a445e5adafe1a743b83acbabe4b09c9d8c2310907779951a292fb158ca19a155

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 7.6MB
Sample260929-2cdh9swbrc
SHA256 a445e5adafe1a743b83acbabe4b09c9d8c2310907779951a292fb158ca19a155
MD5 7275556e97f1106e434388efd01d5c8c
SHA1 e060d79efa525b9f06fc8fd8c006b6673dd6fa28
SHA512 01a1628680a877a33314bfaaa67b49aab8b934ef181a941737f0fd4e66c66d9f3f7e1ad16e6413c78db0a0d01e7a2aa234826006ae79538741443957b4763235
SSDEEP 98304:y5NKLwriZVdCdbgnkWxSmvT96Jdgx+smeMS+M4FHXWJTW+M4FHX:YNK8rSTCdUZxzTUJdU9Nr4cJS4
TLSH
T145869E99AAA510EDC07B8278C1929223FAF17C042335ABFB05E096796F73DF60D79714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5368	elevation_service.exe
5592	elevation_service.exe
5248	maintenanceservice.exe
2160	OSE.EXE
3504	PerceptionSimulationService.exe
5988	perfhost.exe
1436	ReFsDedupSvc.exe
2376	SensorDataService.exe
1408	ssh-agent.exe
4448	AgentService.exe
3848	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e5ae74197465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4624-0-0x0000000140000000-0x00000001407AE000-memory.dmp	upx
behavioral2/memory/4624-74-0x0000000140000000-0x00000001407AE000-memory.dmp	upx
behavioral2/files/0x00010000000093af-329.dat	upx
behavioral2/files/0x0001000000009337-328.dat	upx
behavioral2/files/0x0001000000009cfe-338.dat	upx
behavioral2/files/0x0001000000009371-344.dat	upx
behavioral2/memory/4624-384-0x0000000140000000-0x00000001407AE000-memory.dmp	upx
behavioral2/files/0x000100000000a1d4-343.dat	upx
behavioral2/files/0x000100000000a0ce-342.dat	upx
behavioral2/files/0x000100000000ba3d-341.dat	upx
behavioral2/files/0x0001000000006215-340.dat	upx
behavioral2/files/0x0001000000009b92-339.dat	upx
behavioral2/files/0x0001000000009cd6-337.dat	upx
behavioral2/files/0x000100000001b952-336.dat	upx
behavioral2/files/0x0001000000009952-335.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee298a8f6150dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d07294cd6150dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a431bfcd6150dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006453fd8f6150dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ddafc7cd6150dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5fe9f8e6150dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b6c0318f6150dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f93588e6150dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5592	elevation_service.exe
5592	elevation_service.exe
5592	elevation_service.exe
5592	elevation_service.exe
5592	elevation_service.exe
5592	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4624	2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	4448	AgentService.exe
Token: 33	3848	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeBackupPrivilege	1436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1436	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5368	elevation_service.exe
Token: SeDebugPrivilege	5592	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 5688	3848	SearchIndexer.exe	101
PID 3848 wrote to memory of 2124	3848	SearchIndexer.exe	102
PID 3848 wrote to memory of 2584	3848	SearchIndexer.exe	103
PID 3848 wrote to memory of 4316	3848	SearchIndexer.exe	104
PID 3848 wrote to memory of 2752	3848	SearchIndexer.exe	106
PID 3848 wrote to memory of 6068	3848	SearchIndexer.exe	107
PID 3848 wrote to memory of 4076	3848	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5592

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5248

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2160

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3504

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5988

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1436

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2376

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1408

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5688
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2584
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2752
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dbd98bc6cf252f5841d07d21fe64951ec32340068d660a50dc66017982d46d63
MD5 8bfc9900bce36d73599609fc86387b70
SHA1 5d8c11ab5adaf9f09d7f47cc6dda304d7e923a62
SHA512 d0d086e1c719b5f997aaf9107778817bbd0f006bd104bbfd9a41675806de09584314104305b474aa8e95708c4530029d54b92446458c86bfc65ce9ee2cdb3fa7
SSDEEP 49152:Yb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnmhxSMmT8oWgBCaX:y3q6HjB3+M4FHX
TLSH
T184D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 3.0MB
SHA256 dd29339ad1feed2365d108222d3984f9606e5c9eed3baab40080760083824f18
MD5 673f0d53eef8987a6d6643ae44b02d7e
SHA1 84ea82756c85b1aa80f85b60125ee5e79ade4a0a
SHA512 5aff0c519f51973a11b86ddbd9c0228dee12c122fc772c8f22f4ffba5b13df37a4507a9a4c7a179c80a85e2c4d07b24b26c99ab1490f7567461e60468b678376
SSDEEP 49152:3vcEhxSMmT8oWgBCaX0arSj8RoTCCWhxSMmT8oWgBCaX:3x+M4FHX0JTy+M4FHX
TLSH
T1EEE52339A78548F9EC2B833CDDA28505EA733C988351E75F47B49A682F336D8193E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 0bc317b14548464ac517289df7bd850fb57dba637d5988f316595b27103a9fcb
MD5 4443c246c76509f307c7a48a68968ca5
SHA1 dc98ad07415cafd07cb1adb718b8d3569b8e87ed
SHA512 a36089066ccd83dcd58fbdffd39d3f1af0dbf86310099605b63ea7748ba36ce83114cbf9133db470b03a2d72c32d0a830ac7b772339843f04c75c5a85729a5fd
SSDEEP 24576:aXYfDtczAwrKhxr+EHNmT8oW4ll1JCrLKXI:BtcEhxSMmT8oWgBCaX
TLSH
T13A85F128779508F9EC67823CCCA28512EA737C954360E79B03B49A791F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 a5ac87180c594356345734cdfba9c2d6430e213dc7c5ab8624b35db0c510bd22
MD5 a8da7379d53455a353cb9da114498716
SHA1 4471dea58e37e0317a472c732f4806243f26b222
SHA512 9a6b1e18c1028898a90b1c2d3847398fa81b76c898700ad99012220a9318aee2bd5d5d5d5ebe6353d6ce0b8288a9789a7ac1602de135ddcad560cfc515df39e2
SSDEEP 24576:h0Le5ji0hmxYrMfrKhxr+EHNmT8oW4ll1JCrLKXI:hPji0A29hxSMmT8oWgBCaX
TLSH
T11295AE26F6748335D073C0B9C5D2A68AED71308657308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9ae796e9d4a9b1ad5a9787acf487bf48f9064d33b45e847e0005daec11c880e7
MD5 74141a8ee75b0b5edb2982d9340c72b5
SHA1 1052743d00a7771aa0547afabd5849fe5e4b5a1d
SHA512 43754963566b11d5fd1db18c2ddbbe2083c2d060c3856e55424fe7ed9bfce1a674238a7826bdea5950b8c0563752b089904d5b20def5073cc74c004d59548778
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWE6q8wyutrKhxr+EHNmT8oW4ll1JCrLKXI:6/ezSC6vUzPvxHjy5hxSMmT8oWgBCaX
TLSH
T132756C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 38a7c9f8575a2d64167742541d06b24824d8ca7f056bb3fe67ed4d7e8b996ae0
MD5 8ecc19e04bad4e9e10904cbcf1d6036f
SHA1 d121399a3d8eff53cc0eb371fa24843ce4bb283b
SHA512 8c51eddf7904200c89e68adb82a2eb76781deeb550e1408467cafc95e6d41c446beea577f2b4077422fd007b0755a0e074744a62835cc20cd8dac31ae52c7fb2
SSDEEP 24576:xVbqPb88hv/l+60rKhxr+EHNmT8oW4ll1JCrLKXI:xVO88hXl+KhxSMmT8oWgBCaX
TLSH
T119559E66F6748331D073C07AC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 50a151d2cc5666b7bfad9b1172c56caf586c45f404ee060e0d4318e814c43769
MD5 e7e080c81d03e1fd8c47b8ca01f960dc
SHA1 f468e52433ee11d1c12158632e86576dbf3015f3
SHA512 4d633dac0f73908211175db09564378849c86434439703f89b33f6772a994d89f08dc3e30fca829c5f7f4be3a196e6d55b08f21e314f9b1ad140ea00633909c6
SSDEEP 12288:EHtJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:EHjrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1B66523759F0D64ABEE3B8335F87257129A990DDCD1401E3B9F3A3FAC3934C5A9152212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 36d8bad4f6437bd894275e19aaedde1c063d772743dca765b4bd1c4e4b7c003f
MD5 97d5636784df383bf6c7caf631f2c21e
SHA1 c7484948afff7965d841a49f369ed28c1b83ee25
SHA512 997d00424ebb6452ffdbcec55020e6a691cfe149277d2d4ef3ef7a835d796a382509f00c6735894694b2a24e0e3c9f079d702c40c288ad9767d34ce392bdec4f
SSDEEP 12288:5eBNUbTVO86UQJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:5JIUMrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T17A85CF3BEE28FCD2C67A8D785A918700D77278704B52A3CBD175830E9E235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 966ff082f855af337339ad02750130a2f20b6cb91283e98c46ef228ca170a228
MD5 501be40787a832f5c8c319889aff539a
SHA1 8664cf434c7449e3868692360cea381b50149149
SHA512 2c6722eda62307c92ffce12ec53dac77ba77c64929918efa844dbadfb5c34655b46ff40a40a3205ce5ef375628bf2ca5fe73b6a81596fc1753f1b346c5530f4f
SSDEEP 49152:7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THy:7QvGAdlCEL8c/yRNw5Ck+M4FHX
TLSH
T17B266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 813686909b9f20c18abbecb0e75e7fd40926b2d134ecdbfddf377504511c9ed4
MD5 901a0e62d0fe914fb6bfc8aaf95d9bb1
SHA1 565251c33881c1b072aec4c0bf06fe398946b12b
SHA512 e2276b2eb1144c546474d990c74c577bb5df90fb4a98bc44677c067838798c26c779d52821f386e13e185a6ae9276f15b1e338e242785dac95c17ad6615c8c60
SSDEEP 24576:n7ewsAjarKhxr+EHNmT8oW4ll1JCrLKXI:7ljNhxSMmT8oWgBCaX
TLSH
T19E85E031FF74E036C67F0D766B36C716586C6A604B522AC3E3B88E9D59302D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 50260158806caaac90f7ede986e4679dbf2826e123844074f8f6d871ab1a9a57
MD5 caef09c62cb959e826f7a9040d965f13
SHA1 0289a9f09ef647600a57510b1a5904f83312aa49
SHA512 a666549752e21742ee8a82863353ef3420f013d7cc27925c6134ff1ea1df480e00165f516de6301ad52cae8b597aae0e9d5df3726d898f4a28c0020973941cbf
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHV4:2UEtQevvqc2W1cpV2EI32V4
TLSH
T151474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f4b9190e4c054a599b059a30bee207979ef92c6a61d6b9055e1cd60966e203b5
MD5 bca7ab1d2fc612e6752413ba004dd3c1
SHA1 fb77cc04c70166dff2890aa1ba319dc0f7b846a1
SHA512 15381aecc0a61259cf79035e48cb77fd6fa216351981517bec0edd3ab7b80af939349df99dc8efad5ad24cd7d96a12554ba7389a2d56408d1c945e2b02e5e9eb
SSDEEP 49152:3CbRquA/m2yL5zTfFiV+XenmE3/zthxSMmT8oWgBCaX:goquVjnmg+M4FHX
TLSH
T16CD58D1976B8C1E4D1F6C37886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 de92c5ad2064ca2eb7363e05957c49a15faa079d2b58cb0950f4f5f145a0ae2a
MD5 064e39cdd28119bfd162aa5ec4b82745
SHA1 b1e979b2e4349e102614939a956ffc9eaed83ed4
SHA512 f390afaecb26bfa5940cb88045fbae7f7b7347421f3c27083b3ffb8acdd4c2b7c6c63198effd0008ccd07cf51d11db0f71f493eb8b8aecef9f40891dd60060d4
SSDEEP 24576:6AhGLJIFoiwtA5l7S535rKhxr+EHNmT8oW4ll1JCrLKXI:6AMyFoiq5whxSMmT8oWgBCaX
TLSH
T1FF35AE80EBF955D4F5B3AA7899B68171EA76BCA95E31C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 583486383b4cb540293e0fcb0ce67883163724f0b8bf3384bd8ed38e0ef7b1cd
MD5 a8e2b145ee8f7562f36df14a5e6f7ba9
SHA1 28b03cbf962544437eef069ddb8bca1daaf1da9e
SHA512 31e06354465bacc7d164a9da0cc1d62aa96fb05fb61832061d562afdf1e5991b13a86512ecb74fd0a99a17280649c4c17543a3be6a30e75f041cb12005736ff2
SSDEEP 24576:JwuSOW2rKhxr+EHNmT8oW4ll1JCrLKXI:Jw9OMhxSMmT8oWgBCaX
TLSH
T18385F14677A91CF9E9678238C557C136F7F2BC052621DB2F1770C65A6F33221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 62fcd62194c1ec951dc8dbd6d9802d75238ba5a901c2071aead4afa71ef85185
MD5 e78fa4accde9a49c332f0d12084be83b
SHA1 fb9957ae65cd0f1bca480179aabd35eb969d3125
SHA512 8bd90eefbad4c32128279b679e322d0e2205e31182139d2b46214b16a9ad446f740c547f854550c31c2103fcd91a45576ef88400ef18927e5bae36a7a49f6594
SSDEEP 12288:zjZ1Iy6JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:PZu3rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T17A75126A379860FAE967823CDCE14605D7B23899633143DF1A3547A92F33EC65D36322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5620bc3b8710707a3fcddf87069055e6e5eb9c191261b54b8750b5c6a09d2ae1
MD5 53b83fb40cab08cf027b3a8d9523e690
SHA1 46ea46f6deb6d48bd722b4792a0f0235ce0b9b9f
SHA512 222ecfea379791425e682899cb172e7ba48c5878e195be2e6dbff143775c97640a50f57cfa5602d2771f2dc2f647ec3228e16b2014cdc9ccc79bc38e95cec575
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:zQRQyi36YOcPQLvw2gAf+PN37+M4FHX
TLSH
T1F1667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b64d4a554bb71af603557f2ea53febfc6a03282d8711a2b03d35376aaecad9ff
MD5 9daff559089e934db4b559beed42f83a
SHA1 2f51a26b8f96253342cb554e473a83f4bd243885
SHA512 a62059486e2a017fd3be5a35ee0e3fb41ea79ca19ecb4d3f4bddce1902805e3770ca492598304e68407796d0cc7a1cc369b8dff572b92f61c14be2cc260c4b93
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:fQRQyi36YOcPQLvw2gAf+PN37+M4FHX
TLSH
T1A4667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 65e68dbabf7d1075047c10b397f3f245b7972c52079ac563d10087e02c9cfa87
MD5 caf3c239d9cf793368393a2c758d5116
SHA1 d84cff11ad2f2ddae3c95da5a2c3507334f40907
SHA512 5f3a2d317ce084882348974150589bb42d5e1d1347c58f7b1fede9b3456cdcdc03258282665c3f9bb224cd832d5efe461f8c5b7ce3677396f9f697c0c8bbba64
SSDEEP 49152:F68Qg55nhheWu7PNU3/9hxSMmT8oWgBCaX:TthWRc/9+M4FHX
TLSH
T1B1B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f81c76e13c6450139f9a0b52b5727181ccf3116a18b2ce444046fd9698b1cd62
MD5 33dec3de6b0a3740439ab914dcd12ab2
SHA1 1d39ac489a9eb6ef3ba8f3aac5e306f1e42f02d9
SHA512 50459fb7b9ced5593c7d9f2e74952c55654b17f4b28939e29c6d02655c4f4330833d74cd3c6b5c1544a65f5c32114171ccc0fdc03a7ed8e4c38a39ba10c8b7f9
SSDEEP 49152:o3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99w:Fy5112gYy5azzVvL69nLKnhZS+M4FHX
TLSH
T1DA167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a54f3c054328a3abd68ec25bb0946b12964786ee1cbdc16e1f23ed174ed65e80
MD5 50c1aedf30e8e649af48bca711d5cbc8
SHA1 97a6c3e02ef5f7d86c2d3eb67dafeaa6e7e47a38
SHA512 2ac1d9d9dbfd11b49eb4b8ace4c8b8ca8af1705ed5c6ec23feb29c97166c730d909836cf3136bc3df84fc0abccee0f59899729a9d0078b13181c23260c578ac0
SSDEEP 49152:tB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glzhxSMmT8oWgBCaX:zu6JmVxd2dz+M4FHX
TLSH
T125D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 359e881544bdc16c1a0692e1d3ea4025ffd53f962d470f3b637f87726ec03d08
MD5 cad48eaf3c96130bc4af88b37d1a4a24
SHA1 17065427acf98b7806a04a9d1ee6a16ad91f5fbd
SHA512 2da48862c1a9abd2d3cc2ef28b8e076c210a67f127a24de88e2b287866f6471771f88c5665dbd43de49c93e051a08170578b2ba500f4abd5dc45fc233a1bfbef
SSDEEP 49152:o1hpsNoJpF1A6UU44CwH7R4xfhxSMmT8oWgBCaX:omifPbRg+M4FHX
TLSH
T1E1B5BE13F2D900E8D06ED17887569632EA62BC450B34B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ece85046a9982cc99dfd1b3673e4eb808586449d719b221c02c227ccc504cb9b
MD5 829220fb3d1eabaed90488232551dcf3
SHA1 b329a714c8852ee90f9deb034148623b22ad6ae0
SHA512 6d66f4feca6506647efe4d79f28e81cc11fe64bfc03a5c4f8b94faf1991363633389e6f2fdbca8db75db6716b4fc3a9f402d2554e9a13826bdf7d098f82f3605
SSDEEP 49152:SSuZQIY0Be2KRRVtOnks6NMHq2hxSMmT8oWgBCaX:M5dKTi612+M4FHX
TLSH
T17BC5AE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 52988945030d68742f336b3a6da193316d83e8ab07640e8df06a4f09bac71379
MD5 63fa20cbccb80fd5a568510b5aee71c6
SHA1 6461fd96cfb07e0327be743f1281f09789fd4d46
SHA512 48d3fa2cf5aaaa1acf722bd9d56bd92b1580a149512d982caccd585669f418c264d2f4157d076272207709661217457d291b454eca2184df8ff7fd8a81f2fc51
SSDEEP 49152:phtSn8EApI0figngiDn0AP5wDhxSMmT8oWgBCaX:YX2iyphs+M4FHX
TLSH
T13995BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 d07815b59e084214a41a955802d68b6b5af93a7e27042b8fd22cf8ecc9ad40ee
MD5 75b25c12ff55c381db4a56f18bfac5ec
SHA1 d5f4ce8f0a0a5a34852f78f49f684f65ac33121c
SHA512 1ec05eb5e9faf5cd7eba8f5b38f782b9fc22fc8d8a6001d4292065d58fb1aaf728ac09798ac417b57ffb6aec501af76adae539fcf8754a57333efbde18938a7c
SSDEEP 12288:LFJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:LbrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T101652375AF0F94EBED2AC335E8624716D99C0DDDF202163BAF3E2E683A35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 f240f10e495ae6dd7a9a6b16c181918adae11aa0ea84006c2ee814e9c3438630
MD5 8741cacce8cfc2e2dd62d21365409aec
SHA1 321afe0c85a321a4e8009ea231434c01e404ed4f
SHA512 126e468bc86d7c34e6c2d4669eafdb4dcfa311e910af05be0deb56867337bb09edf26de167d856f1ee21db2197eb4e6a835afb2ccd7d84c467905cff354c225f
SSDEEP 12288:1eJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:1+rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T197652375AF0F54EBED2AC335E8624316D99C0DDDF202163FAF3E2E683A31C5A1552611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 1d202b5c4934b274b808aac6bc138a5efac179060f5ad8ed8a11280c74ecd4bd
MD5 462972d4a1e2572126f724cfb887a3a1
SHA1 c0712c073d8537c93665ea4210201850916d76db
SHA512 c8507264e86b6faaaf295e22467fd47de7d9c5cd6b83b2c233feeac9a909eecdb3aa03cd832b60f25fbb393829986692ae1491d00482fcc42a5af094a2299101
SSDEEP 12288:sIJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:sErKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1B8652375AF0F949BED2AC339E8630716D99C0DDDF201263FAF3E2E683A35C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 51bda1f974c13c4927b363834e744d3308b7b2704f67888c464a90bb42e912bf
MD5 b7392fda09b47698ff35eb5c70d0df74
SHA1 d2c02cceae908b62bcda54b7ca091af63dde13ee
SHA512 2d41fe8ff0d2ce633e5915d7c6c68310b37391b14574525b917e59bc74aa551f65b1ccd11c134e7928792ecaeb3fac91e1209be21f975f34d225260ae66dfbac
SSDEEP 12288:DVXJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:/rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1DA6523656B0E50DBEC26C339D8724212D6F93CDCE322277F9F251E682E31A996931B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 6e01d144916a854d5fab02a5f14cbd5092a6a8b35e65f1c40128db7d2e7942e1
MD5 02bceec93c69aaf6266afc6d0d49f68e
SHA1 6571a34432c2f99e94d4b91e93d1b2f3701e57d8
SHA512 3b32207eef7bb9c7caa4893dd2c4d13715cade1b48bdc8cc5add5c6022fa7af1d57be2bffbcf267667afe48d0237adad6da951f8c4edea5083b2bb89328344ef
SSDEEP 12288:b/JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:bBrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T18F652375AF0F949BED2AC339E8630316D99C0DDDF201263FAF3E2E683A35C5A1552611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 435a8004c1691f55efc7719c22f917ce4907cec4dce016d9315619ba31a99d2f
MD5 8763b55d423822f94b98561438d7f603
SHA1 dc1adb131a36852150cef55ba995ccbb3b2a87a5
SHA512 17c2f377c190777b9dbcee9aae2176d51bb396898398d03f2eef4aaef6f75dbb298bd67af6c9cbd1d2563406ec2fac6332bc24432085650b96e32683e5ace66a
SSDEEP 12288:yiJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:yyrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T192652375AF0F94EBED2AC335E8624316D99C0DDDF201263FAF3E2E683A31C5A1552611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 db5a608b2de63e4ef6960fade9b6cd9d2c033ff3b826625815ee12939b71a0ca
MD5 e86775e068eaac3a862ec5e50356c9cb
SHA1 e39d19e4942c603f9ff9b7eef0e78d7cefc72113
SHA512 39e121e92a63796c501139d7b95c5127dfb5ad65b258682b4e056ed565c53de86e76b04ef75b11e339825a40fe97ed9990bcb67879fc8bd7b76b53c186f1fb48
SSDEEP 12288:dmJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:dGrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1CE652375AF0F549BED2AC335E8624725D99C0DDDF201163FAF3E2E683B35C1A1152621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 0b540caaabb013c12083249b5001c6ee5dd4a9df4e992e9021aa07c4d71445e7
MD5 92e31cf87b5986805204d6c03539159e
SHA1 efd20a34d5b9999c5f2b6095b429c042a0dcaac8
SHA512 458e27637e55abdc0f3537e1c3c7fc56a560fdbb1510d9b5bea908bd7e878b79a886868254bc8fd49bfe804a2b813efecb5fe7e59cf989a1472f3fffc738129b
SSDEEP 24576:dZMEzFVSOerKhxr+EHNmT8oW4ll1JCrLKXI:dZMEzfVhxSMmT8oWgBCaX
TLSH
T1A98502A5B35018F9EC67823ECD218906D6F27C594760C61F07B8366A6F337A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 afb946f2db8f14ccf66cffa0b77a887efe88dfd24f553e9664b6e765dcf5196d
MD5 2851bbc57dc710e9171b285e56995d72
SHA1 202049088a1edc90131504a989cbb9047a412143
SHA512 a928f0ceb9c23fbfe400c006748dc3703f8bdeda253ce898ba6c433cd38efd3ed39225099cede8038b985693963ed939147b58a9cf2ae4946762ac95c966469e
SSDEEP 12288:CRJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:CnrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T117652375AF0F54DBED2A8339E8624716CD9C0DDDF202263BEF3E2E683A35C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 11624f185ddbececda4814efdf7f62c7767d959f3627c15d4377651b6e2d1811
MD5 b78960cd1c3e55d9ccd717b017ab9e91
SHA1 3257a5e2f23fbf22f724209275356522925ca704
SHA512 0cd339a35adae8b32ac2fbcfbb7ead4e31e3abc747b3ef713f4583600ab5062b91c5bba49b9e16338ef458bf24dcd064c1819116bb02d4fb701b1056a7c9e520
SSDEEP 12288:V9JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:VTrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T198652375AF0F54DBED2A8339E9624715C99C0DDDF202263BAF3E2E683B35C1A1552221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 1b7f88638a74fdb80dbe4233ff8a31c3cbb5094e8e368653e28f7afb01f520df
MD5 82dda46762c9fc72d6ded712cc300a68
SHA1 abd701b3266f45a64633099d023c3e9c9b87c31c
SHA512 cee84fb5f294292fa301653fa1c21484efbe92a5a74001edf173e77e60e752c8309e0f217bec2484fa139f113d975e085ae6ff59b1336ad1ae4d71dee2338935
SSDEEP 12288:MyPz5L86JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:VzyKrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1C3751217779630F9D5378238C8621A02F7B57C7A53209BAF5B64077A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 51b3654e69d2dddb0abc3c197007c9672284e2fd27e4e5a06f0fc43d060c7dbc
MD5 99c23df9ffd5da194483ed7789b29a34
SHA1 d2d0700909dea1b58958a3cc9967b5305da5ef16
SHA512 8e366d9748aac3bb4bfa1ff10acb7eacc71beec44637efc91bc63ab983c01b775afed97cd3d403a9be0560bbb33db9838b00f6bbf5e03407315bf347ee6b2214
SSDEEP 12288:VRJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:VnrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1DB652375AF0F54DBED2A8339E9620715D99C0DDDF202263BEF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 1099861c549d914fd14984c8845b03181fb620bc2d2f2b67679250dac3217124
MD5 19b36b3a4ed3a9bf9c6d4f0faa80b8a2
SHA1 8db3ebbeb61558d8f08ebf2ae1e54dac478f6dbc
SHA512 012579682bfd3d9c92eb3e2f3338430bd1da1daaab4e58a5bb782407d57a5c815ee4c8cf677aef8d39b6c2f2432ac83d026fa6fd85853ebbbfd7ca27be0e0b2d
SSDEEP 12288:vRJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:vnrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T18E652375AF0F54EBED2A8339E8620716DD9C0DDDF241263BAF3F2E683A35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 ed9037b71eda128ed39b8182b193f8fd1f8c656c5083cc33bb2b9bf50dc0bea7
MD5 ae0f13a44df9c8fba104cfdf3076e5d2
SHA1 f948978d9469770f4bb7fae95b8928dead76dfdc
SHA512 684f2ff12497291aeaae8cf5696276bbb12a54b21c1d8e97547adb5c553ed2dca09db766678c3368ad87430ff871626f5fe778d55ecba6be27824d8f978d3d0d
SSDEEP 12288:ZyPz5L86JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:YzyKrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1B2751217779630F9D5378238C8621A02F7B57C7A53209BAF5B64077A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 182c46133866e8f8af7e268c4a38ed1e64a039c858742a79d2d0376dfe00165a
MD5 1c35a33eafee0f5fd7c989ea6264a42e
SHA1 cf0c2a0367d936d1d3cd7ec4697b3e35e57b36f4
SHA512 dcca036e98e2551e7e575e784edc67bbc5ebbda020cf0b435a6d17cab6c478dc40d17adcbddad15ebe627bff0fa41d9d1819af09a1bfde2972aaacbe42260a18
SSDEEP 24576:ITdaLl3z0zDUrKhxr+EHNmT8oW4ll1JCrLKXI:ITwLljUhxSMmT8oWgBCaX
TLSH
T1AB8502A5B35018F9EC67823ECC628916D6F27C5A4760C61F07B8366A5F333A11C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 3dbca92e8962231d53792aff8c4d523d1c8c6778a3822deb8f43057fcdf132cb
MD5 f69b9b2d8f8a4916b1f03a80be72aa2f
SHA1 d8f26d99433d0ba849cfccb1e444b2b59b88c572
SHA512 5a7f23a187778c386a0e568cc8ca017e288b72c6a13fa8a74e7349bbb26b8634b5f3a04b88d2542e33abd2c4c77217591fcdb1f59979f13e8beb7c97b903a2d2
SSDEEP 24576:H35d9CHKy7GZorKhxr+EHNmT8oW4ll1JCrLKXI:X5d9CHKyaVhxSMmT8oWgBCaX
TLSH
T16095CF90F3E414E9F0B78A35CD724511DAB67C995B21DE8F03A8265A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 6b82582329c7d4d3b4416e268101600785322af1adce1289f74d30af59e5c3ba
MD5 210da8b2bf1bc4fa6e0536a73eae3ae0
SHA1 f083e5f9ecbf065d7f6bc74e3be17a3475fe2be1
SHA512 4e21f1f1d275f33c441ba289bef1b75bc4e9028e80036fa1f17745f562480614b9bd0b2edf784f6cb89d4072ae1be76c3b555d9579d0853477deaed5f85089cf
SSDEEP 12288:UoJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:UkrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1FD652375AF0F949BED2A8339E8620316D99C0DDDF201263FAF3E2E683A35C5A1152611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 f57024f64536e0742f0588bdaec1db726b29ffe75978f7474ea17b3f5c63ffb7
MD5 5151c0cae52840497690f918b13f751f
SHA1 848d1684e4384b850fb90b6054012e2c7ea53b12
SHA512 88ea07a353b2eb8f2415ef819eeebb997cfb15b4c54d33c4ddbd54daa0ed4d34e3549bb28bdbef6c996d8c75fdde81f201def79a347a482bb37d5b95adea2177
SSDEEP 12288:6aJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:6qrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T121652375AF0F94EBED2AC339E8634712999C0DDDF102163BAF3E2E683B35C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 cb727b955e2a60f6dca515156e90744fde0437394077e94dc29d0713d570a707
MD5 357f883af9e1bdd734453bbaffa585eb
SHA1 67ed7ffff689b5eebb75998e647468bc61c671d9
SHA512 02d1f06f86e600f3e13d31418cb7f4009f40f196025fd5871b4d2e3b515600a62b70373ee54b0a5f82b80517d4530cc9c872773c51422743246db569384e8db2
SSDEEP 24576:UZwvik9RX6wkyAIDrKhxr+EHNmT8oW4ll1JCrLKXIWaKngL2jdshRTdG1YxITqv3:gMnYIyhxSMmT8oWgBCaXtarSj8RoTCCW
TLSH
T18FD5F129EBC844E5E177923C99B3460AF6B1786C5B32C2CF06AA53AD0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b290cfc56efc3ee0daca7a15615ab37ceb297c08eae4082f47aff3b746611518
MD5 f9fd4038a7862c24c883640fd6a11405
SHA1 a98b3a6bcc6cafe1f269ee788f4510138b43a26e
SHA512 cb9127b5b4b1673886d352b6da47bdcb63627ac3c43f818a5059219f197fa3bbbc3ca469ffdbbfa3ce0b0918e6171746e9a928bbfd1d0517344d872106a09400
SSDEEP 49152:IYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0jhxSMmT8oWgB3:WySzPb+M4FHX
TLSH
T15B066C96A16801D5C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 08fa8318196fe9ef223b49bced64bab955786e72a993f8eb54dfffb33722d80e
MD5 19db34f6d4c193c445071682771840b7
SHA1 c4428ac47e1ac9a1152a8b456b558d43118ae2a7
SHA512 0772c3acba43db587230838486ac200b230a140d37b8086d6bd2d66d06575a2355dd5e42fef1c4b1b6ec08422bcbdc01fb13ef6874371ddb59ddb7b5308f8187
SSDEEP 24576:147Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYOrKhxr+EHNmT8oW4ll1JCrLKXI:147JUQj1irIhCnDHUPfF/zhxSMmT8oWM
TLSH
T18365AE1EA3EC01E5E1BAD23885154A1AEA71782E5B31DACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 3fb32c9cacae18c43c9d37def1c5b0463861b31bcc4a36e1c6e7f9ad260f2749
MD5 c90e9ae4279e3ddbce27647d6fd9a7f9
SHA1 dfc3cee29242567009fe4cc461530c57430ab974
SHA512 23db1b76e5687f1e4ace10718cb86774cdf276c3855a5252cb3effc8b14d914c28889792898eae80b2433bea66e154bd54daca87094342ffd6e9ae31160d7777
SSDEEP 12288:5zsfBJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:A3rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T13175F11AD24801E9C46E9239CB524A01F7773C6993E193CB5BE0FA3D1F36A945DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1020KB
SHA256 b3d811f2ea36247e1c2a1de7b7137f059c33910083a5e26a8c064562948f0dca
MD5 0caddc352a77291a3bb35b4a7670c314
SHA1 73505b8c4e4b5594b14029317bcef46aafed3649
SHA512 2a5dc539617ffb2eb72a66d71020d55034631afb490e74d400209beed87a9a89b8d337df495471c192e8412c6a9a93bcf592ddf9598171a4a1049ac347fc297c
SSDEEP 12288:Q/nd3XRU3fYdsX17DEK2DmOGacLYvQ5qvR:Q/nphUPYiFv0yOGacmx
TLSH
T18A2528117666DB5FC6A940321E33C6CCAB707D01EE04AB0772C9873FD576658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 3e4c0e58b640778c5ceb918ebd4cb51eb0edaa01c67a00c327ab58ff4224dc4a
MD5 66b1868f4ba76b9a7fecfc8f1efaa022
SHA1 de1155a831b5f64e5ad85c95bdbd77cba874a7ab
SHA512 812fa3133c0f70d1db78345c7b286e3326a03ea69db83b047b17ac995483e75c87b525167b57d476aab75e8d532678212285632acac9959e6dad78b1b83ec089
SSDEEP 6144:Za4rTlXraT3XAYF+LGTubQytMxH9E9wkNgf5l7iU1mQytMx36LSLKEl+CwSV89:Za4rTlfGim9E9wkNgf5l7iU1dlCr9
TLSH
T15C55C6819137E7CFD1B76132072A5B4C6BA4EC07B7099F2763CA453AD86A751A0B93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 acd2c551a8dd4643e3002c27fdecb4cadab459869f8f408bb8dd221cf835de65
MD5 4991267d2e6bec3c0cbe72c77e724980
SHA1 1ea60b9898408eb11e156289e6f0e113a470f4e4
SHA512 e5d39989b9715dfcbcba94364fe2f352974e31dc8205e4daf528620524021564d4efd9924a6dbc302233fc92695ffe8ca806ac86ec99f7a1682e4da873db8368
SSDEEP 12288:hO7pJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:E/rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1276523719B0E989BFC3A8334E86743216A5D2DACD30055FBEF292BA87931CC55D72712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 91140b53e2cde05d2587b7b3506cff1bae272e026bed1e5737b8ee51703a952a
MD5 901fbf47d8c3793b2e28addc6a1f08fa
SHA1 1daf16c365dc8a48d4f8737095881f46ca03cc2d
SHA512 12ed9696048bb9beaba2ceb3197b59c03c994f220d5e86dc8100fdf6f3e672a27fe77891b7bd4dbd5ee4c8a203f50281bc8990763015f8bd5f92b02d2009ec0d
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYtrKhxr+EHNmT8oW4ll1JCrLKXI:5gb4mBIBhGFxhxSMmT8oWgBCaX
TLSH
T1BB659E1E22EC02F5E0FAD2B8DDA64417D6B278161331D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 5d4665f08325c7dc9c31baef4f7c1cf145f75beaae1d23de727a52ebcf5a740e
MD5 8adb641f7ce01da7d905129fad6c12df
SHA1 a06991581646d8059fc2475b252745c207f25f83
SHA512 30ecbd7f27f4832ae9e46c24e0d03e99f033a189bc6a74749b4ae7cd3534c6efc45dd911392a193819b64f16c2ff61cacc9ba6f0cabb307067147eaf88bc729b
SSDEEP 24576:7G4aKngL2jdshRTdG1YxITqvfPkbIcbjLm:7G4arSj8RoTCCW
TLSH
T12205237EA7C55694C43B977429B6A84A3CF33768970A46DF88E0957C5F657E0323CC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 c716399757d34efcab77bcca8f46829b10b15c38cb73d0e0747c2a3d13ff1099
MD5 5d72568399a959966db83e96a77ffb00
SHA1 c2bc9b1c3dc66e1e62e0ed3f4013f0b42b8c8343
SHA512 3ec3aa9deff3b3e3f09665452b01f56cf4c2829e768bffd32b63398c5a08352fb8e46dec988a8bbfd8b52c84218ffca44590ce09163a113d98638d5c473fffa1
SSDEEP 24576:DG88u8FpJqH1hzria7/merKhxr+EHNmT8oW4ll1JCrLKXI:y7ZFPqVoa7/chxSMmT8oWgBCaX
TLSH
T18995F16577E101F1D47BD138C9824663F6B2B8251360EBDF0BA88B551F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 205777ed83859625cf6e93d2ac8b8f51ce2dcc954e53bf72b8a308d3486926c3
MD5 0383ddc07c0266831560beb7c913f327
SHA1 8ddae0cdac8e4f81fa3e9673037d0d9c26b0b569
SHA512 965893295e4b2551cc7bfca94e593ecfd5287dba1ccbc867f1432f5f511e3e9ca4f843ad7fe28f7f82853f70cc94dd60f8b01b2579b27b262f6c5d2159c12524
SSDEEP 24576:sPUr+NQirKhxr+EHNmT8oW4ll1JCrLKXI:sJQVhxSMmT8oWgBCaX
TLSH
T1FF85F12F269D18E5E67AE13DC9824719F7717866131292DF02A1817E5F33DE8BC3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9a0d3d8ac993deadf8d4e286feef793731565071400ee8598b6951e7b73b7cd1
MD5 a031ab3a5cd29124801a208fe2cabb8c
SHA1 56090675a5ab4188580638115a413a79b64bdb65
SHA512 97d89c33004de9598ccb5d94217886855e9a0d85762ee80da9337832a61254b569b94aff30167f87891d0f499e3b18789031a137a61220b3ac657267e2757f11
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFhxSMmT8oWgBCaX:jG05lO43ba+M4FHX
TLSH
T19AD5CF6E62EC11F9D1BBC17CDAC64A0BEBB23815032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4c0bc04ccc917f2ed1bb744a640665f07bb531d1c689718468bc8568f2c87164
MD5 4d3acf81932adeffa25244ace6b2bc5e
SHA1 f78398f7d293903d7c49e7654422ab842f1fd91c
SHA512 89b14f0b4143d29cd9757a76cb8258486c7b0befef64b56d22651957d1dd09794820a40069513516a64b3019078cb5fad2621e0c3c66cbda388e12d84f880b3b
SSDEEP 24576:7fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnQrKhxr+EHNmT8oW4ll1JCrLKXI:ja5POZ3+Jt2pasx2+m9hxSMmT8oWgBC8
TLSH
T17E65AE5EA7EC00D5D579D17DC583861AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e5e8a063e767655617dc13ce8e31b4ea2eb40fc941b89ecc688a7a23a20eb126
MD5 d1a53362dd7246e48b80700866708c00
SHA1 e97035b315f277c3404bd85a723642f707bcde69
SHA512 49576683787fb20d744c1d842ddd4f7603aeef5ccd006262fa592e3492173d6f64ee1faef4605c1d94cf510a2877db362c50b3f1dbf553089680c2c32dd89406
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkWrKhxr+EHNmT8oW4ll1JCrLKXI:ENc/zEOVHF8hxSMmT8oWgBCaX
TLSH
T133858B2623E900E4E5BBE1BE89779546FA717869533086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 82ff2080ab5317a8ebd792fdb794879e37fe2fe7e3efb638c50a5794aa41c1aa
MD5 96852bc2669ec547fee94a48cc299bfd
SHA1 c3a5ca7026483b8e2d20fa0165c2aae3264b248c
SHA512 30ad297da68f4bdf9f3c5037a09c1bf72c00045d00db013a499443a54b7cbd697a9e60a9d87f25bbb35f910661a57c952a7f9a280cbbdedf25d95c448ee1825a
SSDEEP 24576:g6DITaKngL2jdshRTdG1YxITqvfPkbIcbjLm:g6DITarSj8RoTCCW
TLSH
T12B25126D63AA01F4D06BE13D96934506E5B2B67483074ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 271feb66e52eb910ae39d18d6912e6a2d7b04ff8fb8f01c79e6780a2adb76f5d
MD5 8d2be5a44df646268c8f9abe006f3f39
SHA1 2603c3148a6f355d665d9f8c1a00e684966d2d98
SHA512 37e43189ba91f3147326c7c4bba2846ceb6d2f6fb3097a79bb7eed755d0946bcb5136ab243a5d34a8311fb373bf7a550fe6513cab7fd4e601977a1dee42d79d9
SSDEEP 24576:Yty7aKngL2jdshRTdG1YxITqvfPkbIcbjLm:YtUarSj8RoTCCW
TLSH
T11715231AD7C456D4E97A27786EB385882D727E249B0783CF89E0E63D2F767D06934B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 04aa77fd9a0e306d8dec387fc5d9ecae63c134c10d6bcc2f15fda835670ef952
MD5 4fc4db93b68bd84e9a3307b0a0c1aff8
SHA1 90ecd1733661f9a337b24f94dd961ada5cd97107
SHA512 61d36c9534c0402505201507800a55eeb85a907c21e81a9c13b22685b740d45b3edc03845c5c1fc72d4382c8bbac71d3006e48e00650094c38c39ff70470f826
SSDEEP 24576:CPaKngL2jdshRTdG1YxITqvfPkbIcbjLm:CParSj8RoTCCW
TLSH
T1290523BEDBC45BA0D4167B743AA6A94D38B3376C970B46CF8CE0597C5E7A7D02638900
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 14501c16efc91e0022c80edadb2a923509d788f1da14ff31944b46b94f73f531
MD5 64bedf0cd0b5bbfd3e668ee9c613b364
SHA1 3d34c185799b0e5a59151b194bfa03ee31d615d1
SHA512 3d82675fa2b12ab4ac54805b390acf2942914b557382ecc22e6ed8adebcd853431be35af800e412372a544482a13da32bf3c510a5d2ca1fbdcaffbc2ab5f0059
SSDEEP 49152:jgb4mBIBhGFxhxSMmT8oWgBCaXNarSj8RoTCCW:jts+M4FHXNJTy
TLSH
T11FA5D01E22EC02F5E0FAE3B89DA64407D6B278165332D2DF1151426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 3143098a1467111ffae72fd347e6909fd64e0444f4d73176f94f401d394a1da8
MD5 1fb6ceba230b76831a2da7658320121a
SHA1 ee2137d9a4f53cfc8fad22142b615c7333d8db83
SHA512 333b2c6ddb694f77ed627afe3772cba10ed2b4b4a5d0ec94fbd3ba144cbed21196f6989d3ef2c12d06b17f21ce29b0f54c3131bbc5f4ba09a691c211072cf4a5
SSDEEP 49152:bDMwBtOmPhxSMmT8oWgBCaXwarSj8RoTCCW:XFn+M4FHXwJTy
TLSH
T185A5D16EBBE846E4D1BEC674DD238516EA727861033253CF8290C13E1E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 e3b6ead4aca04e8792f927e3c61aeb6d763fcb38c8b4fc5ace305b4913e371bf
MD5 8b5adf3e0543dacd71829909a2f97cc0
SHA1 2ca7d29926d486a0bfca982256429b33fb5bf4f3
SHA512 e74982d0f0b73a52906bb61f28fcdbc6f912294038346c37ce28ee851659adb1a5bd56cc14fe6895f85a8958779f285884adc0af5c5320c8eb67e03626e61413
SSDEEP 49152:oDVHeBIAAqhxSMmT8oWgBCaXiarSj8RoTCCW:p+M4FHXiJTy
TLSH
T128C5027EEB5C04E4D57BD27CDA638A06E6B138AD031256DF06D481B91F6BEE42D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 48281d5128763b73dd53c3d92e89399498394617e373afad55df16415b5d83c1
MD5 953338333fdeb0256d08fb456f6c4bd2
SHA1 21b61169f33f52d7a99fc02fe2e0183369c567e3
SHA512 93f52e4e74bd809e9b9cca3db7d0141771b264fd14fcf49444261b2c50be4dbee04610f55b77fe883df663a4356fcab48c6a7a1f98058f9f8b399be9a5cc2cc5
SSDEEP 24576:AJnJPbzB4SwCaKngL2jdshRTdG1YxITqvfPkbIcbjLm:AJnJv6S1arSj8RoTCCW
TLSH
T1D135F13DD29810E8E4B7C2B4815A1B4ABE71387D2F1669CB59B4D5343F12FE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 fa5d0aed00be6c238f9380b0b212522ebf5aa329fc956e4274c809a9651ee710
MD5 090cacb364fd65802de594fdd156482d
SHA1 36c70bd3b30e7d0762a2e2609cc5daba16e5d0cb
SHA512 ee0a9b513725641bc25c42b4f74568ace3f6969a3afdb8ba0441cec0748a9093a028d3e5ab8dc45f4c14d8b4ce88ef8c80e36fa8a42673989343e2490161eab9
SSDEEP 24576:tbaKngL2jdshRTdG1YxITqvfPkbIcbjLm:tbarSj8RoTCCW
TLSH
T14C0523AFDBC48B90D55A3B743AA7A84D3C933B5D974B47CFC8E0559C19AA7E0263C440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 9b0d70b146312a051e2852f03734e0fc45cf489f58428bf92a502ce861b03e08
MD5 8d894bae63734fbe0e1cedba6db397e7
SHA1 35dc9071b1b7bd6e30496366234e16f896e50aca
SHA512 a642b3c038b55acb2833bc52185fdf0a4514101e46e94aef27ecde2cd85d45ec80bd4ad4bdb4ce165c59f1fd42d4aba9e9ba5b95559866a8cb200696b08cfc15
SSDEEP 24576:J6UqjpFUaKngL2jdshRTdG1YxITqvfPkbIcbjLm:J6UvarSj8RoTCCW
TLSH
T11615236F97C459E4E03A1330AAB6C10918B27E7A035B86DF65D4967E4F36BC0953EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1408-134-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1408-133-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/1408-140-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1408-400-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/1436-97-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1436-91-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1436-418-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1436-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1436-420-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1436-316-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2160-61-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2160-60-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2160-69-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2160-202-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2376-385-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2376-110-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2376-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2376-403-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2376-401-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3504-254-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3504-84-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3504-82-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3504-76-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3848-161-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3848-160-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3848-167-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3848-404-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4316-415-0x0000027AC13B0000-0x0000027AC163B000-memory.dmp

Download

memory/4448-153-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4448-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4448-145-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4448-157-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4448-151-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4624-330-0x00000000036E0000-0x0000000003740000-memory.dmp

Download

memory/4624-384-0x0000000140000000-0x00000001407AE000-memory.dmp

Download

memory/4624-1-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4624-11-0x0000000002850000-0x00000000028D3000-memory.dmp

Download

memory/4624-124-0x00000000036E0000-0x0000000003740000-memory.dmp

Download

memory/4624-0-0x0000000140000000-0x00000001407AE000-memory.dmp

Download

memory/4624-74-0x0000000140000000-0x00000001407AE000-memory.dmp

Download

memory/4624-118-0x00000000036E0000-0x0000000003740000-memory.dmp

Download

memory/4624-327-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4624-18-0x0000000002850000-0x00000000028D3000-memory.dmp

Download

memory/4624-9-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4624-326-0x0000000002850000-0x00000000028D3000-memory.dmp

Download

memory/5248-48-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5248-49-0x0000000001ED0000-0x0000000001F30000-memory.dmp

Download

memory/5248-67-0x0000000001ED0000-0x0000000001F30000-memory.dmp

Download

memory/5248-71-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5248-55-0x0000000001ED0000-0x0000000001F30000-memory.dmp

Download

memory/5368-32-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5368-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5368-24-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5368-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5592-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5592-131-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5592-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5592-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5988-300-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5988-87-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/6068-442-0x000001F8B6110000-0x000001F8B633D000-memory.dmp

Download