ce5fb2dae8b36ff491e62703f3937241f53ec44bcb6031c28f86b04068760ca3

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Size 2.2MB
Sample261027-wpb83sfy8j
SHA256 ce5fb2dae8b36ff491e62703f3937241f53ec44bcb6031c28f86b04068760ca3
MD5 4c2879affe0570cb359d0bd1b21c084c
SHA1 63fb2956661d5ba9ac3380f4dfe45dc7cdfde047
SHA512 46464ab6a1bc5ce0e6914baa1116dbe368c55bc38c0f895d5ec80d3ecb11c61b78533061bb259cf6c5b2b2d9f1fced2e4a1173ae2970059e62d3159e4993ae13
SSDEEP 49152:WoyibzBhJ6Sd2Vm1GzeD9mWQLkwwNjCRB6NRQzeq+T9DoUU926RAcJXazD8Arp4B:Woy6BhJ6S2Vgt0RAcJ89TETLZUY
TLSH
T152B5BF46A36504E8C97BC2788A16A507E3F2741507709EEF66E14BE61F13EE21E7FB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3996	elevation_service.exe
3320	elevation_service.exe
1328	maintenanceservice.exe
2936	OSE.EXE
4352	PerceptionSimulationService.exe
5812	perfhost.exe
3444	ReFsDedupSvc.exe
3952	SensorDataService.exe
2968	ssh-agent.exe
5492	AgentService.exe
3356	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8a38d5523a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000024b9ac83d66dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005fcd74c93d66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002ebf2c93d66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026e70ec83d66dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b566c0b3e66dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e8666c83d66dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f3e12ca3d66dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
3996	elevation_service.exe
3996	elevation_service.exe
3996	elevation_service.exe
3996	elevation_service.exe
3996	elevation_service.exe
3996	elevation_service.exe
3996	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	5492	AgentService.exe
Token: 33	3356	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeBackupPrivilege	3444	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3444	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3444	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3444	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3444	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3444	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3444	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3444	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3444	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3444	ReFsDedupSvc.exe
Token: SeDebugPrivilege	124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	124	2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	3996	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 3368	3356	SearchIndexer.exe	100
PID 3356 wrote to memory of 3692	3356	SearchIndexer.exe	101
PID 3356 wrote to memory of 5932	3356	SearchIndexer.exe	102
PID 3356 wrote to memory of 4760	3356	SearchIndexer.exe	103
PID 3356 wrote to memory of 5372	3356	SearchIndexer.exe	105
PID 3356 wrote to memory of 4148	3356	SearchIndexer.exe	106
PID 3356 wrote to memory of 3980	3356	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3320

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1328

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2936

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4352

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5812

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3444

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3952

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2968

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5492

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3368
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4760
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0fae8f1166a545ecd1ad1b25c7b2fdfd8019073a171beb07fe555de86d0ffeb0
MD5 f28c7b68395177a2438965b269597eec
SHA1 9c888de8dac7551c9fab3704f2fe67362dd798d5
SHA512 5b9153cdb7006b6cd2e0101dcae623ecadcf50e13c33ec12179e2fd53557157eaac31475810570e528f9e28113381cac9e52851ef498fef1efabe55579c9ac40
SSDEEP 49152:ob+632BuPkFKRrdE6ohQstBhuXjfS4LWxn+rp4YXxbuwETLZ8tYt:C3q6tjBf9TETLZUY
TLSH
T1CAD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 90eb7262d92e6154775440f0ca1326db329c386efcd396d8635d46895da05796
MD5 87f580e7c418648951c3d2ca596b1934
SHA1 687d63b0a866e23b0df417c559e510b259caaa9d
SHA512 e975c26cd42248e76b2f53a4742d0c87252bc70b3dea58f2b667e8748e7f93b6a7129ba8c6f4c2d9bdfae97e7a29d7dd7ab435d4fbbb77fc95a4bdc73fd76594
SSDEEP 24576:CXYfDtczA7rZvz4Yf+vo2ubuwZETLZ8xVSYYt:Jtcgrp4YXxbuwETLZ8tYt
TLSH
T1F875012877E408F9ED67823DCCA18511EA33B86647A4E79B03A0D9291F337D45D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 1ac6fe63f03e8010ed18a6120cdc1af876790cf30af53f88ae9a0b35e98cf2e3
MD5 a7dc85c027b145c80606725449c26c16
SHA1 b035a049e492e9d46c64aa41740776cc930e29cb
SHA512 687d8226709c7c1dc50454b6b42cb38a9db59ceee275dea78e77cbaa873a020ea097d5a5c7bf0af1bdbbacfabec09cbaf76b1b499492859658f5eada6e602df9
SSDEEP 24576:J0Le5ji0hmxrrMmrZvz4Yf+vo2ubuwZETLZ8xVSYYt:JPji0AdRrp4YXxbuwETLZ8tYt
TLSH
T13E959E16F6748375D073C0B9C5D2A68AE97230865B308ACB4286D77C3F67BE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e6abb13c1e076d899a977dbbc18a1e34154bd3b1f2e1fc79d8b869084d07d791
MD5 d05170444636521aae8d845f296884d8
SHA1 3a0cc3147b51d5fdd051da566258b92d47e4f2fd
SHA512 8cd9993df00d6661421eda14c4737fc7f366d3933046f9acc3a715b7722112adb5306d102cb5b88e0df64bb67fe412d8d7ace96d89a32d524a5be5f76fef7716
SSDEEP 24576:3a7/ezSC6vUyDZaqgrvWx6q8wyuwrZvz4Yf+vo2ubuwZETLZ8xVSYYt:6/ezSC6vURPvMHjytrp4YXxbuwETLZ8e
TLSH
T1DE756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bedf12e81c9d86534719b2a8f9819312a55d3df5f390b0573a6f60094dda851f
MD5 afa6b20a2a117d7cd5e581f3a4cd6178
SHA1 faa833b829e9bbd93e0fdc513dba51f4a6f200cf
SHA512 dc27cb456e307323f60d4c560af383d7787d148681e8ac6bedd7cfaa8fb5ea00e4fde257cd0cf794aa9038a0792c2805452151569a5ae62e8c20ad8142c0c709
SSDEEP 24576:nVbqPb88hv/lV7vrZvz4Yf+vo2ubuwZETLZ8xVSYYt:nVO88hXlVzrp4YXxbuwETLZ8tYt
TLSH
T193559E66F5B48331D073C0BAC5D2AA9AEE3234425B31CACB1246D72C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 c5bd91be85d2b11eb240e0c2f90eec5cb5a500b27758243ae2709c6b18710cd3
MD5 b3eb41e0fd550ebeba47fff058630428
SHA1 d2b8340ac8d9000c4f13dfa1861aca613b019637
SHA512 39191938c7ed2a51a172247e1e658d3a3a068ef0150bdb2db45b342a016fc5c6c18285fddc882995cb14613794e33a9a539b05d78cc252ef4bb22f4a96aab9cf
SSDEEP 12288:7j8919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:7jqrZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T1565523159DEC08C4EFD74732A9F058152A03DDB74A8DDA242A73F51C16B8BC1B0F927A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 1d7c7a10e44192b9efe2a40d86016a14681f82a62e5f3a89cfbc1be9ac8e0e73
MD5 a176d29b6c835ee2b2ce9547342fe6f0
SHA1 eae453a1e48098d7ce6951a6d5e4e9a0ee5db296
SHA512 386cf86b13ce41e53f3f8f9aa36f7737ea84da8fc4ce18d4d63655b226d9af54167d8ed6b5a7b284496a724ae3f46d92248792c60e3bca42fc8ac75644ce24e2
SSDEEP 24576:MJIUXrZvz4Yf+vo2ubuwZETLZ8xVSYYt:MJIUXrp4YXxbuwETLZ8tYt
TLSH
T17775DF3BEE28FCD2C27A8D795B918600A77278314F52A3CBE175C20E9E235E15D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e2c110119f638b2096de6a58ead0fd9fba30c99895bc01d5ebbc488c93425675
MD5 40440a367fe552146bdf8a078e68d2de
SHA1 6e286345e3014bd675b627cfbf06a5d2eb8ac808
SHA512 bb5ea37707157861a8e66e42a8c2ec93693f827e028588a24120fa4eddad55fb2cb2d2c207d931d81e828ff17c1875384991725332bba50180e2c06081f968bc
SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3TH0:iQvGAdlCEL8c/pRNw5CA9TETLZUY
TLSH
T1A7267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 830afeff81405b01ff61f6f2471f89daefb20c49747c4408c9ea739bb9c4ad2d
MD5 e5ae43136519e40296f899655374327a
SHA1 231139f977ee85443ca7d2d4563c44ed56fe13c3
SHA512 5cd386b28f1a331830d9a654a0fd19ff4b976a6a22de9eb3ce5735c68599a2d79ccfd3381747132f33c0f818b9beb915af58c11a0e8ad91d04702e7d95057f15
SSDEEP 24576:nMewsAjhrZvz4Yf+vo2ubuwZETLZ8xVSYYt:Mljhrp4YXxbuwETLZ8tYt
TLSH
T1A975E031FE74E436C7BB0DB21B35C716182DB9204F511AC3E3A89E9D59742D22376A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8898e55c8208b08de74f890bd614e158ebc3ffb40a5f910faba05630d143d66e
MD5 e8a6a82dc18921835ccd537a6e0d7a2d
SHA1 46a4e99a686d5f7ec5731ced10a2305befcddec7
SHA512 77a8a4505e22f8f1c392f2df14ad092eff96ed0c3a05797d2d632f654df9f6dd4253b5cc20f7abb3a1423b7842e14a1fd730895ca28f3090f909c8e0deb1cfea
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH59cLZP:kUEtQevvqc2W1cpV29I3259K
TLSH
T17A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c3877777b4616fc98c7e4644381cf8d408c10ca3912ce1f9543b948548bb65bc
MD5 5356c0b892d5f7fbd3eaff62ada06f8c
SHA1 3fc96141e9ae3d195428f0c0e8f2f132627c7bd1
SHA512 94fdc3807883add97ea54f67e948c8f9185819c9a8b560bc1218d126c393ee0eaa67d4f415312a13f2d9ef2d13ae373960f011fd29f2387bb6dd2bf8a1374506
SSDEEP 49152:7CbRquA/m2yL5zLfFiV+XenmE3/zBrp4YXxbuwETLZ8tYt:koq2VjnmM9TETLZUY
TLSH
T1F1D58D0976B881E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9f152004466dd2e1e81386c1245b080ad2bf76968d5199fc1b6f9e0a8520db12
MD5 a2ba380dd15d424e2996987efda7c06f
SHA1 31ed53edbb5d43c4382a6dcfdda2337397dd709d
SHA512 4940ac245a5eb046afc926b0339edf09b534857841652171b32b9b53ae28f71038031c8076d6887f2de21c29edf21aac2ec3eee99d75d111a147f35f820c9fb4
SSDEEP 24576:iAhGLmIFoiwtA5l7S53srZvz4Yf+vo2ubuwZETLZ8xVSYYt:iAM1Foiq5crp4YXxbuwETLZ8tYt
TLSH
T1BB359D81EBF955D4F5B3AA7899B68171EA76BCA65E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 c313ed5c1484fef3029c73c98942da44963d144c9c8fc57c1c7309ae5a6a2189
MD5 10d9d3c7046260ddbfecfde42379b51d
SHA1 b48c350e6bce2bdc02256f122d73e71372291772
SHA512 56918b6c6f5b8f11a838010fad8643c0c3aa5ebeaa8fda93804b9feb2baeebf80a84b44112bbb231922a627e5da8178c4699b04789bc47b56dcd931ef337145f
SSDEEP 24576:MwurOWNrZvz4Yf+vo2ubuwZETLZ8xVSYYt:MwkO4rp4YXxbuwETLZ8tYt
TLSH
T1BE75F04676E80CF9E9A7823985978136F7B3BC122A25D71F1760C61B2F37351AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 5ea376fa7a0d9d2070c033d0ed88ee70423f5ffe996c684c9d8406b225d2949b
MD5 e08a8eec398b010aa919a3f6baa1d9f7
SHA1 572a3ae95d430531af4daf8c38e559620d4cfb35
SHA512 81356e76da17cd3592fa1da1a40fdd61fc98edbfffe69e5b264087219d9d89b7777d72e2d2548d290bb0749d816b14cf6803cbe4768649f4901e79c3eb2eb993
SSDEEP 12288:vEZ1Iyb919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:8ZuOrZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T17465125936E820F9E6A35239D9F056059763B877677683CF262182291F73FC22C39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f93627905312dc75f1d4d3b7940c77a724579d2b44fa7e54e3e0e09353e961c6
MD5 c3e7f73b31e8c68ffa577151faad670c
SHA1 effea65637b572d8f541620176f6b1440d1a8786
SHA512 c9a620228fc8fd698c5b7a6beae35d8531c50fa65f1f93423fdec585c567ae8c9e2eabe5737431c347905c49c207b21d249105beef419ec990e5f3a59c801852
SSDEEP 98304:iQRQyi36YOcPuLvw2gAf+PN3j9TETLZUY:5QyiKakX+PNT9cLZP
TLSH
T15B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 31ce57928cd67f7817e5af7dc28803400f59895c936f81f60e1546c7ee433c2d
MD5 e5fb25e8b62048f884b277985f7908ce
SHA1 97b27968a5b65d122ec04cd5766f43465cfb5e0d
SHA512 35264102f1f3348f10935252e4bd6984954c12eebf2854da0d8a3d2ec12b20655f8703a2d3f5712716cad4c54dbcc06b5b03df8ff3c6a6b5a2a1834b765cfda2
SSDEEP 98304:jQRQyi36YOcPuLvw2gAf+PN3j9TETLZUY:yQyiKakX+PNT9cLZP
TLSH
T115667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d0d76fd0da3a1e390f6d87950c7f7c2bd6dc6a3ae052dac3ac77aa76f3b02427
MD5 9f6d8ddd1a233503691ca5face59e4a8
SHA1 45cf42fe7912c0bd286accdc570f61299e94f431
SHA512 97b6ae84d03213d122c798bd19a9bfe87b5dc97b45deb2a3713672e8aaffd4c62450ee53dd091d2152fe56d5cf2f85154af4b337f2adfff62b4e0c92115e1f97
SSDEEP 49152:868Qg55nhxeWu7PNU3/Rrp4YXxbuwETLZ8tYt:2thGRc/R9TETLZUY
TLSH
T1DAB55A33B2F60099C44DE1769F4A873196D27C758FE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 327562c7584275bed41e64c22d53a55ed9644ddbd640b78e21506c18a5148271
MD5 a99de6453b37153cb265756b9a5d42a4
SHA1 47b0c0d3fa1887da4dbd14f3a77a18f608e251e5
SHA512 4cecdaaaf09aab666a880821ba0a003838b45d7b2b102c46549f1f15aa6768a2da3fca71785a99bcb3777911b2ccd388c022d8040c5df58e5f3f1009996a45ec
SSDEEP 98304:oy5112gYy5azzVvD69nLKnhZq9TETLZUY:BLIH+WhE9cLZP
TLSH
T187167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 596ce3d217a49c755fe733df9043bceea8ac00a602b126e29fd6c42cfabfd8f6
MD5 c4651459de384cead7ec615f70faf67c
SHA1 a70b80451f4a578ae9cbd6815e0999b79e48f18a
SHA512 dbbec0ddb9fdb2d415bbc1d10c06b37cc23c50e84c4ac69451760c38c098fcf6216fa72ebde96a96db520eb0db8f23d90fa915907fa661ca44a4710b0ce18bd9
SSDEEP 49152:JB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glrrp4YXxbuwETLZ8tYt:fu6JmQxd2dr9TETLZUY
TLSH
T1FDD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4b5951a8828f228aabd03218fb898f242b760cd6857deed3d126388b26954770
MD5 689a6cd42e27b8c038bea830a0b41064
SHA1 85d07ff6835379315fcf13a1b0e6bc5016b9a55c
SHA512 c1034a603b4ca7c51759c60902c4a63e64de3d29266fec7726b4a6d821fd64b0af0dd8ea0192e3b18d8de338e41193a8538458ea60184c12723b346f75aae713
SSDEEP 49152:/1hpsNoJpF1A6yU44CwH7R4x3rp4YXxbuwETLZ8tYt:/mifPVRM9TETLZUY
TLSH
T184B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 83fada11e0cf5fffe54d0ffc03376b1de9c0f8610e93ed4935c2c5ccd41a4bfe
MD5 929028ff25e011c7ca7295a24f74ee55
SHA1 22603dba6cd6ecb39c2202f263915318d9616c35
SHA512 5ccaf4a17abce64715f84e8ff3022613b26aed3197e775090dc52a8192849fb5ff3a3132a14d5920d75691126c68064a06740d2c3a4dafba53e64d4df9a45560
SSDEEP 49152:HSuZQIY0Be2KIRVtOnks6NMHqOrp4YXxbuwETLZ8tYt:d5dKOi61O9TETLZUY
TLSH
T19BC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0f5c4163fbec67f82277e32b13368723caf019a2826ddd33f46fb09daedbd14e
MD5 716836471753e7f9b2f6d15e3b6d49b9
SHA1 dda0569383519aeec3e17818f440db7a835d76f6
SHA512 97409e28e3fe7b6a7275dce86548774a82998c90cd52a5bc8d8ec0e5fa0cf8bda037b17bd339a5650bb1c8be070720d708ddcf63234b38bd568af6f158f92fcf
SSDEEP 49152:BhtSn8EApI0figGgiDn0AP5w7rp4YXxbuwETLZ8tYt:QX2i/phY9TETLZUY
TLSH
T16395BE13F2D900E8D05ED174C7568632E962BC160B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 f5b968389b943d4efe18ff444eb2a28955fcacf020c30c399d11fc9323b8dae9
MD5 81fc7062d5b8c63dc0226ae22b9e404c
SHA1 1b8a255739266e8194e15049bdbfd146fe45d063
SHA512 a186b8b186e89ac4e0e2392852f0163e092105a7c28333fd9457a72ed4ef0d5a84ed7d0cd0eb0447f2efcb8daaf3a9ea43dc12bbeabb2c6c8e63f1df7c000e1c
SSDEEP 12288:uU919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:uSrZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T19B552315ACFC09C9EE828772D5E055551907ADBBAB8AD2343B63E01827B5FC130F96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 f41e1da33341dc510fe92b759e5365c13035ce26b3b8091dafe6f8e325c7522f
MD5 6bcfb307cc5188abaea867020917025c
SHA1 82b73409539cb3c172b5d048f4377ddd0ecdc8df
SHA512 b5e66b93064051c7e5427eb7049022a39de7ca4cd4213c107ef434cc0a7e89be7d6b06961c1ec011b4fe27f8184cf80c42f03e3f10cff75696d9eef694130d44
SSDEEP 12288:u/919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:uFrZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T104552315ACF809C9EE828772D6E055551907DDBBAB8AD2343B63E01827B5FC130B96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 ade00fd3de4ad5c122cf000dcb5fe93304deeae96ca756979f2dd0b777c19097
MD5 4802bf91bc7ed475c89abcf34a15f18f
SHA1 b4bd43be4e53e9b754069776aa8c508d949a0ebb
SHA512 91ed752d1eb6e9d796c82b39674bfd749100573909882d457584a902a59727e40e783055953433e5d39a632fee92fd9818dca1a210c62e7c9ddd3f9b328e8f0d
SSDEEP 12288:bR919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:bfrZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T119552315ACFC09C9EE828772D6A055551907DDBBAB8AD2343B63E01827B5FC130F96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 de224b028a0eeb58fcc4a740acc122f0eed155398a194906ad8e7ee8327f0e61
MD5 1ae4269d7119c5b8523089ee1ff4ead0
SHA1 ee16e7d642fb03799150b7920620a715b3f7ab95
SHA512 250ef16d783baf551cdc3e202630c85bf0cf5a4b1ef96b8902953ba67eba706f0ae8ca313d91c6c52aae0ea1d2cc285809f0822024e01ababc344152c2bad4e4
SSDEEP 12288:aVu919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:lrZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T1275523156DF805C5ED93D331C9A041156663FCBBAB6AD36F2B1294191FB1BC038B8BB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 f4e066b2f073d682e88c8ae7af95d6f95e7c402729263a8e3cf1652c76f6e7ac
MD5 e0a687c794bc4924d503a875304a69a2
SHA1 9f3c06e8eb7ae48f67268bbfc6bc687f4750e2e6
SHA512 8c8e5891eeada0062b51bcf882b6e000e4722da2b64657e4ed438f715e7f96e23a575c6ebac7000038de54810074a8f0979c92c60eb4b507cbc38141b6180945
SSDEEP 12288:lW919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:lkrZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T168552315ACFC09C9EE828772D6E0555519079DBBAB8AD2343B63E01827B5FC130F96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 2f21dc98a7dc9a2f28d34664dad0e4e2889cdb25b0e23296a6d5d2746a7605f1
MD5 c7a48f36d85ea5a0d7a0ad8f1ccf802c
SHA1 4bec4335df7378cbd6ce9eafbf1ae2fa79df3c85
SHA512 4e63ca925d85ea6b49bf0440d15a757c6494c9dfd164466829070ed02c6ed630d916e3574d4b46c5376644bd3a69f28effac3a02aa47b46fb9bcabdad6050b8d
SSDEEP 12288:ej919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:eJrZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T14B552315ACFC09C9EE829732D6E055551907DDBBAB8AD2343B63E01827B5FC130B96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 6446ed941824cbb8609be34a78f78ecbe8f74728679d6441d5b3581720d7464e
MD5 64355de3d4c609fb5437e6231eceecdf
SHA1 86964575c15213ea2d9aa903790e5a2f2455a445
SHA512 a3d603037502b08f09a56a23255e5048f1f700fa3f3f58509c1538846bbf9c862b9af5a9e6b4beb6fa7ce66293d530045d1b791523592c4704422da56ca81dff
SSDEEP 12288:3n919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:39rZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T1E1552315ACF809C9EE828772D6A055551907DDBBAB8ED2343B63E01827F5FC130B96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 62a2049a8e9837a530cfe8206f1ee066e28d27af9160e226fbc1e8f2d0b272ff
MD5 b7c44209748c784e404cc6bb6e51b632
SHA1 b561700edbfdc4fb129bfd08f569367e509881a6
SHA512 575cc1e9c2b377b1f8fabd98f9d9bbfe6177bb5ec42b28932858bae42ba0eaa0669bd835691798a3f99fb86a79f7076d1e4a8c97e3d65ab52c7b060705ea0ffd
SSDEEP 24576:GZM9zFVSOlrZvz4Yf+vo2ubuwZETLZ8xVSYYt:GZM9zfZrp4YXxbuwETLZ8tYt
TLSH
T1EC750255B3A01CF8EC67823EC9558905D6B3BC6A0B60C61F13B5362A1F737911C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 e5b29e3e2592bd2b84f86ba3faab671f0f08508589e488dffcc6069f804d3e51
MD5 071cab70049a886c4af54fef0b74ea05
SHA1 00c20e380bcd5bd959c4e9dd9aae16d11aa6e5e4
SHA512 32e7c7750fb267c5ef6f5af57374f140ea49d200fd6681f736ba1df8bfa067ce9ee59e4502d090c5e08595b8988b0a0ea9903d7120e6dd5cf6025576c6e5976d
SSDEEP 12288:4A919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:4erZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T184552315ACFC09C9EE828772D6E055551907DDBBAB8AD2343B63E01827B5FC130B96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 6b34eeedf042b9ea697cef66004bcbda7c4ed08153d21bb76d30921573b92223
MD5 cff8d0d3b3f8dd7ddcd97b1bb4a1f944
SHA1 7aaddd47bf11c7a67a75fc1220a4ac54a9f8a9c5
SHA512 fbfc06a3f1daab03349500cb0c6a8e2cfdfd0e3440df937a0c4764db28ae613a65718d5ab1a5b172d7193c1842e410850dcbee2b3879aafb6c49622851583ab6
SSDEEP 12288:Zs919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:Z6rZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T1C8552315ACF809C9EE828772D6E055551907DDBBAB8AD2343B23E01827B5FC130F96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 45801ba60f8a8c5bc514877f344fc18f24128746676d19ae25f1a04d88f86b6c
MD5 9a220beca0ffed79705c00bac816dd1d
SHA1 aebbef9bffb69d79708425d4017c39a962a050bb
SHA512 6039b6a94a5952f49f62aa11824698328b4e49790fa854208b297e8765f28e74cead846a301fcffe3ede510a932d89082f341de633d97ba5d2febd8541f66f0b
SSDEEP 12288:GyPz5L8b919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:7zyxrZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T16365020776E520F8D5678235C8A11A02F772B8374B248AAF2760463A2F777D16D7EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 d5158c1ba4780fd4cb768497fe0e4a53f5e53fb31a7cf1de488d0369f791e644
MD5 d97f61c7ba691178eb63c896aa780c0e
SHA1 d00d5ff8112c39483d1d3e39b15d7d158d859e30
SHA512 7f469f086cf6a5fe8561ba8e6d2d0b375453ee6391eab89e10fb9d26d9a31485b36c23c2157ce4ab1077f2b3aaa0424e899744120110a781ab8bfbe3c2603b52
SSDEEP 12288:iA919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:ierZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T172552315ACFC09C9EE828772D6E055551907DDBBAB8AD2343B63E01827B5FC130B96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 48a9ef0ab57e857281c9da50c20b8e4dab21b6fa0f064f1895b120f8afb317b3
MD5 1d24aaaec425bf6b7cb204c497427e53
SHA1 b3acb408d5903a2b0a4f82b6a549ac246b7a6c54
SHA512 e7b1ba78ea85f4812b02e437f21e409993d9a5826f0e428e5558d0cb101f6317371d80f52350935e18fe54001325023577edef0d02d990eccada790d7fb3bd39
SSDEEP 12288:1A919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:1erZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T1A4552315ACFC09C9EE828772D6E055551907DDBBAB8AD2343B63E01827B5FC130B96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a272ed44ac99c0a5f10a4545f657fc30ee3104635ac761b70f06df4fdac2b3a8
MD5 c02f4a0e8574ce61ea250e3fdc2eb337
SHA1 2ad8d9aac25320ad6a9676abb80b3cfb8eb0a3ad
SHA512 cb9e7b6e12645d6a65375b6930954ced8aca982a5c3e21db9a0eef5bf47770540e805a1bbb1eca31bdcd80e1063d43a5a36ad00e8ce4743fef50e06427f78eaf
SSDEEP 12288:WyPz5L8b919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:rzyxrZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T11865020776E520F8D5678235C8A11A02F772B8374B248AAF2760463A2F777D16D7EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 c06ca37ed918a5d3cd04337fa5dd2d35014654a66b551946832046d98ce808b8
MD5 3188a237d6f8341962de0fd49485c5b6
SHA1 de1dee492c31241ad88d9615fd56788755e61242
SHA512 d60d89132ca7f50cc8dfba689b52e0c7fc06e652263ab62c4c47ba085bc09cad0eec0636225e62da34cce3e7fad2416578bcdafe965c44d14e6247c23e7de4d6
SSDEEP 24576:5TyaLl3z0zDPrZvz4Yf+vo2ubuwZETLZ8xVSYYt:5TpLljwrp4YXxbuwETLZ8tYt
TLSH
T180750295B3901CF8EC67823EC9658906D6B3BC6A0764C61F17B4362A1F733911C3DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 54b87e6c23b94bdcec2857fd5fbb86716bbea98344d22b08817d773312adf7aa
MD5 438d7743b29e5b494242a6254869c225
SHA1 07bd8f78af043175ca9e1d958a63d7c76f3d6f28
SHA512 143357458f342fe25fc72ea61f180168bc5b409c2e8bd585eb094cf8feef32af71ad9adba34f6f625fa1e1f02d6ee5a8dd5f72fbeb7781cc9095d39d8f1af1b4
SSDEEP 24576:A3Ud9CHKy7GZDrZvz4Yf+vo2ubuwZETLZ8xVSYYt:KUd9CHKyaZrp4YXxbuwETLZ8tYt
TLSH
T12485CF90F3E414E8F1B79A35C9724511DA767CAA1B21DA8F03A4661A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 b5279ce4c907b8772d38fba71fc36fb54e5b1b2f26252a197de644c23053f28a
MD5 9bfb74c7621d7cd2027a697a052b54d3
SHA1 77cf2b6410046049e9dad7df5ebabe5737021ef6
SHA512 fa29c79fc52c5d20b07da266efddeb4b849b3cfe3eef401e6de93e63e88a3f4802b1ad70fb0ab17faaf4c7a61d3a2f58ce32a0f15c6d361e634d06bb7b7c6344
SSDEEP 12288:3x919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:3/rZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T12C552315ACFC09C9EE828772D6A0555519079DBBAB8ED2343B63E01827B5FC130F96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 271d99186e66fff3890f829c7aedad8e0c23203e70a53eb8d5e034cd75385def
MD5 9501572b05c31fc45c9899e27173bc8d
SHA1 8030a6a13ea55023acd963ea95d31122330776cc
SHA512 39d4066d51c034f9b53d2f07e9010ce632509c0ddcd14223f947a0e4410f8b0461beeeacf3bacd81c8200cc350a41e567aa0ee8260436fa08b59fc8c58d3f7fe
SSDEEP 12288:s7919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:sRrZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T193552315ACF809D9EE868772D5E055151907EDBBAB8AD2343B63E01827F5FC130B52BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 e21caab434b93f0c483f0d405fd94fd41d3d6c8ba15e42bac5a23b77ba572bea
MD5 fd521316f3ac44ac8afa341a8aa3b421
SHA1 cfda3dd4396cfc7a001ff6cb21fdbf8768358baf
SHA512 78794e9a78f2df14da32fbc15f80e247f2b1771cbc85f0be1885d47a71e23c56dbf2c41207e201e238c5acb91b5ffd9920d76cfd4827300a3b1dbb7484cb853d
SSDEEP 12288:qq919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:qorZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T15D552315ACFC09C9EE828732D6E055551947DDBBAB8AD2343B63E01827B5FC130B96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 85b88e98f84cac9161787eeefa1a3d0328fb2e7842e8e543c03d9b1a454fde80
MD5 fe6044df8b9afbf208fee2568c5870a6
SHA1 4eac826764b350e2e05759379d3c156d9dce3150
SHA512 3fd0be40a9e2462c5767743e1c5ebcf3faa5cb1c3d15d95b8452aa3c4f70a1ed8a5647b76324d78172828f6433b465cbb90ffb4829379b1de4bffa0f5c6aa436
SSDEEP 12288:NA919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:NerZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T1FF552315ACFC09C9EE828772D6E055551907DDBBAB8AD2343B63E01827B5FC130B96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 872d0652a9ecaf87dc23ab770f13dc5e55ca4cf665b0681e4cb8f33833b33a93
MD5 e1848def590a3b2c6ed34c68c914d0f2
SHA1 d103cf194e5053811f42ffd59c3075473b06ac88
SHA512 f692d58761a55677f36d4667413df75f5c8e2f4bfad14b71812bd167292668c7524f48291cf8bd8b93a913b501d19efad6651f642ba23b773493a6558a9c285f
SSDEEP 12288:2x919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:2/rZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T1F0552315ACFC09C9EE828772D6A055551907DDBBAB8ED2343B63E01827B5FC130B96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 89afb0649cb834f2bac17a3bcda3fef4625ac9e342e8008733dcd3195a3288d3
MD5 d8c27ff9e2646e13fd1a3001522079ff
SHA1 e962fd4a838a2e86d03d330feb23ab20dc329ca5
SHA512 31e22eaace3a460db77df2e4eb73f7d7fd0f5dcc09d02816884e6208049e9b30e572923bb606a55f8b44b09361fcf754f4391c0fed7fa6dc79fcbaba9d4b3d21
SSDEEP 12288:yo919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:yWrZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T1BC552315ACF809C9DE828772D6E055151907DDBBAA8FD2343B23E11827B5FC230B95BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 d3f088d5cac18891d9bc922c480ed1cb98f68ea1926a63ef383865e7d0eca247
MD5 5447a68f0c07bfc02d1f4019b0be7642
SHA1 5321cd830a49765566a9c7965af7c615739c0575
SHA512 3eb6a32c38fea80c3fe0eba9698ba35726330ea473b47f1037b4b843e2805418f00c04753c17ceab0c1acff676047aaf83225b16de1cf42df3682119d35a5d7a
SSDEEP 12288:8W919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:8krZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T13C552315ACFC09C9EE828772D6A0555519079DBBAB8ED2343B63E01827B5FC130F96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 bb7a5015b84c983bc9846e796c676cbaa3034666994d56d634aa77b4a2172ef9
MD5 06742267bfe05c8c4f8931d2a9a3019e
SHA1 3950c0ce05d21f1468d6afae1655c73a98a7bb6b
SHA512 c671b254a7244021d135fcc6df6be9bd02915f84dfac01bfadfc9059912b8b823f229cd11c7f6bb0b656a0a0bc6c98f41f6917a9f0ca1774db9de4c039a95e13
SSDEEP 24576:dfwvSk9RX6wkyAIKrZvz4Yf+vo2ubuwZETLZ8xVSYYt:tMnYIKrp4YXxbuwETLZ8tYt
TLSH
T18185D029EBDC04E5E1B7923C99B3460AF6B278691B31C6CF125A536D0E37ED06D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b935df0ba658e9df6b2960f9add89ce9c6862c59bcdba01cdd1c29a1fdb9c359
MD5 fdc0310ae9c74d6e63fcd26fc24f0032
SHA1 19fac621aa174eb9350047271360ae05ee489e1b
SHA512 f714f85b43889f10f77caebe8b6d974bfc92a4058cb8b9a6e1065ce525559fdf3e4a691fc859616be15d1b72f034e4ba6b09fe44a6d5862afcf697c12714ffef
SSDEEP 49152:RYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0brp4YXxbuwETv:/ySzPD9TETLZUY
TLSH
T16F066C56A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c89e1f12d4c4d3f4b877141791b620568b1ce8662c8fbb0eac87ea4f5289288f
MD5 e3fd35bf970ce9609a2d5743d269f5a0
SHA1 dd87f2adda9d3795fd0e4b5ca7ba1937ca6757d8
SHA512 8ad73127f4af13779362e3a9c81f0407090b606532784d0b9d7a81e8c482420ff7b6e1841905465389708f3e858ca3bbb6a1f50b72ef4fb34889b4e75065ad40
SSDEEP 24576:V47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AY1rZvz4Yf+vo2ubuwZETLZ8xVSYYt:V47JUQjairIhCnDHUPfF/rrp4YXxbuwu
TLSH
T18A65AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF2270837D6F63ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 85ecdb0e66d3a6946b3a8f5693b9fa0a7a71ef24eee8d88c7a21a4011922b27c
MD5 37c3dbf5ea8f4f80db949ae6c2b8c603
SHA1 21bd08476ad345bc44563bd47576a4cc848151d8
SHA512 2b92263c6ca18dc66c916605a4153363d095cd3cd55494d353e98d03c305e7980c720ab8c32d3467bf33479b6aef9d3bde3e48e0a8f977dfaf909b9733a7a543
SSDEEP 12288:PgsfQ919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:fOrZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T17B65F019D2A802E8C4AE6235C7914A41B3237C6697E1D3CB26D1F53E1F76AC06CFA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 cdeb215e414730d093efd66eb8bba2864c4c344e13a7169be868ea5fefaa1ed3
MD5 5e417c24485d6aaf371a1565988feafd
SHA1 e396271291fad8da1b80fa1ab3c1d7a0e82fbf70
SHA512 60ee6ab882f410043fe466d4cc340dc20143bee7f633178260f3fd4af5179d26edb5f73b168a38db4f37f2e616664ad989818bfadc32e6e9a7bb12f89e113689
SSDEEP 12288:pcPi/Bqv2c9sq7W7zNK7IOfP/aRMNUjJnMA:pR/a2j7zk7IOX/aRMN4JnM
TLSH
T1084528517626CB4FC6A940325E33D1CCAB707D41EE446F0373C98B3F9576A59BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 088a561abbe8c2a62aff6b93da7faa9bcdf5b503b2eebea122489c5b76b796c1
MD5 9307f4ae57289a90f2a78b1d39328939
SHA1 06647a3e00301c545ce3524e831e22bc9712c0e6
SHA512 9d6e5dd59f1e28aaa0feaadee223ea14e9653ce54156119829f880b2fde42a3bcd128056f4fd3c174f3c91e09a5a0da6b9ac1d2e44f3b0aba00d96670d485015
SSDEEP 3:OlH/ltbaoBRlQvXR2W/Y3mCllltq3mCllltGlslslslslslsl6y9zF/t:KpiQGamCtSmCtEEEEEEE11N
TLSH
T19C8192988FC01A64D68A223144A8C3C903E0C18DA60A43DF060C202A9C006840D02EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 7864873325c14ab3662647e8aac7e96042ed8df3640849aeca800432be6ca8a7
MD5 803e984d91874aba27ebc53bb4dc15b4
SHA1 bd88a2300ab30c240a418b8b2b7b906210aa0673
SHA512 9f643035e9778c6eb7dc8dc7c1c724091c4775dd5c920a63f6d4fb9690bb174fff235ec90bf86c525e998fd2235c282026cfe6f21a371d750fb782d673984f57
SSDEEP 12288:D2n1gHFXAyHLCT9FA8jT8H7kMTXy2XOXUPCNuI23OXUmZw/F3HUie:DQyHQoHLH33mZw/NHde
TLSH
T1CD7509815537A7CFD1FA6032033A6B8DB764EC02B7096F2673C9053AD86AB45B0B97C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 39a18161a212835db953b095ee96260bbd6940e9fd11b8cd4d1671fed233f5b3
MD5 1de500f31cac652e0948b745a217d90a
SHA1 5ea88d392daff8148f58378f6d95b634fd150521
SHA512 cf36e2f904172c857d63b1a977e8a61f4f40b1988ed243ebc8cb80e16478a32d9c520d17de841644b46d16e8c41f0288e030d0fb22fe019b79d948c95e97993e
SSDEEP 12288:XC74919Q+vzcfY8E8fs+3YEdo2+BELg7iwZBDGTLYguSUxVSwtYf18L:GGrZvz4Yf+vo2ubuwZETLZ8xVSYYt
TLSH
T1C15523119EEC0DC9FDA6973195A48120260BFDBB4F49C2E73A12E11C26B4FC16CB567E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 21929602e81b5e7fae6ff97dea5f38e84dadb2ccf672e5f45197fea25ee08a11
MD5 07fe092a81626408c6e479a44dcf730c
SHA1 e9b08ec5361f4593d0b02ca72ba8af91c5f1a767
SHA512 cc42dd79851da7c13954acf8377cec897425bf5b1a2cf5d9deca87d9ccaf0ebab012c1840e540f9e9509e59f29629f21f85b0e02a4ea2caea62109af3283aa8d
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bYwrZvz4Yf+vo2ubuwZETLZ8xVSYYt:Igb4mBIBhGF1rp4YXxbuwETLZ8tYt
TLSH
T1E6659E1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4a1179a4c18abd1b48941ac07f70b50ba651944aef3eb2add628ac418576a3ab
MD5 d8877f0ad7a124f8ba5c4b7185458c5a
SHA1 b499c5dedb1862b9f587f1200a555ee93cda4725
SHA512 d9a3e67b72a6c643d0ea22e2eaf60bdc7115161f30d47d988e79a3f38fe127dcaa1b5a32e947b7606edf68e14464d6285a261c77f1a0bc9ae8dba04f8196e5a2
SSDEEP 24576:CG88u8FpJqH1bzria7/mlrZvz4Yf+vo2ubuwZETLZ8xVSYYt:Z7ZFPqVea7/Irp4YXxbuwETLZ8tYt
TLSH
T16395F16576E501F0D47BD1388A824663F6B2B8261364EBDF07A88B551F33BD10B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c3400cfa7740a4f19039b656411b8684489c74c941aa0cbd92b99bfdd2bf4489
MD5 11cae4e4c56f26109d0791d5d0370050
SHA1 7d0304c9090a06477a025dce5859b6cdec4c7d37
SHA512 949849f4f06d8d7f91dd593d2d8739893ce09a1811edb6c7027cf2a19fb16299533ca73c99e5e21b48e951dbb917383c3541c02b0561041e6d407a3d49e77701
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJrp4YXxbuwETLZ8t:gG05lO43bi9TETLZUY
TLSH
T154D5CF6E62EC11F9D1BBC17CDAC6460BEBB23825032556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 dc5fb1f7754faf8d00bc383fb7323d935eab06b6443d44f9bca72f7e04dd3355
MD5 a56ed3d253a0aa13643ad7b28c24e419
SHA1 b5576e9733a70af51ff0ab42e3719c895a530cf2
SHA512 c0d30f387099592b33e97886b5695e53569204845b0ee0f8f467cbcaf8e492800b5f542181c3a88781b8cc725d601f39716d3961911b5a9b2b544c6e8612d357
SSDEEP 24576:+fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnbrZvz4Yf+vo2ubuwZETLZ8xVSYYt:ma5POZ3hJt2pasx2+mRrp4YXxbuwETLL
TLSH
T19F65BF5EA6FC00D5D5B9D17DC583461AF5B2342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7389a555279293b0c7411889a80804302216fd5053a8f158da4a2887a59eb860
MD5 27fcd97ccda7f2a3fed62f7935833a4c
SHA1 397019c6ed95d5590cb6111dee3ccb2558feb2fc
SHA512 4c6e579f8a3ca42ce2ab1850aa54d7d89dc83d44804d304f01e346eb24482205cf1d311273956a940b1c13f27340fb5659d11184a1176ae87502def06a772279
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7FktrZvz4Yf+vo2ubuwZETLZ8xVSYYt:QNc/zEOVHForp4YXxbuwETLZ8tYt
TLSH
T14A858B1622E901E4F5BBE1BE89779546FA71786513348ACF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fd0c7befeab0eef1eeb844ecb60015d27c1acefbc9812d29dbfb3c422d2d1635
MD5 c54ed44dc9d031ed2b1a38bab69d2996
SHA1 901656108c1f6b54bbd9842eb6dafdc802ddd996
SHA512 58b491beb8ae4252f597206a7e05117c48d48dce7fc45b72e7bad1901931ca69b79389fecfb2892435a2eeb55d8d255ae68c17c767e9a7f81a3654936ddef1c6
SSDEEP 24576:83kNvNnaFeYhJNtmZBmnrZvz4Yf+vo2ubuwZETLZ8xVSYYt:83MwBtOmnrp4YXxbuwETLZ8tYt
TLSH
T17F55AF2EBAF806E4D1FAC6B5CD238512EA727461173293CB5390C13E0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b7e479291f87e732ecdf2b7d7c7cfc743f4a22b153378aa9b8efa0074cd7d6d3
MD5 195bf1bd245dc8dcd07f9b3128c7a4a8
SHA1 a43c0f5c78def09c252a8836cbd90a4aa5941ce4
SHA512 52f0e50edf16ca396331bbf30c4c7b03bcf2f80acc38c7901d6875d190a8bc7849cbd5d703b9382767e16a0ef7a4c06863c99feabf3778886b2a19eac4b23dbd
SSDEEP 24576:kPUr+NQZrZvz4Yf+vo2ubuwZETLZ8xVSYYt:kJQZrp4YXxbuwETLZ8tYt
TLSH
T1A675E12F66EC18E5E676E17D85828619E772B8621712D2DF02A1813E0F77ED47C3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 5ca0149e42e13837b9b03f63fa11325f87850c3d29533b7b3022d4acfa584eff
MD5 5b19ee37b31f445a321ab99e9645161d
SHA1 89c532fa921020575a0376a7cd228083b192148a
SHA512 ebbda65ac92a2fb7e7337bd22256eafa54cb06a09afd5453f3d7440a081a0514aed431a154dcd462a6387548ef83aa7d372f9614fbf8de04019f649127554bb8
SSDEEP 24576:uD3FHshBIYQgAyrZvz4Yf+vo2ubuwZETLZ8xVSYYt:uDVHeBIAAyrp4YXxbuwETLZ8tYt
TLSH
T13785E13DEA9C04E4E57BD27CD6638A06E77238A9032256DB1690C1791F6BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-94-0x0000000140000000-0x0000000141130000-memory.dmp

Download

memory/124-1-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/124-9-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/124-0-0x0000000140000000-0x0000000141130000-memory.dmp

Download

memory/1328-52-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/1328-50-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/1328-45-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/1328-46-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/1328-39-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2936-280-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/2936-54-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/2936-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2936-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2968-112-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2968-311-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/2968-122-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/2968-120-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3320-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3320-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3320-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3320-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3320-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3356-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3356-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3356-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3356-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3444-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3444-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3444-92-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3444-86-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3444-327-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3444-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3952-106-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3952-100-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3952-118-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3952-313-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3952-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3996-23-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3996-119-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3996-15-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3996-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4352-65-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/4352-306-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/4352-67-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4352-73-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5492-133-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5492-127-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5492-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5492-137-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5492-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5812-77-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/5812-82-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/5812-95-0x0000000000400000-0x0000000000552000-memory.dmp

Download