3500ef5f7b6da58e80544f08cbb5174c92e5c41c8d2960989eced97243096530

Analysis

max time kernel
86s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Size 6.8MB
Sample260928-c3a4dsvsbx
SHA256 3500ef5f7b6da58e80544f08cbb5174c92e5c41c8d2960989eced97243096530
MD5 97d97e945c50767a14599e536ec3ca6c
SHA1 7809f0ae460cdb9fe22eac674acb30e0eb90983d
SHA512 7f8db078d788ea1ea4faec0688669c3a10185f2566382a84e46a28314e2436f6638e136c98671b3f84399f6a324afca9ce024913575b5dc80d8fb512e3e5266f
SSDEEP 98304:Lo+0x9FjO509xZqNcxfH64NWg/29z4V4wFRKIhm4XoFmsieu:shx9M509XqNcxfH64Ix9zMHDKI0lmr3
TLSH
T15A66BE66A6A450ECD577C178CA468617E7F2BC0513719BCF06A0A67A1F33AE12F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery ransomware spyware stealer trojan upx

Malware Config

Signatures

Renames multiple (406) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 10 IoCs

pid	Process
3096	elevation_service.exe
2408	maintenanceservice.exe
4300	OSE.EXE
3680	PerceptionSimulationService.exe
5524	perfhost.exe
1512	ReFsDedupSvc.exe
5380	SensorDataService.exe
960	ssh-agent.exe
1724	AgentService.exe
3192	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
8316	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
	\??\F:\	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
	\??\F:\	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

Drops file in System32 directory 55 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e4a4f7f87465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0001000000009337-7001.dat	upx
behavioral2/files/0x00010000000093af-7003.dat	upx
behavioral2/files/0x0001000000009cd6-7014.dat	upx
behavioral2/files/0x000100000000a0ce-7023.dat	upx
behavioral2/files/0x000100000000627a-7031.dat	upx
behavioral2/files/0x000100000000bd4d-7030.dat	upx
behavioral2/files/0x0001000000006223-7029.dat	upx
behavioral2/files/0x000100000000a319-7028.dat	upx
behavioral2/files/0x000100000000a304-7027.dat	upx
behavioral2/files/0x000100000000a2c1-7026.dat	upx
behavioral2/files/0x0001000000009371-7025.dat	upx
behavioral2/files/0x000100000000a1d4-7024.dat	upx
behavioral2/files/0x000100000000ba3d-7022.dat	upx
behavioral2/files/0x0001000000006215-7018.dat	upx
behavioral2/files/0x0001000000009b92-7017.dat	upx
behavioral2/files/0x0001000000009cfe-7016.dat	upx
behavioral2/files/0x000100000001b952-7013.dat	upx
behavioral2/files/0x0001000000009952-7005.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaws.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
10496	steamwebhelper.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed14a321f24edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b9782e22f24edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2c85d21f24edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f09f2721f24edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008183681ff24edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000900d0522f24edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b492b22f24edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000def7dd22f24edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeBackupPrivilege	1512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1512	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1724	AgentService.exe
Token: 33	3192	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3192	SearchIndexer.exe
Token: SeDebugPrivilege	3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Token: SeDebugPrivilege	3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 1628	3192	SearchIndexer.exe	99
PID 3192 wrote to memory of 4776	3192	SearchIndexer.exe	100
PID 3192 wrote to memory of 4676	3192	SearchIndexer.exe	101
PID 3192 wrote to memory of 3376	3192	SearchIndexer.exe	102
PID 3304 wrote to memory of 8316	3304	2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Users\Admin\AppData\Local\Temp\2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
  2⤵
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  PID:8316
- - C:\Users\Admin\AppData\Local\Temp\2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
    3⤵
    PID:13712
  - - C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe
      C:\Users\Admin\AppData\Local\Temp\steamsysinfo.exe -steamid 0 -buildid 1788652215 -logdir C:\Users\Admin\AppData\Local\Temp\logs -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\D68B.tmp
      4⤵
      PID:14324
  - - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
      C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=13712" "-buildid=1788652215" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"
      4⤵
      PID:15204
    - - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,18221963824118689301,10855059884704552925,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1740 --mojo-platform-channel-handle=1736 /prefetch:2
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --field-trial-handle=2144,i,18221963824118689301,10855059884704552925,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2164 --mojo-platform-channel-handle=2160 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:10496
    - - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --field-trial-handle=2248,i,18221963824118689301,10855059884704552925,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2256 --mojo-platform-channel-handle=2252 /prefetch:13
        5⤵
        
        PID:11200
    - - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4136,i,18221963824118689301,10855059884704552925,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4172 --mojo-platform-channel-handle=4164 /prefetch:1
        5⤵
        
        PID:12052
    - - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --field-trial-handle=5152,i,18221963824118689301,10855059884704552925,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5192 --mojo-platform-channel-handle=5188 /prefetch:14
        5⤵
        
        PID:21276
  - - C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe
      .\bin\gldriverquery64.exe
      4⤵
      PID:18564
  - - C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe
      .\bin\gldriverquery.exe
      4⤵
      PID:19272
  - - C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe
      .\bin\vulkandriverquery64.exe
      4⤵
      PID:19392
  - - C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe
      .\bin\vulkandriverquery.exe
      4⤵
      PID:5772

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3096

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2408

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4300

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3680

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5524

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5380

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:960

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1628
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2860 2880 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4676
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2908 2924 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3376

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004D8
1⤵
PID:18244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:22336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:22400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.9MB
SHA256 6641d4fd7e7c510bf41e0d2d3a5e9f21e4889e8c79a34af0212b4afabf6d5755
MD5 a17df3c9933359dda9add8d872babcc9
SHA1 e10a05ccb2de4dd9e015701f1f0d678967f602d0
SHA512 cc8e1b681dbbd9fd9ce3d455e117497ce70f7762f65a35867c924c31d5c1c24b82134f639862b76630afbcb0134ef8b19302cfda9453495e84bcce828d5a3acd
SSDEEP 49152:PUv632BuPkFKRrdE6oh7stBhuXjfS4LWxnY4XoFmIBpA2ZGBB9su9d:p3q6gjBH4XoFmsieu
TLSH
T195E5AD03F2D900E8E069D178D7469533EAA2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 afd8350b383b1676f801777243bc9f45375af69401f7c688e733e6fb8b864710
MD5 eaee1dfdfe35de0a5e566fe7ec02e009
SHA1 01faa9e0a85193741b1cec853033272d09186ceb
SHA512 608f670a3217ca825925a15da089f3cbf3f833b60ffa3358ddbc171b0eb8faf0cbc553032bd32871f600f333ddc28010b993cd56e5ff53953fa7cd25820286f5
SSDEEP 12288:s1XLsswWkxy2lRq2czAMksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:aXYfDtczAI9Xozsr8zbhN6GwXOGIh4
TLSH
T1E5850129B3E008F9ED678239CCA28501EA73BC5547A0E7CB03B495655F336D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 a2f0ab627eb596d762a8044f2016b5cf1a799617819e912fccaa5ddbc69d71a3
MD5 fd17efbe89c42f629779209e8284746c
SHA1 092c55a1603da36b5ff9129b071ae837a1ff39bc
SHA512 bdce72bd9b8bbe47674f3456f532944d0781b93530f9bd8cd08db1491dcc25ad47121c228a5d5e51a26b0140902e1b0b11c2e2ff45776cd941a5d10e124cd852
SSDEEP 49152:0Dc1Xozsr8zlLwJIhz4XoFmIBpA2ZGBB9su9d:0IwFRKIhz4XoFmsieu
TLSH
T10DC51229B7D008F8ED678239C8A28941FB73789187A0E75B03F485661F337995E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 256e6340b58080be48780170a7972a2b7c2ac2d0e1908ac5595fe1c8f48dec83
MD5 71014b0b1e16cda9129dfef40aee5472
SHA1 ef696e21811307bd9b5be752c7d2be9b34eab641
SHA512 2a0ae35ad88c6ac607cc164cfbc2c1e7a0f3c7586cac9da357fcb42b387e0a3279d905df255838158ec969ae4579585675ba6ce7e394ee11cb39ebcf9afa1e0c
SSDEEP 12288:Lmw5HEjsChNkBFgl0WDm+CBksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEi:KwuVOWm9Xozsr8zbhN6GwXOGIh4
TLSH
T1DC85F14677A41CF9EAA7863985878535E7F3BC062A21DB1F1370C25B9F37221BD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a89e10147d2fb2ac58778ac2d72168531e022632558b88c7f76effcf30a8b927
MD5 ef5aaf0b088144942a10f53bab5eec34
SHA1 3e0cd9e6019717d6cb5d629dda5b56eb247d72d3
SHA512 1806d3b5dc31f7753c6b09d7295375a4c63b1fe7d7ab7729fcc9b654196815e63aba2ae063f8c72dc44f76dd9c35680f909459b15e4e892065ff5621648cdf61
SSDEEP 49152:bB+taZ3usBWOBr4tEG20bqx0z+n217aau1gliXozsr8zlLwJIh:Nu6JmUxd2duwFRKIh
TLSH
T147D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
Size 1.5MB
SHA256 55da74a4cd1cc1e2aeddc6bbef06256460b586655968647f4502a59ae67fa644
MD5 3128b10f2ed20b4c9bf3aca34ebddaae
SHA1 4f04c0794c72fa4053233da4c4063c2c4f8ea8ea
SHA512 485681dad827e85cb0966fa84bc40d9ecfab8bcfcfde4d8fcc45ca96e6469d91869da2c35589596f7043f57ae020c9d9c108e0a6b47ff868ed7864bf152aab02
SSDEEP 12288:TBksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Tf9Xozsr8zbhN6GwXOGIh4
TLSH
T1826523B7F6A2A442FB575B3129811AC4DDA7BD9FA9C20791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
Size 1.5MB
SHA256 8adbefae6a9fb9910d92deab34f8e3aa44314e8d8b95b6973b9633d523e5a380
MD5 496f731bc24156b475afd95edc2d6b35
SHA1 10d965bd8921d0f967a2e07fdd3d43a026a591c5
SHA512 a41e2e205a8e46ca8a0e1782b65e0eac32d6bbb8c6b491821b5306eaa60528756b8e5d22efacbf366ee6bffd2720eb3e75b5bfc64de470c5587835d1f2649706
SSDEEP 12288:GAksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Gs9Xozsr8zbhN6GwXOGIh4
TLSH
T1296523B7FAA2A442EB575B3129811AC4CDA7BD9FA9C20791333D1041DC7A87A7E31335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
Size 1.5MB
SHA256 161e284af08f024d056a06cb0aca86150562e58fb7de500916488f34046baf73
MD5 8d49c8705e8cd5ac46abc224ce8eae31
SHA1 e4672ae40fc755f34a2ab83f5424ad03ad243f85
SHA512 cd163182715ae60b4acdb5008b65077b0e3e37db14b9dc23b2512fa21f0ef0482f21dc612f06e3f347c7554e3c92a7c3bd6b3095bc51b520586b1094700ac22d
SSDEEP 12288:BUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:BA9Xozsr8zbhN6GwXOGIh4
TLSH
T1F26523B7FA92A443FB575B3129811AC4C9A7BD9FA9820791333D1042DC7A87A7E31335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
Size 1.5MB
SHA256 54640aa0f91acfea287fe671af22a8fe19de2958dd1adbad34d5b0cd2e1e8811
MD5 2416233e9fcb069a3ccc93fe4ece2649
SHA1 177c418769dcf2d9eb0879518d495f9feaab107b
SHA512 4b020538d923d2ba29d6630707165128d33f03f66ee19a5004fe7d8a5c288efe70423f50936c1bb0bc875b94ae432f92f75e242c5a60856f25a94ff982a4dbc1
SSDEEP 12288:0BksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:0f9Xozsr8zbhN6GwXOGIh4
TLSH
T1356523B7F692A442FB575F3129801AC4D9A7BD9FA9820791333D1042DD7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 1.5MB
SHA256 4e6d57b81a0d94c525b75f50c38beda131355a13fc6f0bec5d0af199ffe24159
MD5 9d34641788536756800db83330c2e7d8
SHA1 0f336acf512cf4bd69df6e470a39ad3bbb688eb8
SHA512 1ea982ba8994900151340b223172168a892def18c5c432f86c9df1dc14cca1d20de4da00981ebf1e4a6c707edfc1ef054f9ce958b602d579aedc8a8472d3a394
SSDEEP 12288:+QYfg0aXksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:gf1a19Xozsr8zbhN6GwXOGIh4
TLSH
T166750192B3E51095F573DF3599A04540CB77FC965A12AF9F1360010A4E7AAE2EE38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
Size 1.5MB
SHA256 47f9ca031c62b3f5ecbdd7d149748b1436725302e0d3bd712cd08c1bf4de5b36
MD5 2aa0a84914ebe18407e834dca4aa964c
SHA1 2aadb575f2e1b3901306e924d587010ee82ad82b
SHA512 80559377a7a59557d02ea37f81a49b83c18752643370c820332b8c0567db25ae63fdca42193a7e862af910906b6e115ddf1470cd8a951439c9be47a21a7bb173
SSDEEP 12288:klksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:kD9Xozsr8zbhN6GwXOGIh4
TLSH
T1426523A7FA926442EB575B3129801AC4CEA7BD9FA9C21791333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
Size 1.6MB
SHA256 520d19321a9d2ff90aff89b342b9f433236a18710b78ad20f3d81c68499c78a1
MD5 ddb7c6e6db719962d62d88a1ffef6844
SHA1 9b778d09a6598a5ae1c1f2b5e33859fce3c9daff
SHA512 4f68004907a2c09759e28fbf81499ce3731f05e24eb28b7e302b736aaa3b968855edfcbd76014283a62e07a7f74ddc05186d59067ff5106c95aaf7022ac9553d
SSDEEP 12288:TQ0dWCuSyCq7IwpksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:UjCuF7Iw39Xozsr8zbhN6GwXOGIh4
TLSH
T1898512B667A01562CAF7427999C3874ED7B67C2A03A407CB40D842661F279E82F743FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 853782de2a5f580fee60a988ebfd2ec7065f076195191803d16daf47f48a9fb4
MD5 b04eacf5680abe0475cac0cf626420b5
SHA1 e89426c9f9886fd80ca5d2bef92265fc05a6fc31
SHA512 c5e98edf8022c30a22150801852f220f0de9092a5db03c13e0dac8e228e808c1226a9377072c77060cbbd422ef458bd134724eef0fcc4d3efce22698b21ca75f
SSDEEP 12288:7VNksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:B9Xozsr8zbhN6GwXOGIh4
TLSH
T1596523A7F7A550C2EE679B3199915680DAF3FC9E9B5207CB233800468D76679BE30331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 04a0fe9df26277143cceff44af1ed30583a85877f06ee02123799b4ed3678a46
MD5 9f3834a448cfa402986a222fbda90608
SHA1 e295e206f030b5279ed016cc0e866f3e2dfd7ee3
SHA512 1421cc90f285ab6a49c0e680b23405ea8b3d73cb7428c3b6f9bfd9fb483b3457f0669769b3c92ac92f44bea1052ce03d800e79dcafd9a8479ee6ffb5f8c9bd53
SSDEEP 12288:UyksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:UW9Xozsr8zbhN6GwXOGIh4
TLSH
T1446523B7FA92A443EB575B3129815AC4CEA7BD9F99C20791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 1.7MB
SHA256 c82481033295128de5e95a96c72b24f6e0ae5041c8419f1c743d3ae8b7660c65
MD5 68ca0553327b9b41db06f0e581c0e94f
SHA1 3758a5fb5b7bd1f0a80967657c731e6816b2ef5e
SHA512 64bb9670d096d7b781a193f58f888d967663d93d7010852b5af72a98e9ffe7b80a81f49f6c37cc51b2dafb7ae4e2383718a5bc53b2885551beb38a2c09e309c8
SSDEEP 12288:ViZwbWzzFEoS2cPvyKksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:YZMWzFVSOe9Xozsr8zbhN6GwXOGIh4
TLSH
T18E8501A6B39018F4ED67823EC9518905D6B2BC5A0BA0C75F13B832675F333A11D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 1.5MB
SHA256 215f2c5eb02b29faf6f32a374e3ee5b3aa28f949474a524d81326ce091420a26
MD5 780c73acc6a59ec324cf2f5b1203a562
SHA1 a3b0e007372190f02c7a512500449fe398fba451
SHA512 3207a17d74e0c425d1c4daaf98c79770cc25b41d290bfe2a6626ce6a026522f565fb1344c11b8e69533a087f28a130d63213ae2d8ca2679b7a9f36d15520784d
SSDEEP 12288:Wg83vv/ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:W13t9Xozsr8zbhN6GwXOGIh4
TLSH
T1347512A2F3E46480F6779F3298718910C9B7BC9E5BA18E4F1264310A4D777E19938F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 1.7MB
SHA256 f9a16c0943f40fee15fe63dad15490830088e6d3fff941ca2798c3ec255fab0d
MD5 845755448466feae93ac874fe7f8d46c
SHA1 bf6a7ca6d899ec5fa32938b95f848e573f0a3c88
SHA512 82d2aecb200ea60041e7b7757e4defacd8ab78ef1178809756fc436270069f295f26d62d396e88bbb6f3ab15f9ac78f3bf24cba81417fa4e66fc5e1a817a9f21
SSDEEP 24576:oTHaLl3z0zDs9Xozsr8zbhN6GwXOGIh4:oT6LljFXozsr8zlLwJIh
TLSH
T1418501A5B39018F4ED67823EC8518945D6B2BC5A0BA0C75F13B832675F333A12D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 1.9MB
SHA256 bcd0e5c09df1cdf41f1d7fb22f083aa2a5ad7e1df05a287bfe3ca4d481ffd0c2
MD5 731c74ad6605c51575fbe088ffaec223
SHA1 063e9d80ff5697ffd5aecb982bd338da4f2ad4d2
SHA512 4f8c110aa44e168ddffad59aa17af133700995951ebcb76253286a35cedb778f7882211071f89c8fa63f70363bab65ca2a4c0f48fef94f892ec23c32c07cfcca
SSDEEP 24576:d3Ld9CHKy7GZw9Xozsr8zbhN6GwXOGIh4:9Ld9CHKyawXozsr8zlLwJIh
TLSH
T12695CF91F3E410E4F1B79A358D725511DAB67C9A1B61CE8F03A8251A1F33AE19D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
Size 1.5MB
SHA256 f15303884dee34194c4c0b3736a04e1e6f66db68ea98ab4277fdf2e4d20a6740
MD5 b3465094b6d13d8db5bcc059eff7726a
SHA1 3aa6ea9c4b7b9816f340595168547e476fd7ca27
SHA512 82942039c333ccbb4d0e2d3890321f3c56f3cf934073a7672a3cc8c9300598decb9402f30ec53897c66b209d396ce6fe66327ccab13550867f40bdda6e1321d4
SSDEEP 12288:D1ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:DT9Xozsr8zbhN6GwXOGIh4
TLSH
T1BA6523B7F9A2A442EB575B3129811AC4DDA7BD9FA9C21791333D1042DC7A83A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 1.6MB
SHA256 6a5dec61b1f130297e33ef57eed1465d4aa012b54df9c7ba8cca896d200855c0
MD5 a569a6b0c5b137eb38fa9f99e2d3cb8d
SHA1 47aee92583195b2514f0c016f682541eeef5397f
SHA512 de77302c7240af5d8e0bfc08721eb7781a608ecb2b4d1cc77a670e80cbcac3e44c4f7e58cea214801b7a25ab03f4a978164af2181c24485d855a1a77db22cf7d
SSDEEP 12288:Ync36BHdBdnksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:6HdfF9Xozsr8zbhN6GwXOGIh4
TLSH
T1A875014273E40094F577DA3988904541EBB6BD561B61AFDF1364205A4E3BAE2EE3CF32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
Size 1.5MB
SHA256 482aba3a5fe21802fac324e9c4c82f6be712e6ecd3e797d8ae2375c9fa74be12
MD5 40c548b6ade790934ca68aa4c38710f5
SHA1 c03e31becca684da5066d036a2c94d1328b08723
SHA512 f49ca977f18159cde0c283b86179c68a3fe470d6d8114bb23229aca2012d9e1a280e9c72c019ccc74c312e47b360010dc45e350ecea80653c386558fc9ae38c1
SSDEEP 12288:mfksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:mt9Xozsr8zbhN6GwXOGIh4
TLSH
T16E6523B7FAA1A442EB575B3129811AC4CDA7BD9FA9C20791333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
Size 1.5MB
SHA256 b7d36087ffd6f7ffc9f259be229ed6fb6d797c06c9a27ed2a49f003e742dd26a
MD5 71954e79cfaedf1a3f60d9a88d5320d2
SHA1 7e452b9b7ecbd30fc43f33ddcef6e6f3c43163af
SHA512 ed398ff41f96eeaa4c2c9fc477c23950bcabacc92bdf2dff9ef08a93e4405d088674e26cd9c85f1515e24ef248153b0b8bba3dc14eba20e42d5bd22bfd22736a
SSDEEP 12288:VzksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Vx9Xozsr8zbhN6GwXOGIh4
TLSH
T1466523B7F9A2A442EB575B3129811AC4CDA7BD9FA9C20791333D1046DC7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jre-1.8\bin\klist.exe
Size 1.5MB
SHA256 4af134f67ab2c4168e48a633c1880db39ea10591c11cb0dcead3194c031db34c
MD5 0e38e6a34972f52dda15d46b2e15d5ca
SHA1 4fc0bd48b563c745f3e369183adc4ad6d70afd78
SHA512 be1447026cee08120eb3348ca74b3833f9407d78747efe745cebe2c5db00143059a7e8ef8a3c831ae0045d02ba359fc77933adfcc9892ba8485ae7261b1902ac
SSDEEP 12288:7zksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:7x9Xozsr8zbhN6GwXOGIh4
TLSH
T1566523B7F9A2A442EB575B3129811AC4CDA7BD9FA9C21791333D1042DC7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
Size 1.5MB
SHA256 72d858bbddda15aa520bbcc79beff5823e9fe5c602bf4c21e0fef627996385b8
MD5 9a744a1dc3456bee3ec31c7f8240e20b
SHA1 b48f6a3bc08a4988aeed086effad8e02a8644766
SHA512 a8d0c92f84189b00cc9018b0efcfb9156ddea623d825fe83ebcff82c030762c8dae35fb50d5194125b5c63c818bf8bfe0e8debf30f059c3634fae9abf5ade9f5
SSDEEP 12288:tAksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:ts9Xozsr8zbhN6GwXOGIh4
TLSH
T1FE6523B7F9A2A442EB575B3129811AC4CDA7BD9FA9C21791333D1042DC7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
Size 1.5MB
SHA256 e11b0efd05c3f3cbff1ac09e69b3e4141bb3ec4da77e67f26f0a73221b488a01
MD5 cf59fc0d27ec1a08b76fd9f5e2d08768
SHA1 6e66f72d17bfcd087de0599f9c3e0fd146ada407
SHA512 9580409fdc1e3272f6b21a856c8c997e30b9dd305884d48975d14dd2af1ddbe68978eb8739c82108f5f6f4fbec755a041865a005124bc8665ef2e9586c772408
SSDEEP 12288:49rksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:4959Xozsr8zbhN6GwXOGIh4
TLSH
T13F6523B7F9A26442EB575B3229811AC4CDA7BD9FA9C31791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
Size 1.5MB
SHA256 df3af21376ba8fee424f06cbe4d121b1283a46ae9a6502a431ec6df51d2c3b79
MD5 b34159f8410db538583ee1dd44118457
SHA1 baa92c4f4a4598847412ff0d89c9e0f6af420961
SHA512 43243e987d9faf33364a5a7fcb4fbbc9ece3b6c40920f7abae21aeb2eb56d6025a516323f64a3c076463f88bd6b7b560ed87efe53a86091e8628e986ff426d09
SSDEEP 12288:VfksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Vt9Xozsr8zbhN6GwXOGIh4
TLSH
T1316523B7F992A442EB575B3129811AC4CEA7FD9FA9C20791333D1042DC7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
Size 1.5MB
SHA256 9a88733cc1a21fd3b25c45d387be0824e3c0e63b962ee27f628bb47133bf69f5
MD5 061494707b8920674d22a2a3b9af8902
SHA1 1d8cde0774e8d23de49e0eb091efba29f11abc58
SHA512 fee76fdb88eeac4033105c6236b27129757a1f45bea8770d9585dac2227c8eb8fd972709fa36eb472513199baca3592b9953eb4c45e13dd5c3c15b50e7dfcd79
SSDEEP 12288:OBksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Of9Xozsr8zbhN6GwXOGIh4
TLSH
T1716523B7F6A2A442FB575B3129811AC4DDA7BD9FA9C20791333D1042DC7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jre-1.8\bin\rmid.exe
Size 1.5MB
SHA256 f303e0fd6bed66782bf4357c403a10fce51f76662f5c2f5ec8318d96f8c7f9f0
MD5 9d5e3af788c4c47060477e19514fc2ad
SHA1 e111161cf489ef82076d3bad191f2770ddcddc0b
SHA512 e61b46de62aa33b4e1618708678dd7cd42e252b28dff824a076baf53085667f15478b79fd95184a8ee6bcacd76383038399d9930b26d635e553ff6c9038af4a6
SSDEEP 12288:iAksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:is9Xozsr8zbhN6GwXOGIh4
TLSH
T1656523B7FA92A442EB575B3129811AC4DDA7BD9FA9C20791333D1041DC7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
Size 1.5MB
SHA256 0f9576715cd0afb5508d2b49e7a316de0183ad299fecf14508eeaf3e4d7852f4
MD5 c8d567e8c1332158f1e8172ee712a2a8
SHA1 b8c53844c847cf4e8f77243b4268a30d74bf164d
SHA512 c3466d07549f9c6d4ae4aebc208d7139a5725425dacc5b925d1c0a35bd08e4c426af047bbd3f2bd588bdedad1b00ecddea81abac53e90ec8439197580f524d7d
SSDEEP 12288:7UksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:7A9Xozsr8zbhN6GwXOGIh4
TLSH
T1B96523B7FA92A443FB575B3129801AC4D9A7BD9FA9820791333D1042DC7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jre-1.8\bin\servertool.exe
Size 1.5MB
SHA256 6da3d45310a77a5b2a666840a694cc2d68d1791b0ca98e4d48568ff9e6503c4a
MD5 37b3f59bde39f161f102b298821b877b
SHA1 f16e26bc70ce060f261d6552e62671e09be83579
SHA512 90c36b7d2de810bd63051d776f99f894cd546aad0d31d08bc771ab4c54516d3c5d66e547036d18c78eb8c25d0911be3e57f78b734242f9388acf32d79ac8eb02
SSDEEP 12288:yBksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:yf9Xozsr8zbhN6GwXOGIh4
TLSH
T1E86523B7F692A442FB575F3129801AC4DAA7BD9FA9820791333D1042DD7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 1.5MB
SHA256 a901d5e4aeaf3ef4bb7beb24ab1817d93ca6de760e14d1c350e7ddb4423d1b00
MD5 cbdf790ad6dd9c125233092a44f77d15
SHA1 1e4c03110f86fde544d3c339eb4a68545bd79a59
SHA512 b756a842b3416e66c8155de51e63957ac6972fa273bfb9892bb24aa913c85d22568a6232d56b8eed8b26e3216dd01bdfa1fee7407c60e9873a24934340c8f30a
SSDEEP 12288:MQYfg0aXksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:af1a19Xozsr8zbhN6GwXOGIh4
TLSH
T145750192B3E51095F573DF3599A04540CB77FC965A12AF9F1360010A4E7AAE2EE38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
Size 1.5MB
SHA256 3205caf131c179f74df1b857b95816d7a4b3c455b5692e17b717cda7f8682d53
MD5 9152a02ca66d3ef49ce5552317926e70
SHA1 b2e407636bcab526477cc9c3db03ca6d52e76cec
SHA512 c2096fa979e8e0f365be970820b79bc77b6cdf24ce3cc83a90a70705b83b7d087f34309b52705b5969cf49b4064368e25a7c11b6bc8e54a03385d93ab915fe17
SSDEEP 12288:slksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:sD9Xozsr8zbhN6GwXOGIh4
TLSH
T15F6523B7FA926442FB575B3129801AC4CEA7BD9FA9C21791333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jre-1.8\bin\unpack200.exe
Size 1.6MB
SHA256 53ac6f92bfe36daec0d71fad5f45d2bc78a151aeb979f0c19232cd81598733b8
MD5 dc9d5f328fdd1602ebd170299dfa1413
SHA1 2213bbfafbe4e4243e785b3bacfbb3f454de3588
SHA512 d6f5c3b7806e9ddcc0bcec98cdff23b4a420a2e03f434dd7671a3a9c82ed72f39cba066ea0e8ce169c9426ed1a5edf7e55e9071e03221f1a6e28be05c29bddb2
SSDEEP 12288:SQ0dWCuSyCq7IwpksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:7jCuF7Iw39Xozsr8zbhN6GwXOGIh4
TLSH
T1878512B667A01562CAF7427999C3874ED7B67C2A03A407CB40D842661F279E82F743FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Program Files\Mozilla Firefox\crashreporter.exe
Size 3.9MB
SHA256 6721c2327ede05ed875807934cd536b34d256259c427a97b42611e75a6cd596b
MD5 c930d13f778507cfb24d509f14f5d056
SHA1 babd497bc575e9ad81a7ab89bc821ce6dac1132b
SHA512 55b063197131d11662c391d88b04a5abc65e30381258f79f64c30f500a12dd88faa01119b8c7983d6ce6f085bc7f46a0ff676e06e76d29f864364aa4a4f3a025
SSDEEP 49152:AAUF58RGQBOa74nO28wsz3iDT4JmeDNB05FQz/cTmXLhm6kVLXozsr8zlLwJIh:AAOwBN7P2Jg9f05FyuaLhm6WwFRKIh
TLSH
T17F163942EB611DDAC025C0B482266723B761FDBD073036F74A906735AD68EE01FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default-browser-agent.exe

Path C:\Program Files\Mozilla Firefox\default-browser-agent.exe
Size 1.5MB
SHA256 8938e9095bee75183d7e2ba31ba36f54731e40c626eb99b17b0b1fca6c47243f
MD5 b0b4a96a7f57e0b4b0db3a54415193f3
SHA1 f975c350b949317f94af27ab107e762895024a0d
SHA512 ad05798fdb07a511986127f25b91e229278983bd9811d0b103f1ac6453601ea7ec6b05ac4748aadd5480ffa7e8779d8995c3ee134165c3b4c5ca5529afb4135b
SSDEEP 12288:6kksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:6Q9Xozsr8zbhN6GwXOGIh4
TLSH
T1186523A7FA919042FF57573219815A90DAA3FD8B5B4217C3233A1106CC7A9F6BE34372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 1.2MB
SHA256 a8f20dbacbcd740ecb741026f0d0ebbfc37b1ddc35ba63b734f3dfababd3e2a6
MD5 2b53a10138d9cab5f67a35132dd5261b
SHA1 8f884b743a7699e5ed75351b63aab87d19472cb7
SHA512 6e480895d37e5755d780a4f3ca2fe1ae1d95078740fbb99a19b7ee7a329f23e7c8ac23130a58fae481fb2c93da00bce7cd32993f3fd52dd160156d95c8db7bb9
SSDEEP 24576:DOvG1kQWoNxaqIn4SwpemIwpelzD9Xozsr8zbhN6GwXOGIh4:SvG1kvoNxaqIn4ZpeapeltXozsr8zlLT
TLSH
T19E45D103F38516F8E48AE5749A429233E5723C880B5161DB1BF93F2A3D71AD56B7872C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 1.7MB
SHA256 59209466d0ce78240a5670fbe769fbcbfe0c54d47e3258ffb06c092e57682483
MD5 d3d2935d3505d9db40932eff99336879
SHA1 e4015a95e2125343ffe8009f339b301fa4ef5338
SHA512 0d0efc6cb95bd71e113d7cd3fd0db0bcee6e66ec38ea673cfcd365a70ca8f307b94b5a17b0f0ff2c4404a9811a82564bdc3a961cc9af21f600ef049bbe50bda7
SSDEEP 12288:61XLsswWkxy2lRq2czAMksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:QXYfDtczAI9Xozsr8zbhN6GwXOGIh4
TLSH
T16C850129B7E008F9ED678239CCA28501EA73BC5547A0E7CB03B485655F336D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.7MB
SHA256 d9d6649f6bf419c80d5a1ddfee7b00ced3670b7d91fceb6e5a007d88bbe33bab
MD5 c895d671f557f56ccdb0ea5fb775a5b7
SHA1 0d815bfbb4c4acede0dd8cebce546ebe83483a0f
SHA512 e9f02ca7837edcd981503d29d5ee7719aeb72c787207efbff2f0db10fe38f33bdafaa1fe9e73499cc4e8e2579df6c417fd61c983823f706ffe27262d118d8a21
SSDEEP 49152:aMnYIfXozsr8zlLwJIhp4XoFmIBpA2ZGBB9su9d:ZBwFRKIhp4XoFmsieu
TLSH
T13FD5012DEBD844E5E177923C89B34646F6B178595B31C2CF026943AE0E37ED4AE39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 a07376ff6996fbd7499a1af4c57e98b9d665908b7a6b201f6747613ba3ad8f20
MD5 223c3b75abe590ee4c161db5b7794835
SHA1 5bfac4d8bba5959f64e452a1b17d4ca4de76d683
SHA512 c5bd7bdb0822a6886b8285cc7e3085519f880b2f2cbe3b2da0abfaa101ed66b57b06e90cd48a7da545d5f0b0efa29a50a51e294f6b20a5e07b9a20626a0e13f7
SSDEEP 49152:HYmdNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0SXozsr8zlLwJm:NySzPmwFRKIhS4XoFmsieu
TLSH
T1FA269D97A16801D5C5B9C1B98B0BCC17FBB134490335ABEB02E546935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 c0bf0140046906ff288b24b64cd5ae74ca9e28b5699f75f90bab016c2a1ad112
MD5 cbef54295f4ac64124151c591c9017e5
SHA1 b57b028ca06f9972852e0e8582c526ad8e73a314
SHA512 71b4fad968712f57923ae62fa35aabd1ddd624c8544cbc66f17a8ce07fb1a34a5288ed33707ae54bb9b9d4c0e4d5f08eab8dc69fd2ca9575ed7b27e665242f3f
SSDEEP 49152:MS7JUQjqirIhCnDHUPfF/iXozsr8zlLwJIhp4XoFmIBpA2ZGBB9su9d:pJ0glD0PEwFRKIhp4XoFmsieu
TLSH
T185B5E01EA3EC01D5E1BAD23885154A5AEA71742E5F318ACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 a269832707e8c23137e91f2d4d96dc3eefebee7396b51002fe9b75a5789398fb
MD5 23e87511b98efef03f9aba9092e4736b
SHA1 3336ef9393f16f2558400755f2ac444bad0b4e78
SHA512 6af58c7e012edf91167ce36fa3d06b1b4032a0fb765c34633932bc8def78451e3121a554c4193f968bc87e313f13f86f3a4192199ca3987a2312fe817661f9f2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 96e00dbbcf25f2ed2ae315cd19a4ba1652d67bffa2baccb265ad041bd68863d9
MD5 305735c7d75780e1821c1a616063dfe2
SHA1 1b2e3daa6be9e2c65996ec214b925f7eeb7476a3
SHA512 5465150e6b18260bbf85d1d041a71150ace838892f38f412b1befe9746bde4754714b1d13950ecfaadf25d0a85b2776983fb2b326fdd4379e344eabf9a7f4b8e
TLSH
T1E7E08C251090454DDB806333D3C9995432F0A5000F130F07D7488378BEF27A4817EA03
MD5 SHA1 SHA512 TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
Size 7KB
SHA256 2f0d235e304060350c2fdbc2b2480b0cdcabd15b8cc67385bab40d2586f4c190
MD5 31762d62ae8cde678e51afcd6d598564
SHA1 e928fce223e35885ee34b892a4197c6b97ec9496
SHA512 07b64cb94e0e924dcc68c73fed9fa57f8a5dd5c92f62eb6de6ab52e62c69e31dd3124174ee61d2bff9cc81142c201420b096ef555ce2b2a5a18da8852e5d9a82
SSDEEP 192:rnnG/ef0XXV++wpNpTkkePM6yIsnDjwgQ:rnGHX/wDak/Q
TLSH
T1C8F18519AC18AABF4CC6D718EA367A83D3F5143174903D48E6FC9A1C24E76EC222755B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5b3ebb.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences~RFe5b3ebb.TMP
Size 7KB
SHA256 5f3fb8797eb9c4bcb8714dc33c5b024aa4a213aef3d97f5794c310432f9a4d6a
MD5 8f6b85fed410a274475123babb3a20f7
SHA1 88f0f9b55a3d26d1cc5e79502bb69afa11031e06
SHA512 ea66ebd9a68a2d71f5c8f4c21bbb004dae0c36750ff817718d73db81efd9d0c25d41568c6e6b73df7401c0b943cf74a70e617b6ce2506d5dd7a46491810a224d
SSDEEP 192:rnnGyef0XXV++wpNpTkkePM6yIsnDjwgf:rnG4X/wDak/f
TLSH
T1B7E162199C28A9BF4CC6E719EA367B83D3F514313490394CE7F89A1C24E76EC2227957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 1KB
SHA256 706a410ac1b5644ec6936ab3e875c43f44e18d98aa6e4cc3fb9e90954e377f87
MD5 9f7f462dbc718ea1c9b97b8c4fedf418
SHA1 1926e97017d776a70a4cbbd7bedee7d53b90ff96
SHA512 16886e2198431d393fc7d71677dacd8682b0f4c0330e3a7deacedb217b614195229fda406dfa2120f286ae1a201610d05d895ec8aa8e10fff84f9f89e64fe663
TLSH
T19E11A531F4E86EBAFA6389357B95AB430D311035C1704E4CB6CF0B0441A78882237C7A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 2KB
SHA256 1875ccb415431773376507feb580713496f64176371666ad7b16e72a1482c483
MD5 cc5db239cb055ca5eff108bfad2a6195
SHA1 3c0c88173f4bc46a7644d8ce038e58a37aff1ab8
SHA512 f2df21ce77602e17f429ae04a3828ad614ef5d87b74457b63b6deb3a0c782292e2bcb1034747526b81a6fde400b3c33a574c81a06b0d72a3d7b370149e704af2
TLSH
T11E519531E4E8CCB796B3C451B9527A43CAB42076E5605B98E5EE0B1C01EB9EC135386B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5ae36c.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State~RFe5ae36c.TMP
Size 889B
SHA256 11a79772892df9df6c5713c8173dc03fcd39dc9f71ba6037273602b9fd2b6b04
MD5 98250cfdd88446508a83015a29e275d1
SHA1 f46a16af0e776579896b91e5e1eaec735157f171
SHA512 55ee2e5b0c37bb6045eb7e7959259da4121d29e07b296e751146b9d42e7fe21d08a52122e8ef6160bfa0b54b9493d1c4ed40af51fc811d33b494ba7315f59abe
TLSH
T1CA115232E8D46EBAFAA3C536BB95AA420D351076C1640E0CBADF070510F79986227C7A
MD5 SHA1 SHA512 TLSH

Submit Download

config.vdf

Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
Size 117B
SHA256 a3d8a2cba6e356e02c0f33b50e3a9e61d2f9dfb6a26b5983e30e7786da95dba7
MD5 b46cdf246adb25dd32b81a328e154f53
SHA1 181a1ead2bf44bfafa67339153c4e446863b450f
SHA512 9230a9ca314bc2ab9dfffbf2ff069e7fb7ab9f57f130cb20e44776b7a82060fb0c2f93359b91d7be95f50ddfedc203a58a623cafbb07170c5822dd06f8a549d3
TLSH
T1B0B09243E89CC4AE01680A5DC0A2C4C1214A0677885105E23A9A9618E95E111456D94E
MD5 SHA1 SHA512 TLSH

Submit Download

config.vdf

Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
Size 1KB
SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
MD5 6e6a2b18264504cc084caa3ad0bfc6ae
SHA1 b177d719bd3c1bc547d5c97937a584b8b7d57196
SHA512 74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679
TLSH
T1FA119E5C6BB7490FCF1E0877C28FB955582FB08D79C354D8BFA448997E10E22106ED15
MD5 SHA1 SHA512 TLSH

Submit Download

config.vdf

Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
Size 9KB
SHA256 00f165de5be13a22dde04649a7b17077527047970d7ab1eab822087f874514d3
MD5 0c3f502b24cddb508f3e41a22463f9d1
SHA1 4cdcdab83b2ff6ac0850ae1e4941a719fd6b5caf
SHA512 06d455e8638f8267a4ad1d5bf82b4669c6c949ec5af1213a9652c14afc9fa02526811d2eb40c3d9448aae890d8d058e705c507c90acbaf41fb9df330341289e9
SSDEEP 96:Pl9JQkmUfrV4Dcch1RnMUCYPMUC/njVrr:99JQkmmBvmlY
TLSH
T150226D476D2D40AF03598E6D12E6E0DE129C427F6A9991F3B7E24A0B7108F19B5FD338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.vdf

Path C:\Users\Admin\AppData\Local\Temp\config\config.vdf
Size 1KB
SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
MD5 a2ec2e91c3ef8c42e22c4887d032b333
SHA1 e2c738a2e9400535b74e2263c7e7d1ecefe575f2
SHA512 b069d241efb19e09ec8b5e60ef6c43e00d5cc0f774b9340127c2180356dd1964ac625c1afdfaee5f99e72b26f56046fc329aadbbc365b403af765a55e9c9aab3
TLSH
T1A121002E2BBB491FCE0E0C7BC18FB9A0543FB15C39C314C4BEA4489E7D20E11506DA14
MD5 SHA1 SHA512 TLSH

Submit Download

service_log.txt

Path C:\Users\Admin\AppData\Local\Temp\logs\service_log.txt
Size 685B
SHA256 056d071e438264b40dddd1a81b9bfe49e2674208b9c194afa8ab0a0a4aa3b541
MD5 4c6fe22fd35b7ebac7142a413970a496
SHA1 9a9f049989c149307ba94f8212a59141472cc0fc
SHA512 ab83b086e92b455f8fa083624744b089f7b0b6ed828ab1e9dbaa811b516940afa00bad0f911f164ac2784a0d2c21ac9a2700e3b812231e56996643e3dcfd72d2
TLSH
T18A01D4F5A8D820FB502722C8D94B0F32ED505B2C0275E01132888CD78ACE62F5FBB905
MD5 SHA1 SHA512 TLSH

Submit Download

steam_client_win64

Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win64
Size 7KB
SHA256 ee29f4f7f5195bb184d883146d72d4eb05a92f6f10cffc8d176d2410c52af93a
MD5 7f8d3253008b6201cce1cc5a140237a2
SHA1 936ab32202e5459ba697f6a6afa296ebe0de4075
SHA512 3514d539a376ae955798bd090c602ecaf65b0c1a7e333ac7e421a8db4b8058d7ad02c6cd9f4c29d3a9c7aed11e8bf49116402be4550dac69ab3e3850dc8b0567
SSDEEP 192:Kdo7upLQAEM1BWMGwECMibkhUQm1Ed+9y:CoSpLQQeMGwECMkpX+I9y
TLSH
T17BF19513364474693BA9874B81708DDA0FA8A10B72BF6CEBDE2EC71DD4A6E1174E710D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

btnOvrOffBottom.tga_

Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\btnOvrOffBottom.tga_
Size 444B
SHA256 ecd13153d9d438809a38de30f3abbb0f6f92837a7e3cacb442a9a9309bcd78d9
MD5 89cb2bc5ccdab01b0653d4dbb3d6a062
SHA1 afb947fffd5f5f3723e0c8c3b52cb8cbff406ee9
SHA512 e5bef83bfad930e2b68720e00d450aa879619dcabcf8d96f9f8c47636a95a9662bc91b04cfa9160081d8af79a1257b75647d89677123f28b8c609808d5b86653
TLSH
T1CFF004040C400137C744757DDCD7C5CD77D4F4301540014C57D0307504D5041D1F44D0
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]_

Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
Size 6KB
SHA256 5afc5816946e0d7b6d57a99a60be71d9e88670d9a63c18e249c9266d8e95cd2f
MD5 5a5715177822e69c98aab578421ae78f
SHA1 175ea27d6ef6df27fae93a724c94b2c770f78205
SHA512 b11d05dff7f9ce55c2b30de82709f5aa9b410734e1b88a6879e3489394a5b36a27389022de0a741a16f70d0639439d4f75942c3fd604567d63b9ec229d86b331
SSDEEP 48:dfnnnW6kQhYvc072yybS7WWjsHannnffw:Xr
TLSH
T161E12E6C226CC9DA805BB8F0CA19CBF804060EC9E85E11DFA0D73E8CFE38C8AE431500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloud_localfiles.tga_

Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\cloud_localfiles.tga_
Size 14KB
SHA256 c7a1b0021d1f943e497c592d83050ac85a3b93aff732f9b94cd26d9c41b37ca3
MD5 c4e538289a4c12da96cec77e7a3e36d8
SHA1 12d57144c0e79edbabc8033a9bf22b1720299f2f
SHA512 db3eac8c05b7277a6ab9974c682b20350705fcf616040204bab053d98cf193c2d6fc416eb571ca67f7e53bda59ccaddc0351bf60310a64dba2d83fd9aa539ab1
SSDEEP 384:1MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMrMMMMMMMMMMMMMMMMMMMMMMMMMMMMM0MY:ABTA
TLSH
T157626B16A05E37CE310A055AD1256DA3FA2021F58355346F30FBDE1668702B71AEEFAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]_

Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
Size 15KB
SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
MD5 577b7286c7b05cecde9bea0a0d39740e
SHA1 144d97afe83738177a2dbe43994f14ec11e44b53
SHA512 8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0
SSDEEP 192:JDApAAAAAAAAAAAAGPAAAAAAAAAAAAK5Oq:JDAfIq
TLSH
T1D5623E04FC24B31BD6B9E07EAA974B0B507F4CD9D84330D40C7A5CA8B98DB02A26643F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]_

Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
Size 92KB
SHA256 e0ce36b93ae67846424364085ad79ee24fe5c036e5f6a78a4acbe1583f22daab
MD5 323181f4e9013b8b341897abd322e56c
SHA1 85e2e4a5d38c515185415bd4aa8d24f32d428fa2
SHA512 24fc5c82e25f2ee689b0888c6905f13ae74037e8db06a39b247d525071c858e8a284600dc5e33f006a2657d04c0b045c146c2af0951c7ecdceec34082a95d004
SSDEEP 192:JjJzVPBVK2A54RrjK/MQqLVWT5qOuIToER2zrpIEl:Jd5FjKkQqLVWT5qOu+tR2znl
TLSH
T1719359726F6CFC49BC94C88EE14132D065725AE7804B2551F8B4EE30E1E7ED72E9A94C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_button_news_mousedown.tga_

Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news_mousedown.tga_
Size 20KB
SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
MD5 00bf35778a90f9dfa68ce0d1a032d9b5
SHA1 de6a3d102de9a186e1585be14b49390dcb9605d6
SHA512 342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041
SSDEEP 48:X77qTxcazfhjZRRRRRRRRRRRRRRRRRRRKFvJJJhmAr:X774zmvJJJhmu
TLSH
T18F9209380E706CCE81CE9A27AB348AD2A9D2DC6F36632E348653350FC1948543EA734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tabStdBottom.tga_

Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\tabStdBottom.tga_
Size 48B
SHA256 5caa5fa3e79dcd8ec5ec20256ed7c77efaae77e0ae8d89e4a974c484cb177d84
MD5 bd64c051ae2410eef96839a3cb7297f7
SHA1 95a5b0455d69127fe50e396153c795d9914ce0d4
SHA512 ea2f76c8cf5dc2fd15017ad9b942d020c3ad5ce1cedc2a1604137ea02f8411cfff4166ffe93c101756b404344488b304cf2b4a71c25b2929654dda9a88a88793
MD5 SHA1 SHA512

Submit Download

steam_cloudsync.ico_

Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_cloudsync.ico_
Size 47KB
SHA256 5aaca90948de8f7d11264ed608a2f96acba061e6463d337d658b00ed1c552449
MD5 da277b7a17374bde018ffab02015238b
SHA1 ceaafa1a1ed7d2101ad3c2884159364aacbf9dcd
SHA512 5a6e542ae9938f560d40348ceac663feaf889a6c990efdcfbea919531dbc34771fe2f0f366ab7adc15e998e5ed392d80dad78a8392f11b9c8fdf2c67f0431a53
SSDEEP 768:CHjkEJqa7vWVw70BCDiSfUpWy46032U/C0Tz+3TaZeYJqF3D7RTB6F0SBS6:CDlJdvIw72ILUsyi9/CQ+34eY4zBCph
TLSH
T19F237CBEA78A557DC9A0473840CAEA7C433A6EC5E0A7C2C751D07F5B5C35643BE0E1A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_cloudsync_posix.tga_

Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_cloudsync_posix.tga_
Size 64KB
SHA256 fd2abb8945c06a6b9c5444baf6ea523b52bf7a03a58b34ebe0a6a110630ed5f8
MD5 be3a210738638c4f33aa7e01cb475e26
SHA1 02276a10cd77cfd57e4c796c45d69d526f8420bd
SHA512 6a11640800df51a8d88ef4224acd39cbb051dcdd6239bee82575ca11772a6a52e40c6614af3ea61320d29b4f75fc9611f6182ad2a55d7284863fd38d89631feb
SSDEEP 1536:fQF+zt5w33333333333333333W3333333333333333333DkqbbbbbbCm/b77vBQT:d5bbbbbbCm/b77MquuamizaWraS2Dz7o
TLSH
T165535F64EB112ABC9EF1BF05A6EA967813165D42113BCCFA168D7F4231F3A319DC6D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_tray.tga_

Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_tray.tga_
Size 1KB
SHA256 f747d5fd27e74412be05bb376c0ff12fcebb7f39c158eaa89ab6a0a9d92ef3b6
MD5 7ecf5b072a3c49209af4710481dff5c9
SHA1 6b49560eb27b2d7cd169c066208d4fd3a4863f3b
SHA512 ec9ed9d824471655a48b48324a023a7231560810f6403f0ded04af35b51dde4dcd244bd4147570ac9c5cf0c841af33caaf8de7d60cf20f6fcbedbd1717d6d262
TLSH
T12D1163C2ACCD1788DB12C53807E6E6021C320C1608B66EC9B4277356097B43CAAF649B
MD5 SHA1 SHA512 TLSH

Submit Download

filter_clean_bulgarian.txt.gz_

Path C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_bulgarian.txt.gz_
Size 23B
SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
MD5 836dd6b25a8902af48cd52738b675e4b
SHA1 449347c06a872bedf311046bca8d316bfba3830b
SHA512 6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80
MD5 SHA1 SHA512

Submit Download

filter_clean_schinese.txt.gz_

Path C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_schinese.txt.gz_
Size 33B
SHA256 77f0055faba992867817c485930c5f60cf64e65c65b410128426dc35fd8d862b
MD5 dd542d7ca2128ef0e7c3411b5ab9e8d3
SHA1 0a98ce0efdb5fd75d3c697f06f3c084d5882dc49
SHA512 0d0c1801d0bdf69d2010b0e26ce0a156fa50baaa0370330bdcdb879cbd09a6146d7bc89de2d5ea6f3615123a60e1be87def44c07f92de24615974e3cae2cab85
MD5 SHA1 SHA512

Submit Download

game_details_header_green.tga_

Path C:\Users\Admin\AppData\Local\Temp\package\tmp\steam\cached\game_details_header_green.tga_
Size 2.1MB
SHA256 a24832de8b80e206143170a899ab91e76e85685aed74963fe2f490344bbf6427
MD5 1ed17a7d11da47608f99d98a8d249e6f
SHA1 ea3d9e0de541be2a346e93e63286f0265ac302fc
SHA512 e423be766c3d615dee6f3ed8b0b7bb5735ec13617a93f6f5403a3e7c4c379b9ab87e9fd5f0c9fa9338f656e321488d0aba895ac9f77da413e27473b2218b9ac7
SSDEEP 49152:q3m8TZFdk4Sd9DM8CsBALhExgBrPzkpRkQhbCh6:fDM8o6xgBnkkH6
TLSH
T1EEA54B0FF4A936693DC1EB9E11B1F1F438EA07534182DA93BDD79B4960C2C84A741B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 44b5a4a93a09dc190e78b6d232c234ee032970b033129809e98f155fd09494ab
MD5 32252fd33ba794767b08278c5ef1fca5
SHA1 a0cc8e3a125a9f0beffcb7ec2a9ce089fdcd6fcf
SHA512 caf376d02cbeacf575d02f30eeee9314e2c5ca11137a79499875e5a0d795831553961a2e8354d6f2dc3c31a3fab719d2c4c3a9084cf8ebe37b6c6a417129b144
SSDEEP 12288:Dd7LksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:5Z9Xozsr8zbhN6GwXOGIh4
TLSH
T1D76523B7E795A802FE7B5B30288556549A5BFD9E4F8107C3322C1186DC7A8E5BE30336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8512d9a809e4e09aec076428d0b93a60551c1d9fea315829ac6bd42969027720
MD5 f1b37005edd16b902c7970d3f3b3b2b1
SHA1 4a7721139991aa4640fd675f51035da8442ee684
SHA512 e3d7eeb1e3e9c8e793aca8118e3547e9d1e331f22508c5141d516705381d7688f806163836bd7d678783779b6710168d3281c2f93a484607bfb72c510cb10bbc
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bY/9Xozsr8zbhN6GwXOGIh4:tgb4mBIBhGFMXozsr8zlLwJIh
TLSH
T14865AE1E22EC02F5E1FAD2B89DA64417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 bd9456a74d5aded807b7ef32ea58c09a55dcfd2d66056328e9191c002a505891
MD5 e9fe1bb04403c19cd3d5acaf63c511e8
SHA1 eec8d4b508bddb4d2e28290b9d78dfe45bac988f
SHA512 6d44991e829bb8ce02974e3287c5a86ae9fa7056c94edc31a60b99565c67f5aed60104ae0fd59409b8e60cc0a40afb0cc887972c14d26b5e698faea21c779840
SSDEEP 24576:5G6W/rsXoFDKIXtmg/bA16AF7AZGBB9s0J8Cd:5GT4XoFmIBpA2ZGBB9su9d
TLSH
T19E05232D66A528D8CD3AD976447299933AB530A0FB1510FF09E4C0B65FB0BD6E334DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 5eec69ff10c9b3ddad0c7aff62a65b131db2f1099c82add6c54a4023570ff95c
MD5 4f2f1f87f1137293d719627e51a809d2
SHA1 1a3fc1b5184cb31889ee8c187c052b3d38a99643
SHA512 392cceda7018859a8b8a5754ee829bae8b298294f4cc7d69209363f75610fe6886995fb4f592bae2fa7dda13493a6e99eed3833f8c508d9183a7f81d67a76613
SSDEEP 24576:aG88u8FpJqH1czria7/me9Xozsr8zbhN6GwXOGIh4:h7ZFPqV7a7/tXozsr8zlLwJIh
TLSH
T11CA5F166B7E101F1D477D13889824663F6B2B8250364EFDF07AC8A511F23AE55B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 00d0992e33ace1052a0d01038cb2c31da0e4180757ca89dc58113afc0f742d7b
MD5 82776f9fddec7d01b6229b6ed1015185
SHA1 c0313e5999acf753bb21aaae0f910723f535a11d
SHA512 c3bd219d2168b98637ff0b872724f9156e65aa9f04341c539c278268aee4f945d66cdaa86f1aadb03eb4bd240dc7d66c4062aa51d5b170e5c64c6101e86c062c
SSDEEP 12288:4HvUrBFrEjwaQuksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:4PUr+NQi9Xozsr8zbhN6GwXOGIh4
TLSH
T10F85F26F72E918D5E677A13D89824709E772B866071293CF02A0417E4E77DE8BD3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 54a64c0bf06068b4448bf6dec565bdbcef96ec10bf3e4e0f4ef3eaa94b44a4e4
MD5 700ecdedf90ecaaf8b1a15197b397c85
SHA1 cc8653b3455b9354a0b4c3d2bfeafbaadadc76fd
SHA512 a5730a42dced6f496f2256e9ef313338ff5a3db0c7085c27dd65e138032eb7ba95c0d2de73f652c6136a34a6f9ef5e10a4d2df658f9898bc571706ae6240f21d
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjgXozsr8zlLwJIh:1G05lO43b3wFRKIh
TLSH
T1F8D5CF6E62EC11F9D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2835629345db6fd6cb6c6c7693646975740ef93679c8558d0faffd7a97638bd9
MD5 ea42e2514f8ad2accdc0a0481c58cbe4
SHA1 af7952fe2091751087fc8086da766cb46fb029b3
SHA512 c5f3169a93f665ecb182c7a8e3184453da72443b229868cfbb9b171d8faea59811e609f78bdc20133397f93374840780ec0de3bc77b3993209f31a6aa527ac86
SSDEEP 24576:Dfa5POZ3dpqWVM50JicR2hG0lasx2+47eidno9Xozsr8zbhN6GwXOGIh4:7a5POZ39Jt2pasx2+m4Xozsr8zlLwJIh
TLSH
T1AB65BF5EA6FC00D5D57AD17DC583461AE5B1342653329BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d96248ed186dfea55a38f5f3f105fac9572fec87f73f7315bd6a33771c5aca83
MD5 c88758bd130e7a39aa323632e6df0225
SHA1 baa43f7270f13a44f9bed68f0d84cd3ef4b40fc9
SHA512 9ac251540a174a29ea4f769ff31fa7930de193e2c5ce9cbfbf57b0956e5135d8f674993b4a7c19a4d75e76876d477762975c17ab720927cf7e13174f60928f0a
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7FkG9Xozsr8zbhN6GwXOGIh4:9Nc/zEOVHFNXozsr8zlLwJIh
TLSH
T10B858C2623E901E4F5BBE1BE89779546FA717865533086CF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 e6e596379ea57cad5e3c2c4e27a405766210fa03096644e398e39766efd23e68
MD5 b948aa8e530ed84e85d6a4650eaff8f7
SHA1 a80557644bace1620852c2562a4384777dc5ca7c
SHA512 9947a18c335c598a5374c77864d47cd07475ba4006db47ad9c36cc34f7ae1bf279827262144001d6650b7ac51d208cbb4acb9b9c6a72eece0dbc27380bec29c3
SSDEEP 24576:5UDIAW/rsXoFDKIXtmg/bA16AF7AZGBB9s0J8Cd:5UDIh4XoFmIBpA2ZGBB9su9d
TLSH
T13C25021D637A10F9D16BD03E85930542E2B2B0B1D75215EF0AE4C4BA5FA3FC9BA38E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 f78e3fde044246631aed5f7d892f3826a3163d5c72484a086f3a2048b0f49c5a
MD5 dfa17d1b5d8b43581666551e84f844cd
SHA1 e6bcd818d850cd1d4b951f466ed204ab203bf1c0
SHA512 e997a348c9bdad09e0fb2eb99f8a28f99525797c9c62e22901ffb0593bdf2f2c111405640e5ba63e0d50d1cc0f346e28cc3595f45a01d455199606bd1d314339
SSDEEP 24576:xtyOW/rsXoFDKIXtmg/bA16AF7AZGBB9s0J8Cd:xtI4XoFmIBpA2ZGBB9su9d
TLSH
T17C152208939464D8EA795579896386E13F757C20EB2112FF15E0D23E2F70BC6EA30F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 804KB
SHA256 6755c73ca32fe6e6348a2edf9e88f4b0de25baecb94fa8bd9eb0f4474ab2b802
MD5 8cc3df831afbc56941ba5d905856bbb0
SHA1 040aa9f83c3339f6f3b49793d2bbabf08be454a5
SHA512 94a780c0034757dd9fc746010d08e54b9f582025f8b6f9faf5406e0bc4673c949794e1ee23a5a876d215ce8926ecc72a8767de33e6bf3afc72c27d43e7c59238
SSDEEP 24576:9odW/rsXoFDKIXtmg/bA16AF7AZGBB9s0J8Cd:9oC4XoFmIBpA2ZGBB9su9d
TLSH
T10E05231D96552C98DD25A8B614635ED237B930B0FB5610FB29E4C0B61BB0BCBD370EAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 ca20224213f86d00de39b65c882d23f5b869350490a7915c907b9992a8971dab
MD5 5d2e5387e25cc4b020cce213953393a7
SHA1 1fca4c872e0ca990bfa228cb309c6b19bfbf814c
SHA512 295eb7d81a6d7176529e318a19392e00924977b23626b41a954e45f8b732dbad9bcc8302a43d177aa6af94506a549d4a34b5fd1d588eed745dfaced06d11ef58
SSDEEP 24576:WVgXIoTfaidZHW/rsXoFDKIXtmg/bA16AF7AZGBB9s0J8Cd:KgtTrZc4XoFmIBpA2ZGBB9su9d
TLSH
T16465AE1DA3EA05CAE2B2D675D8731493D633B4315772C6DF2448C03A4DAAED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 9ce0a5091f491e7cd98fb56f5180e86ff60ee4fae8456c6110ef254ea3e0bd90
MD5 a1efdfd2ae8beda6d7b5f25cb632dd3d
SHA1 7ebd1023202b9a624ecb4379c4e6ac057e6ac9c7
SHA512 a98b715579383fab440ccbdaf6336126a691aef660b4eb0aed6fc6382a6936626c877efb1b4b036fb7749167770959b23337e5741393a6e5308864b8e58de339
SSDEEP 49152:Hgb4mBIBhGFMXozsr8zlLwJIhn4XoFmIBpA2ZGBB9su9d:HthwFRKIhn4XoFmsieu
TLSH
T17CA5D01E22EC01F5E0FAE2B89DA64417D6B378165732D2DF1150422D2F3BEE89E39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 f69069814a572d4a44e87b09918027407120337871d2c96510687e4fcc646519
MD5 54c060382ea52788b4d5959cf574a2fd
SHA1 74b4245e357389915d0ce51c7b0c30b0facdb67b
SHA512 f0e6fadd6e4ac4ea490b5b2261d7c31b744b0b1f9a4743baca559e7b68764dbd0e0af88d8e65b2c92b2509d1752bd7882a95d81d224acea259faf298ce9c08d0
SSDEEP 24576:zTkNvNnaFeYhJNtmZBmlW/rsXoFDKIXtmg/bA16AF7AZGBB9s0J8Cd:zTMwBtOmK4XoFmIBpA2ZGBB9su9d
TLSH
T15D75BF2EBAB806E4D1FEC6B5CD238512FA727461173252CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 9f702e56b887e388530cc03224d3e9d56f190d7c5d4baa4a901f405612de6f21
MD5 a2ddb443251e7f2d48ac646cc7e8c5ab
SHA1 bc5765157a7ba896dd3b73ad61c8c3a52a73d027
SHA512 c4853b2f765de30bdec2caf50fe915eebde7683361e7f9930b1d219eb1aad62659092a3eeb28902a80d45c11d4282f01c6c228a325c1a07bba0c9cf8cf237c2e
SSDEEP 49152:rDVHeBIAAXXozsr8zlLwJIhc4XoFmIBpA2ZGBB9su9d:RwFRKIhc4XoFmsieu
TLSH
T164C5127EE69C04E4E97BD17C9A538A02F77138A9032216DB02D481B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 03b5b78ca1bce2a4b4f8c37264ff060e91f0cc26903a82c399702a2e7cf88de2
MD5 01b5485456cd15a668fbce1540f1b0f3
SHA1 5bc5755799d004eeeb81ebff7e286e5e32fe5f56
SHA512 45f0bd0018491f151dc14b25e938a422425da4c906349742b8adfd11a9fbc271dc4fb9397356cafcfce80fd2a7198fcf65a853912bbdabd1e43a33bbdb197c04
SSDEEP 24576:UJnJPbzB4S3W/rsXoFDKIXtmg/bA16AF7AZGBB9s0J8Cd:UJnJv6Ss4XoFmIBpA2ZGBB9su9d
TLSH
T1A435E02DD2A810E8E4B7C2B4811A1B96BF71347C2F2269D719B4D4353F52FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 b879c0804165ee6b4ad60d9cf66b36998eca5f9fab5084db7796cb269ab91c30
MD5 e9f5986ccf3034c12650020953097aad
SHA1 5bd0da368536b8bd62da082eb1ca460d016b225d
SHA512 bda1a5ef3f4327b4f138ebbfbae6998706da818903640a3d866c2849061d30f794a47689d2993f9de9771de4a64dd0a1b8ad8116208c0f2d00107dbfc6f2b693
SSDEEP 24576:/IW/rsXoFDKIXtmg/bA16AF7AZGBB9s0J8Cd:/p4XoFmIBpA2ZGBB9su9d
TLSH
T13505230D96545CD8DE25ACB314639DD23BA93190FB9610F759E880A61BF0BCBD370AEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 8050ffb26cb086717e884f72fac2fb2ba5a2d7cdef008bc4ea44b64ab0ba947e
MD5 cb2b771a9faeb1ae2d1b11dc8651077a
SHA1 dce12ab669c6bc2496164274b9039cc72952992f
SHA512 5ece7698d9ce5d6b07557cc933c1ac1067833fbd5d7b2a65617026a5ee652080609474d85c0556ef8f35c2b6e35b4feac18bca37cf49f5cb87c40174de7dad5c
SSDEEP 24576:d6UqjpWW/rsXoFDKIXtmg/bA16AF7AZGBB9s0J8Cd:d6U+4XoFmIBpA2ZGBB9su9d
TLSH
T11425220E56D428E8E83A9570D862866226B5787267B611FF35D8C17B4F30FC6D33AF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.2MB
SHA256 aa9990e1c9eca1d9be93e29acbdccfe0645a19886259935d36ef6858375ee675
MD5 54895fcc3e649d2a528077ac6cf0767e
SHA1 0f49585a2168a77fcc0b702299712bc607aac7de
SHA512 06fc952d0d746be90522bb718491cc16207290b422b9d51f6c73ed9c95b09f671cb2e66ae65ab9ad8e03f4c740ea1caa104ab1e5f91e41da2e95738daacfee61
SSDEEP 49152:kCLHGeeV5ijCmlDWDkqf4XoFmIBpA2ZGBB9su9d:fG4XoFmsieu
TLSH
T11CA57C05E7EB5184E8F3CAF5CA2694169A327C509B34F7EF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 964KB
SHA256 1f71d9e8e20c4a210b29e88524dceecc5b30dd574b45f427904cc40788fc3042
MD5 87e9258ea248f0558e930856c6d28ad1
SHA1 d87fb280460324a3d959bea5bc66fa5eb15673d4
SHA512 3dbfd5ffaf83b6ce47979eb1b21b8d2cbe94fa388826256b39bd6c9f4c0a750bade7f3683943e77096370a5b8f251cfecd80be5f3b9fb11af43b8eee89cfe64c
SSDEEP 24576:ercmR+W/rsXoFDKIXtmg/bA16AF7AZGBB9s0J8Cd:ocmRH4XoFmIBpA2ZGBB9su9d
TLSH
T10025010EB6AE00E5E577917C88424552F7B37070A75223EF02A0C77E4E67ADABE34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 f8e0c194b9caa852d5b53383432e58a03d716006ce94be9dde67b3328cf06eb1
MD5 9d4e6de283b957c20e6d444cd6015a24
SHA1 e2da4f4266beef011b10941620f41dbd8cda5d59
SHA512 591b00a08bb8b8b45af47e3e6e446931a59d25d3caf13239ea31c3729c5ccf3b96eb15ea50c720e048e394b005e7705e26b0ab01d68b0d3fcc22a42bfd1bcbc0
SSDEEP 49152:CDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3e4XoFmIBpA2ZGBB9su9d:j3Upow8sB34XoFmsieu
TLSH
T1DCB59D3DA2E800A8D9AAC379C54213A6EA71742D3F3015DB0174C578BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/960-125-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/960-131-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/960-123-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/960-362-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1512-353-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1512-7097-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1512-106-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1512-100-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1512-99-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1512-7099-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1724-146-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1724-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1724-140-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1724-151-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1724-153-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2408-57-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2408-55-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/2408-45-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/2408-44-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2408-51-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/3096-39-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3096-32-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3096-155-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3096-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3192-163-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3192-367-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3192-157-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3192-156-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3304-85-0x0000000140000000-0x0000000141785000-memory.dmp

Download

memory/3304-7002-0x00000000022F0000-0x0000000002373000-memory.dmp

Download

memory/3304-0-0x0000000002020000-0x000000000217C000-memory.dmp

Download

memory/3304-7-0x00000000022F0000-0x0000000002373000-memory.dmp

Download

memory/3304-1-0x00000000022F0000-0x0000000002373000-memory.dmp

Download

memory/3304-9-0x0000000140000000-0x0000000141785000-memory.dmp

Download

memory/3304-14-0x0000000002DC0000-0x0000000002E20000-memory.dmp

Download

memory/3304-22-0x0000000002DC0000-0x0000000002E20000-memory.dmp

Download

memory/3304-7039-0x0000000140000000-0x0000000141785000-memory.dmp

Download

memory/3304-6997-0x0000000002DC0000-0x0000000002E20000-memory.dmp

Download

memory/3680-74-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3680-86-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3680-83-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3680-325-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4300-317-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/4300-66-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4300-60-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4300-59-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/5380-358-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5380-112-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5380-355-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5380-118-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5380-111-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5524-340-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/5524-89-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/5524-90-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/5524-95-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/8316-7089-0x0000000002CE0000-0x0000000002D40000-memory.dmp

Download

memory/8316-13668-0x0000000002CE0000-0x0000000002D40000-memory.dmp

Download

memory/8316-13661-0x0000000140000000-0x0000000141785000-memory.dmp

Download

memory/8316-13666-0x0000000002160000-0x00000000021E3000-memory.dmp

Download

memory/8316-13681-0x0000000140000000-0x0000000141785000-memory.dmp

Download

memory/8316-7095-0x0000000002CE0000-0x0000000002D40000-memory.dmp

Download

memory/8316-7006-0x0000000002160000-0x00000000021E3000-memory.dmp

Download

memory/8316-7015-0x0000000002160000-0x00000000021E3000-memory.dmp

Download

memory/8316-7020-0x0000000140000000-0x0000000141785000-memory.dmp

Download

memory/11200-13759-0x00007FFC8E2A0000-0x00007FFC8E2A1000-memory.dmp

Download

memory/11200-13760-0x00007FFC8F470000-0x00007FFC8F471000-memory.dmp

Download

memory/11200-13969-0x000001ED727C0000-0x000001ED72EB6000-memory.dmp

Download

memory/12052-13978-0x000001C60CC00000-0x000001C60D2F6000-memory.dmp

Download

memory/13712-13685-0x00000000020D0000-0x0000000002130000-memory.dmp

Download

memory/13712-13866-0x0000000140000000-0x0000000141785000-memory.dmp

Download

memory/13712-13691-0x00000000020D0000-0x0000000002130000-memory.dmp

Download

memory/13712-13680-0x0000000140000000-0x0000000141785000-memory.dmp

Download

memory/13712-13678-0x0000000002030000-0x00000000020B3000-memory.dmp

Download

memory/13712-13672-0x0000000002030000-0x00000000020B3000-memory.dmp

Download

memory/15204-13930-0x00000268499A0000-0x00000268499FD000-memory.dmp

Download

memory/15204-14005-0x00000268499A0000-0x00000268499FD000-memory.dmp

Download