203a1
SSDEEP 12288:WOb1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGn:Wy6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T192652397F80D49D3D3ACC37082E149C8D99DED6EEE65524AEB02F215737235568B0E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 46653d53db1d5d1bac62fa061a3bc4b3875634b108ca1d45f81617237959b7d4
MD5 350494adaca659907f33dd2556a3b889
SHA1 8c834b5fa4e45bc81801b6448eeb65dec487a9a4
SHA512 609d1c6306b3f462845fb2f800837afe91318227122a58d39c967adec8414aca255438d3a30ee28164a43c9f25a0cf64d4610b1f76c0ea7363f346153436d84d
SSDEEP 12288:QRb1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGb:QL6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T1DC6523ABF80909D7D3ACC37082D149C8DA9DED6DEE76524AEB02F305737235568B0E58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.5MB
SHA256 fd6098a53ae575db3d80efca9b7cb4232d570f8bbc2ccffbabb7b065922838e7
MD5 25dfe4595e44d5047b09271ea6006531
SHA1 eb963f71c724c7a5724fcbae29017215e2e090b6
SHA512 fff4aaa749f719b4a4005c81eafb26cbe6f7b6df8f989b18f8fc8232f9f4c86c135f4db44f3307364abe972f2c782a6d10663e2da51e2fc9a3f0b011e78b91f9
SSDEEP 12288:WOb1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGO:Wy6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T1DC652397F80949D3D3ACC37082D149C8DA9DED6EEE75524AEB02F31573B235568B0E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 c6a86a313a6a7c58d1782565f2577e88ca4adbdf751ed281cd11722ca9696961
MD5 3f65064f2230209b4b83aa842be8e96f
SHA1 9d881b74baee6e569ed26599f039eec6bcf6a8b2
SHA512 28283408e0657240a44f5487ba06a1bb7fc2819aba1918fd7ffc657aded96388cf4343106836a338d682d484d05562da882db4a2ff54fefa8649b3846454e147
SSDEEP 24576:yfwvLk9RX6wkyAII6jg20TmA7eE3J9oMtFL5GxDGwVb/:tMnYIIcImA7tTtF9aD9Vb
TLSH
T1DF95CF29EBDC44E6E1B7923C89B3460AF6B1B8691B31C2CF125A536D1E33ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5a857688af175384ec9c412cf24b0321a655a080ddf251d95a1127b67134d896
MD5 41c34ba9bcf916a18f9d5577ad07cafc
SHA1 18bb93d88f7a516c42c1e563667f6e3c433f5407
SHA512 f63bfe599f92108a5d4c6b0bfb7cd878697b09330f139055fb206dc662131ece79b585c1d24c4017294c110dbbd258752b7d8ad5b2a31bf720b140f81375c91d
SSDEEP 49152:KYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HcImA7tTtF9a7:2ySzP0IS9Z
TLSH
T1CC066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 30629c946e8c852266af46aee66cf0de3d0e7eeff442d1b9ebea5a409e811f7e
MD5 8c4382f7a680ef77f5545aabbb8499c8
SHA1 ecacdcc6d1b696ab2e53ed5cb24596b4fc8fa247
SHA512 d1c09105f3b3d783560173c92262e7b926117f833d55f6098d0239209f5f2bdac4257d792fbecfc585098897f32e9726e2008f8faa72183c35b0f025ae9382c6
SSDEEP 24576:747Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYZ6jg20TmA7eE3J9oMtFL5GxDGwVb/:747JUQj4irIhCnDHUPfF/XcImA7tTtFQ
TLSH
T10865AE1EA3EC01E5E1BA827885554A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 155d14311a16124d3fe9f1a77c303d06d3336113eb0ef12147bb386673cc9664
MD5 be5cf6f11bbcdeea983a99a2357d48c1
SHA1 2243ca4d0f80309401898ac739b4ebb15394edde
SHA512 8f69c7996e5e1f82e05dd8dd2fc9a759985c40542c37c5c3d976da47264657b403f7b39a4f80ccde50a39eb39517e81e8430f1ace3638203604baa1897968e5e
SSDEEP 12288:pQsfAb1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGu:JU6jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T10775F15AE24802E9C16EA235C7954A81F7677C258BE193CB97C0F13E2F762905DF9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 74f17703f6db7d97f89fd5cf055b71169287499e1c263a506092bb1b08c6d6c9
MD5 72ee7f97dcfecd8e712613b95bf29daf
SHA1 afd57b19852cdcf0926ba508e4d82d031bdbfb17
SHA512 93326a10e26762534c53cb75e9eefd2e5acc0f0189fdcd3de04ce73f641a3f304cbd039e3b3399622f23f153070e81d1931b869fd5fc88ed107a7638df3b2a77
SSDEEP 12288:79GWU3fFdDBFsmKWRdBiXZ5pigbrBkGe0wZb3qmrXiqI1rwtRMkkR81:79pUPFdsmKWRdBiX7mGerOigFqRMk
TLSH
T138352911766ACB4FC66940321E33D2CCA7707D41EE44AF0373C98B3F9576659BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 bd69495c732c5e64cf6d0d0a78e54a7ecd91b61f1315de133bfb73226a9de5df
MD5 9f2e1836788b90b15a71e03036e4236e
SHA1 48a5d00a9b83b5d219c667fab76e514058c7f349
SHA512 c460cd3eab8168683699cfcffd3c5bf659158fce1e39d6a5e4a7879c2619f0e780a9d7178e50e454a2297efd6e5e2ba199a7da29d3c475a5b818f6c4b3747dd2
SSDEEP 12288:8mKWRdBiJE2jmKWRdBiUmKWRdBiY0SE6Kw9uh:8mKWRdBifmKWRdBiUmKWRdBiY0SQw9uh
TLSH
T1A065E9816137E68FD1BB6032032A5B4C6764EC16B7496F22B3C9453ED82BB51B0F97C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 e6128cb5db248808048a37470e58233e5a559cb376b49e7a302fb00a58369002
MD5 ff600e2ffea99939649a9350f363244a
SHA1 75e59e24002c7663825490496f373ffddad72498
SHA512 5e5465c9deadcb81e2b321c00599a877ba159c1692dee2cc52d5dccf8c5b6ed86267c39df4ecd146a13d16a13dd44979031b27fc3c5c0cac9ae317ca9948aaba
SSDEEP 12288:L+7ob1pgiu0Z20TmKRDVXpCjnE31vpAMQr70G+TntRD/L5pIjVDtswVbUGj:W86jg20TmA7eE3J9oMtFL5GxDGwVb/
TLSH
T195652367E60D4DD3E6BD937081E98588AA5EFD688F2481CBEB01F30572727C59CB0B49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2e5b24264d0166fc75ef3ee9e259cdda5cb3ef881f932d95de5c5358ae13c2e7
MD5 86f04ff84e370738da9e5fc219ab21e1
SHA1 1f2d525474d2bb99c498e915a8df1591a9b71b00
SHA512 15c67de1d8abc3f70533840b8b8f97276c221084cd43f0c4d6904a70be9201cad90db127eec8a85783363bf54c9df6d62cf16327410fa87ce6a76e436522c910
SSDEEP 24576:Fgb6bmBIi49WNNFpg1rSvFv7bYm6jg20TmA7eE3J9oMtFL5GxDGwVb/:Fgb4mBIBhGFZcImA7tTtF9aD9Vb
TLSH
T11F65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 0cfe389117a810136d241543948632fd07d9ce674bea70b1cd43380bb0c569d7
MD5 74b07d33f7ef1928d5b064a0424831a4
SHA1 dc0014fd6f51de40ab81f63d6e70c7ea717bc3c8
SHA512 726699760724041430d49f8c2f34ac45204b65577a8932e0fb93864f82bbad8a8e92a423c1ceea8b2742f2cb2699b328c00ba50765dc78d0f93f435e87c8772c
SSDEEP 24576:LG88u8FpJqH1Vzria7/mJ6jg20TmA7eE3J9oMtFL5GxDGwVb/:K7ZFPqVMa7/ucImA7tTtF9aD9Vb
TLSH
T1A9A5F16676E101F1D47BD1388A8246A3F6B2B8250364EBDF07A88B511F237D54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 bde357cf5bdba1a6f0104204d87b5c6fe41ef1ddf9a5850bfe403232737194b4
MD5 edc22e8b8d9005c8307ab0473be2de15
SHA1 0d83029b9d79a89dc1f1351b15605a6f30f3883c
SHA512 50dd284ecaeb4d6fbabdc33af0bd3a9cb12846f54a74db6b3e385481b8fe192ff00d718245b8c4e3831587d465c00404b1b375a19f07cf3f30a41ce37cd164e5
SSDEEP 24576:RPUr+NQ16jg20TmA7eE3J9oMtFL5GxDGwVb/:RJQ1cImA7tTtF9aD9Vb
TLSH
T15885E12F72AD1CE5E67AE17D85828709F771B866071292CF0291817E5F73AD8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0dd9cb8b475c4f10b2ef632303fbba44a7e5e917262491b734c721d85922053c
MD5 d21b71dd14938abdc1e5691b77998f21
SHA1 8fbdf2f93df0af6ad7eaf314d80290fc211e17f3
SHA512 a040ec511c3fb9d4a7e3d4e627c394790664645d8b96654e0f04a1dec81579c52316a131c06def7c114b0cc91f300949a57c900bb02e611841379b5486f9d2cf
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjlcImA7tTtF9aD9Vb:SG05lO43bZIS9Z
TLSH
T14AD5CF6A62EC11F9D1BBD17CCAC64A0BEBB23815033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ec50316879df01cb606a813282e10613e13657ab93fbe54afb70823ac94d754e
MD5 916c61d5f2c036ee6aa896260f529f41
SHA1 d5629bc028a512492cf4fdce1b23ed1b33173b18
SHA512 fd32fbad15dd854c14e48ee03504956f6b7fe7633bf010e88edb2a28ba2cc36e201d42f2f4efa9168a9e4168c73216cc7ac6d6879a7448a9d0061d17ceeb0568
SSDEEP 24576:Pfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnH6jg20TmA7eE3J9oMtFL5GxDGwVj:3a5POZ39Jt2pasx2+m9cImA7tTtF9aDn
TLSH
T12F65AF5EA6FC01D5D1B9D17DC583460AF5B1342653329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b63601f3e83836fbc332390609d0df7b3fba2b3fa3e470eda0bb14571be6033a
MD5 869a314a5c7c4a242ae19dfe9c4cf6a1
SHA1 af493d26e0736ad6184a29040c25f07da70e94f7
SHA512 c5c7788347f31bed3e0b01d5cc4513af2a0a221177302f4d3d34bcacee37c2b05ddcc8e42666cc00bd897579fa123f65e91bfe98e4df8849eec8e0ff40ffb525
SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7Fkh6jg20TmA7eE3J9oMtFL5GxDGwVb/:7Nc/zEOVHFOcImA7tTtF9aD9Vb
TLSH
T158857B1623E901E4F1BBE1BE89779546FAB17869573086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 92cb81f59a381f3a8c3b4099cf39854eedf9c93dc59898e0dee9108766ced2c4
MD5 d08cf07e50de401ca1d6ce18afaebe0e
SHA1 cb9be27aa4aad4a7ffe7c849162829e129246388
SHA512 31c11211c51a55dbcc61ab0bcb248db9ebe53e042c65de0b9be757ca52a6b2f56233aeb1c281b9d99a2646a271dd31d9cdcb050b7f2105b093f0aac897878f4b
SSDEEP 24576:btkNvNnaFeYhJNtmZBmL6jg20TmA7eE3J9oMtFL5GxDGwVb/:btMwBtOmLcImA7tTtF9aD9Vb
TLSH
T11C55AF6EB6B806E4D1FEC6B4CD238512EA727861073293CB9390C13E1E679D89D75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 eeaa9f1b0b1be1808ac8e5c500e955e23958b672e02f422d2542dc7ced78b68a
MD5 23bde8bd615c96395670a0ff5a43c121
SHA1 7a96e098b7fe1786354ee16b43c977fa48b12f62
SHA512 2e2450315a459f6a1b236889b43dc87c183a812338f208ea1e636c1017ac179ef217208e0ed2772add332f2a59c036990755c95b3b51ddcabddbeab5f7fed796
SSDEEP 24576:ID3FHshBIYQgAA6jg20TmA7eE3J9oMtFL5GxDGwVb/:IDVHeBIAAAcImA7tTtF9aD9Vb
TLSH
T1CA95E17EE65C04E5E57AC2BCC6A38A06E77178A9073256CB0290C1B61F67EE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/580-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/580-125-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/580-119-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/580-130-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/580-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1088-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1088-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1088-15-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1088-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1088-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1996-352-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/1996-78-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/2104-351-0x0000000140000000-0x00000001405BE000-memory.dmp

Download

memory/2104-296-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/2104-8-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/2104-7-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/2104-77-0x0000000140000000-0x00000001405BE000-memory.dmp

Download

memory/2104-6-0x0000000140000000-0x00000001405BE000-memory.dmp

Download

memory/2104-0-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/2552-52-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/2552-40-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2552-46-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2552-39-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/2552-50-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2732-106-0x0000000140000000-0x0000000140225000-memory.dmp

Download

memory/2732-358-0x0000000140000000-0x0000000140225000-memory.dmp

Download

memory/2732-114-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2732-108-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2736-54-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/2736-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2736-276-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/2736-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3272-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3272-359-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3272-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3272-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4052-372-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4052-357-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4052-370-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4052-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4052-88-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4052-82-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4068-73-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4068-67-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4068-72-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/4068-298-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/4420-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4420-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4420-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4420-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5052-356-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5052-353-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5052-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5052-94-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5052-100-0x0000000000800000-0x0000000000860000-memory.dmp

Download