e85ece7f3959d62df7a5d3a59363ea3a75e177d8dbdbd985fcf02436cb0d27ba

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 22:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 6.4MB
Sample261029-2htgnsft7v
SHA256 e85ece7f3959d62df7a5d3a59363ea3a75e177d8dbdbd985fcf02436cb0d27ba
MD5 9dbb3d1c91d3d79fabfbcb744cf73de7
SHA1 085a750f93af92821a4b485accd5859d58e1e215
SHA512 17f5c75e4ea88bccec1e440341d0da8b0ead752f9ea20a5772989d23d577302419815175ceda6b3e00713dfa037c61d6a072f6e186b6cd4c6c62c29d69de29f5
SSDEEP 98304:Qf+5INhrKmsxFM6dsepXd+3Ps1PvQb6Y+k:COmsxFM6aexd+/QP9Y+k
TLSH
T1CC667C5663F802DCE0B7C678C6264A13D6B2BC165771D7CF1264956A0F33BE18E39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4868	elevation_service.exe
4664	elevation_service.exe
2240	maintenanceservice.exe
4644	OSE.EXE
2404	PerceptionSimulationService.exe
5620	perfhost.exe
4700	ReFsDedupSvc.exe
3852	SensorDataService.exe
1072	ssh-agent.exe
2296	AgentService.exe
1480	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\962ad35a3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0a00cdaf567dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d4f9ed8f567dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae1ca217f667dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc05f4d8f567dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f06321d9f567dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb808617f667dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000093a4ad7f567dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e9b78dcf567dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4868	elevation_service.exe
4868	elevation_service.exe
4868	elevation_service.exe
4868	elevation_service.exe
4868	elevation_service.exe
4868	elevation_service.exe
4868	elevation_service.exe
4664	elevation_service.exe
4664	elevation_service.exe
4664	elevation_service.exe
4664	elevation_service.exe
4664	elevation_service.exe
4664	elevation_service.exe
4664	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5304	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	2296	AgentService.exe
Token: SeBackupPrivilege	4700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4700	ReFsDedupSvc.exe
Token: 33	1480	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1480	SearchIndexer.exe
Token: SeDebugPrivilege	4868	elevation_service.exe
Token: SeDebugPrivilege	4664	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 5116	1480	SearchIndexer.exe	102
PID 1480 wrote to memory of 1624	1480	SearchIndexer.exe	107
PID 1480 wrote to memory of 4416	1480	SearchIndexer.exe	108
PID 1480 wrote to memory of 5836	1480	SearchIndexer.exe	109
PID 1480 wrote to memory of 3568	1480	SearchIndexer.exe	113
PID 1480 wrote to memory of 5484	1480	SearchIndexer.exe	114
PID 1480 wrote to memory of 4440	1480	SearchIndexer.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2240

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4644

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2404

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5620

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3852

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1072

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5116
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1624
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3568
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5484
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f8215ca869d39b89000ce04d5e3c3a2264cc14dd7eb2ac09d8cb621a81f16a58
MD5 c4be84004e7146a1e5c3279ac8d8f2ab
SHA1 81b02a509125aad915c803a97dd6b4fbe555ff3d
SHA512 2434170a3f877be336e7699eba8b0555e25c0acc291cc87c15253b45c11aa3fa4f0aeca0d4bf121fa3ba3bad56857f6ad34a6d462f9dda5c20df8153657ecdce
SSDEEP 49152:gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnYB+kn3Hnx:K3q6sjBr+k
TLSH
T178D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9d94bf9a8cf6c802ab969d70a3b7cafb02f9cdd15afc4fd80b032f02e581b582
MD5 dbbc19c2e8159f8d5993e07bf7aad3ac
SHA1 c4093d003ad2f1d6711d5827a1c0c40b97f64ecb
SHA512 05b711a14ef7fd9d050214475d836b1ebc93d9817d29677176a4e17c0d1f71f13798e67330d2eb21f537d2b5f1eb8f69201b3ac44eb97f3f178ea52e09568aeb
SSDEEP 12288:51XLsswWkxy2lRq2czAtLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:XXYfDtczAyNyBo4kx929bL3Hnx
TLSH
T1E165012967D409F9ED6B927CC8A28511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 b57f549357384bd9c0ffecbea6c20d6443cdb028bbd044893765f517dead93e7
MD5 80bd60931751279c267848110e6b9c66
SHA1 f1bf711eff221213e0a4e21d667188f4b638ad85
SHA512 54118b2f0c42f369f8a1faf6898cac722a43d280eb92e4e639f582d857f6e03b377cf190210029574f584f23f14d90e6ac6e2f2f4631809c873ccea2034a2208
SSDEEP 12288:NXZNYVLeyUji0h90ZD0wxpGZIVuFrHsALDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:j0Le5ji0hmxWrM/NyBo4kx929bL3Hnx
TLSH
T154859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dc0c8f2959174f6893a085ec51a1ae1e11347f75a4320199676ccf3af9b3d1c4
MD5 bc67d131a7dac6621d4e0be87f99390a
SHA1 327ede020e6cb03c7fe1a2b036430bd1a1b7b40f
SHA512 d7c1ff99c8276717d746430825e6addf80a2583b0aaa3990e2d927b287f5b408a9956c45e0b300867edc0b63e700fd199a915367737e776e0a3c9e14150ae9af
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWn6q8wyupNyBo4kx929bL3Hnx:h/ezSC6vUzPveHjyvB+kn3Hnx
TLSH
T178755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 eb08bd3714f6fc0ac2348b2994bb42182d242a97960f03775d47b12a5b8fb9f0
MD5 19373247c63d572c0b9452cead3c1aac
SHA1 7bdb8773094e4fb85235ce93e0c0b8777a4cae70
SHA512 bb00f51ad224d0fa8683a8c6d01ac94ae8e1d8252a25f562759e4a4a1f632915a09b95fba67bb4da089ba5c07bdf73734264d753b24c31feadb493512de2e4fe
SSDEEP 12288:bVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98JLDAptNyvUgXZ32dT4ePc7N29CD:bVbqPb88hv/l+YWNyBo4kx929bL3Hnx
TLSH
T134559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a5c289fa6091f88eaae120fdbd6eaea01639457b91b83613649fc636f22df2f1
MD5 0f75934ff989bfa547ba6fc341b541e7
SHA1 f35486bdc75a6ea20c03f3db499c123d5c522590
SHA512 2b07136bc483671255f3c9b7bb149287ec9d25cdfa02b5a9d5dac1a14d4a7a55f55eb03bd23f350d82242ee1601d0588126c1876d94f05fce738e23b618c3989
SSDEEP 12288:dxsLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:dxzNyBo4kx929bL3Hnx
TLSH
T1A4452312470C627AFBBD3E70759E8454CC35BC8D0D95DB98DE62ACBB58BC9A2CB21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 75dfb78e8aace0265c81a250ef2784464165c39e1b0b0cc69bad29180d807bb2
MD5 fd5d98cdc0e0715a17f07213f5e8e00d
SHA1 f181d7c1e70cd10c05e75cec3c5b719cc989a424
SHA512 82e3f192033c7c3ca7e97f39f2b8970b459db20870f7b4b9d86257a499b260f1ba6076e367c5187c845e44dd36b7652a69fe9950b3606ce7cbc1dcac1255d880
SSDEEP 12288:BeBNUbTVO86UhLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:BJIUeNyBo4kx929bL3Hnx
TLSH
T1F265CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4ff75c1a61178ee742a6d369792801812300412fbaa5e084e33526d1a8f4c20c
MD5 af66f6e2a7b962dccea7bda9d3c1ea4e
SHA1 1b518cace8d59c995f8cd04c5ab42e3de29e343b
SHA512 615d1e7bfda8e8ff574ad999160076a7e12349ba506b9da6b0148a017d60f5fbd2f82ced38b3d4ec247d967a22d74b563b3ce5d8c1bfe466d5125e01440790fb
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THD:TQvGAdlCEL8c/DRNw5C++k
TLSH
T16F266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 4fc66b45e7cc3f0952a74ac8436f10889e0e9bb55ec1435e76da084c21319f3a
MD5 971840581ba5211e50011f44e4a1a506
SHA1 3003addc2d3fdff3d4c9467df308b96bc96d95da
SHA512 79f65200f74ddb04fe73b6826d951681db8559979ee64f967bc00818a7f68d1cb93f25ce3d781c343945d21fce03b576005ad5f40fa94ab4ea872c1cfd3b93a0
SSDEEP 12288:MAwSfxL/2Dc3nDLLmt0LDQewsAjrLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:xeewsAjoNyBo4kx929bL3Hnx
TLSH
T1BF75E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e6a236263c1f9cf0ca2f0ee644533854313f115295a2531b9a2c6a3fdb3cc584
MD5 92ecb9dabb7a615b183eed7e48f63363
SHA1 8f10df6fbd9ff911e53363309e50163e2414cb53
SHA512 827a52b2612c4151bf30696bb19746495595298669ce7a34dcaf7a9d0404283ee27a13e50d842ad4d4eedd9fcd675665dc1036268b372728cc5f278cbf5eb933
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHV+k:XUEtQevvqc2W1cpV2tI32V
TLSH
T13C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3fcf37683eaf952390522640f3f65de43ab6ebc22f7c31e6676fde86b9478c7f
MD5 c102bc045b5c90ff23ea0ad0862edf1d
SHA1 7ec7b46e16fe12cf24b19ad3b5d70f6e685bed76
SHA512 568a8e4da4b787c434bec546bc152816bba391328e8da3a2436813510aca4044a79fbfc75c5b1dc130b86d5196f6f54cf9321e8d7f1830a3d05ea32782040d7c
SSDEEP 49152:mCbRquA/m2yL5zTfFiV+XenmE3/zrB+kn3Hnx:LoquVjnma+k
TLSH
T1FAD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5914a3464ff288b9a28dc37b8218624c1cc300a235b3f22ae5e0c5d67987c6a5
MD5 b0deff840084bc9e9b255d77d1d6a0e3
SHA1 7e9ac0a21ef9945a024e48c62df52735efcb1641
SHA512 1541b5d86c2dd66311c163818e8db79cf784611148e118eac8de5588f8ca849bc3b366671bbdc0954f61662eda1ca86d8c08c7118ed375bf4a0292d6a3eb8444
SSDEEP 24576:yAhGL3IFoiwtA5l7S53FNyBo4kx929bL3Hnx:yAMUFoiq5CB+kn3Hnx
TLSH
T1AD35AE81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 85c59bb1f7c8b37b16d43a61d7ca0da6857e8acbcba51771f405668c57c8cbfc
MD5 cf75404b565c2a08f2fd7a9413b4d246
SHA1 87d48642eb3c78b74ec4791694e5e62a1afa0774
SHA512 8b8064431d054e6a45eedf35a6521561ac615982b212d1fec81e95def600121a5a1fff42c54b054de95012c7854b550ccabebccdf4da6e009e9d8dcb1d757e10
SSDEEP 12288:Wmw5HEjsChNzBFgl0WDm+CCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:Pwu6OW0NyBo4kx929bL3Hnx
TLSH
T1EF65F10677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e7bd8159b26256f249aad5d1ef0f34d624f02e540753b47318295406bf255da9
MD5 7113e97027b1db977ec61dc4f6f55f95
SHA1 0e19a81610f2c010393c566024f209feb76b5b84
SHA512 f191bb393ab2925223e5508028c6782ed9734d6943952002640de98ec00789ebe0c4d5894795eddc712014f36022651502ca86f146f7c01e85cb369ed447b394
SSDEEP 12288:NgZ1Iy7LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:2ZuHNyBo4kx929bL3Hnx
TLSH
T19C551216239831FAF2AB2678D8E58605CB32BC461B7183CF5A2145BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5ca3d0080d3e021fa1180eb6895e513109d363fcb9360455833eca3be0fdf6ba
MD5 0ec4e5f0cd53697cb82dae40840bdd08
SHA1 9f168b226757404875f4898d8592b5577cfd9e9b
SHA512 678c14a47a5c4018039f48846abf22e05f632bfd68c21ceda9796dbf5b99829357e8cc7c87baaa3f99e26025213d3e7a4fc9fa1e390ee6a095ada86ad6ef4228
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UP:WQRQyi36YOcPbLvw2gAf+PN3f+k
TLSH
T177666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a41b35c9ce7fd8bf471ab40014210d03804790495fc646165244b7c3720be6e9
MD5 1d8f8e2b0823526ef3024be80ab14afa
SHA1 8cc230bf1aff8c32612b8001a52df8bdd9ecd9f0
SHA512 542b7b20411ecef781e582331458e9792c44e73667d1251f95b040e01d245d4bb36362db953bc8454c34715081cabf741cbb35600b13c3c77773ef92fbd81967
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UP:GQRQyi36YOcPbLvw2gAf+PN3f+k
TLSH
T1ED666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 53c9dcd7597820422d42c2ba377886754e478ba74b4254512e7212b62ea2ea68
MD5 e40bb871adc4b852f53eff95db92e572
SHA1 cab703a970a5351c92be037ce51ad4b8198695ef
SHA512 d1c9af626596dc4b1f1c242ac60479c307a565c8bb858645e5d30a9c69c24b6fd71ebc3de91b4bb857a1f2b6ce194eb36d32866dc8704933fe147825aeaa8442
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0XNyBo4kx929bL3R:968Qg55nhceWu7PNU3/7B+kn3Hnx
TLSH
T10AB55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a0500d6eddcefa4579c70e6b6fdf191d5c0f02b752c7af4142bf5f33a9d03243
MD5 f0244c96dd1a65bc0837d1a7496615dd
SHA1 5afdb5d078d66ba2dc3773159776b59cd5d044d3
SHA512 0bc3c0e24f82107e202dd4fa3285cff93d95e24d861d4b7582ede9b1ed9ed9e52b99636f84d28619740e894201fcda92d54ba78a3a08db8fd5401ef4fbb789cb
SSDEEP 49152:A3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99x:ty5112gYy5azzVvt69nLKnhZA+k
TLSH
T107167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4d5b8e63a38313afc66130b3ce6cb824f534eb6a5b15afa57ed29c9a5061e66a
MD5 6468ca9cca0ea4781469c2aa0ee08922
SHA1 915be51bb36ae234bdb9ddc7b73c85a7f14b1441
SHA512 0999f62201e384edbd02f99780e2cfa66547cb3cf67d5037cf843afd5fcf92b12fd2608399cbffe2ee99f6d975f8dfb3ecd0d5bd9ef298959dacfbd4797612fa
SSDEEP 49152:KB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glBB+kn3Hnx:Yu6Jmdxd2dn+k
TLSH
T105D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a91790f8da1d7a6b95e8addf4a7ae804849b812bffc1703914508aecf76f0e4c
MD5 d47f3d7f7e83f41dbe2a1dac0a61eaa4
SHA1 297b5a04758c0fcc6393432429ede56c54e0a0cc
SHA512 7432d7ff4638cd6b30bb28f4efe01009a10c6cdac5b2ea61e7939a3910c688233bd4d07fee4db71f5aefa0d4bb331b04dba5d60c51add6c79042b6f5bd42f966
SSDEEP 49152:a1hpsNoJpF1A63U44CwH7R4x1B+kn3Hnx:amifPWRa+k
TLSH
T16AB5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 dd5249d18c9759086a3d76aac3347571372a8877d8d783b5849a41dc91f31093
MD5 56de3bd0758ce96a435d6c662e8ad7f6
SHA1 95b8df06f1ad8419c1ebd6869c0de0182d7e9ee4
SHA512 1bb56d999c03b5e5fd8aa251e664225aef424606efa3dcb8fdd7be10909a43d6fac02301c9dd41eb1c53b971e7d4c9b3c83725b7cd0fad9e8d029a6b2d0db958
SSDEEP 49152:kSuZQIY0Be2KcRVtOnks6NMHqoB+kn3Hnx:25dKii610+k
TLSH
T116C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2e8ac3be7383b7db6f2053b2c8a35b41a3d1d6162ccea22e3e1d0f63803c96a3
MD5 1dadb3088c4f086dc8222d01522200c8
SHA1 591f5fe6e17c960af885cb067d0f334361b3c702
SHA512 3abf3a3d94b9ff3b20b6dfc7724cdaf2effe20cd0134eb6f7bc233399dacf14c788365173ba553ca352b79c07fd02406c76dadc870fd90790d98b2fef845e7a4
SSDEEP 49152:DhtSn8EApI0fig3giDn0AP5wRB+kn3Hnx:iX2imphW+k
TLSH
T1E495BE13F2D901E8D06ED174C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 bffb8fd477a41273f6c5f65c3b799fb2ea7f2df23f13df0144325827e3477b19
MD5 5776165928dafd76e03113af22c0edcc
SHA1 53a00d44d5b92bc70e1405b0dab8fb52759119f1
SHA512 e8e9c1bfd98fdf6c98e56faeb12dd4da5c39747e478fca061051f2425c2db647080b7cab375f826086c7647eaa8dec17656043e2764689e0a2216c2892f64e3d
SSDEEP 12288:tELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:tbNyBo4kx929bL3Hnx
TLSH
T1A14523129A4C627AF76D3FB0644A8558CC34BC8F1E9593D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 29df605e82085948fd4f713c0ad42e527446a322a32649b8cdb22cf9a1dafd70
MD5 0d7bb695abd31af27ec34f35b99ea474
SHA1 dc501b8032350658d95e11e15a94b3467010581c
SHA512 65337f4df3dd80aeb57518f07c51bebfeb836874e5f179440ddaa4f2a7438957b68aebd3dc2a94bc7d82514bca66583311ddcd45bb1c974f24b5dd6df2c614f1
SSDEEP 12288:S3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:SMNyBo4kx929bL3Hnx
TLSH
T1174523125A0C627AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA24B21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cea43363be47f25ffdc7ff6056d1b2d01ebf3e7c7f4869bb2f85875fca214aaa
MD5 67fdafc624620d396624523d0f713d3c
SHA1 ade34b47dde8c94c1e6c8ebc6e8fd0573558952b
SHA512 730a0b1c1ae1521280fbbe63c824670056304251f858b4ef33970d67f588e1ba636432461b27a493a1b85addb997c18c9a9bbbbcbf253bb33ca7814379b97fff
SSDEEP 12288:L5LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:LmNyBo4kx929bL3Hnx
TLSH
T1BA4523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 3e2598859fd721e6f2968db272055f618024fdcb1cfe8e727a97585c1d1916f7
MD5 1ecf056b8136089ea4d6e3a110816a3e
SHA1 74a59b7ae3a4f43c53ca3e2946c29705433a5adf
SHA512 c3ff0e10a0bd41d5a7995b4974f9d373e54789c1ad1fbc222614de2bdb3eae2cf7afebb5d77ea0dfc011b951e79e56cddc3d6a09b5b9574ebc8835be3c842921
SSDEEP 12288:+VmLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:YNyBo4kx929bL3Hnx
TLSH
T15E552302575C12BAFA7A7BB0D8568054C835BC8A5B7197DFDF124CBB0EB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0a884d4114cae594cba710f9890d02f510a64fea39245273514e3f5fd3399b40
MD5 a82db46287bddeab7c844781ff2d9b59
SHA1 8526dcb996ff0e932421ce1eda189b5a679f53c1
SHA512 fd6fbecb8b6127136d022c0b212c8e597fbd9f03fd11df6ff87432df585b7586fc0440d9325914b8f1e8b12f49723dcda9732ce5f07642a54c57c1b9270a2312
SSDEEP 12288:uuLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:udNyBo4kx929bL3Hnx
TLSH
T1594523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f08cb1154a84b5fce287de2153679b8a57c5f2d354a0072e3dc7c35326f119cd
MD5 56e3d4c81d2b1778baea90b492d4ec2b
SHA1 bf31b5327419750c8c0eaae2b17a25c1335c34f1
SHA512 e573986412519a702d4f47400d8319d4639cba719833c6a3a0e945f3b1931cb412c563dac122ab5b32a89fca01c2268ac67f44143174aed41e9f1bb5f06f1c9b
SSDEEP 12288:mDLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:mQNyBo4kx929bL3Hnx
TLSH
T1AF4523125A0C627AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 badb6c136565a3975804f4abb61e876202c1dbe666c1b3c22087aa9be9897dd1
MD5 8e7ba279154a839b17ed708ea142951e
SHA1 ab0237f19f6ba3832d9976bc18ce6cc14da2a958
SHA512 e7a07c55908614664006f76ccfe64d9b22bc85ba8416db30e6eb541d0344f07d450528ec5f5b7fa213477568a769fa2302b5965fe36ea3e3c0b064bae969b125
SSDEEP 12288://LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:/ENyBo4kx929bL3Hnx
TLSH
T11C4523129A0C223AF76D3EB065498498CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 32caee539bf7519a443a2237221b7335c7d0bdcd934055d741cffa2d31171f32
MD5 4e959866d8f84bf7af426491f6ef4a9b
SHA1 64fc8fe23b02be30364e660cd5c40b21c647ff83
SHA512 35cd64ebbadb0ed3862c9c6264438db4e09685bbab1b7536b1de26d3e2e3e4dac23df6f8e4b4d795f6bca7762a8f58dfb583e1e5944f60692e41be0cd6accfee
SSDEEP 12288:LiZwbjzzFEoS2cPvyXLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:2ZMXzFVSOsNyBo4kx929bL3Hnx
TLSH
T17D650195B39418F8EC67823DC8158906C6B2BC5A0BA0C65F07B4367B5F773A10D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 aa114238b403d29a4c5d28caac1000cca2348fdde5b0f79689a4713f6af708de
MD5 809dc234482709186e69eec4bb96d4e1
SHA1 8bbff34689cc73f2a01c6287640866431d2a3056
SHA512 0801c3b313a164168cf908443b0a5e1084aa27c95d60e83e829fa9ff42c9b16c766b2fdedeee562f8ea3a08659ef759bafc4f42a0c976a6fa82926709199a664
SSDEEP 12288:5oLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:53NyBo4kx929bL3Hnx
TLSH
T1D44523125A0C627AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ef738d0fb08b56ffc6038dd4b8bb00d2d50efde5ec54a5eacd63e8b0d8769154
MD5 d0ef30ccbfe945d315c883d88ceacc0c
SHA1 2ca580086e6b37e2dd2b5b158928144ef5b88373
SHA512 13d6a655da06e88971d9de14e33dfcb7cfa4110247af92c1c051cf384344e72243792d1162185563f061c02e615298c30254146d4904808863105779236f5bf6
SSDEEP 12288:S8LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:SjNyBo4kx929bL3Hnx
TLSH
T1D14523125A0C627AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 5d2a0d1616058e5ee8fdaa3ea181975aee9dd5a66ad806b29145699677d91085
MD5 76722b87e7c9d287131d759c5fd9ac95
SHA1 c4fe4b7d400b93a2400d52ca9a2f2c8a6f752547
SHA512 0ec4e6c69e1673da688d7d20ee8fb486db634dacf282b9ac6000a60b5dfe28ffe3cb232147aea49899139c6051a290d9d60bf298ba3e8d88866071bcc78de035
SSDEEP 12288:9yPz5L87LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:0zyYNyBo4kx929bL3Hnx
TLSH
T15655120773A831F9E17A6234C8960A05E731BC760B608BEF576046771F776E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c183b348a520a71161546ae4ea59503746a97918e829969f707141b0cfcc6910
MD5 4491c0f4d3662368b086afc4fb615eb2
SHA1 6785f29c1fc0c27cd463fe01fe17bddb579bdb4d
SHA512 8fcb84b903975364f4949356ed38877bc93dfbd9f518fed89b73b070ae0368b5872ad3b742950981020c31faf69244f89d0be7b99ca9ea69c7f5278e87f0fa24
SSDEEP 12288:VoLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:V3NyBo4kx929bL3Hnx
TLSH
T1774523125A0C627AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 11db55e7541d3eb21d9a1bef80a4b9c12d0e9c7276627998b1a9d0ba6676fecf
MD5 036a0a0a3c8ba36334d162b2b4a245fb
SHA1 2aa2f120f8785e684fceddc6c90213da4ecd6f74
SHA512 1d742399407e32416697c65e2738c2b8471ef98116bcaade3400f343f0b12f85d8f67b5bdbcf1b8a124af0d3a686fd66de446171a3b8edfda04609c9c7b0643e
SSDEEP 12288:WoLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:W3NyBo4kx929bL3Hnx
TLSH
T1C34523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 0609e59c6b49ff6b473e444942f193539aa8c84ab94c1dd79b0b3b1667340eee
MD5 80bc63d14b492644bd7da0c7883ac82e
SHA1 cd4a9055efa27e34ea81f7e28bd1ace650071f2c
SHA512 545a2cc532e09cfee2294630d7d6367214c2c6eb72270a2723e8780190eaf2a9cb8cd6d35e8de82cbfa96f835751a71cc8d902e56fe3d2de78c87cd4ff3c1bb3
SSDEEP 12288:ayPz5L87LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:HzyYNyBo4kx929bL3Hnx
TLSH
T15755120773A831F9E17A6234C8960A05E731BC760B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 ec4ef5cb4598af8422cdf6de7ca25b2f87cba16469720137b48f2c7d4debe1f9
MD5 fc25516c8910f3e6ab344276ccbb1c64
SHA1 d3ad363dc578c2275f309016e89c419a8e41a54b
SHA512 e3a740e2025f08522ff82d1b922ada12a7cf04cdc69ef08562161d6319156f43eb8da318e1aa547ab2d88a730896054625648f6a130813558badb56fa8e0d07c
SSDEEP 12288:dCd98WYoaLHF3z0z04PDvhpLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:ITtaLl3z0zD2NyBo4kx929bL3Hnx
TLSH
T1706501A5B35018F8EC6B823DC8568906C6B2BC5A0B70C65F07A4367B5F373A11D3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 769e2ed27078ce90ddb8171e523148866bc3ea886dc61734829d7700e20e3317
MD5 dc366f87c7291f4a3cbbd685fc570a4d
SHA1 73a30db2cdcbeaae52d3b2a67e60a953b02a1156
SHA512 b740375a0c8051b1ddf7a7219c35b5a7107a685041ee508bb838025406fdfec3b72746ecb234941d127638527db736602a70efbcd88db533cbb0765ec909de97
SSDEEP 12288:0i4e7ARdTfgwCHKy7GLbbdIvqLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:03ld9CHKy7GZ6NyBo4kx929bL3Hnx
TLSH
T1FA85CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 396907958d60fd730a294cd7d645e272f96df3d1eba03820280ff3bf93a1f88e
MD5 c38d7c44f8c08060009537162186e5a3
SHA1 a6c78bd2e57ccda4af37d3c25d12c5a4bddb23a2
SHA512 0c41ba085536ced790597b21d5221ab1cf6719a37662cf547a73bbffcc832ef53e5e8d5c37f760e65da6873b23e9828513c994699a5b75d9c8483b454c0f37f5
SSDEEP 12288:HZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:HGNyBo4kx929bL3Hnx
TLSH
T1654523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 73af66d5dc0e925bedfb4da5cd13b32c3064577aa30c7eaf04690246ca7743b4
MD5 92bad673fad09ab36b8dbd0048c8ae7d
SHA1 b571db7335a4e59ba6a8cb2fced2229d46fe155c
SHA512 637a8f1165945e37bdd827edbf786f774d6ce69dad490c4f589ebc55a668c4c0c45572e1aca04038dcebf2d8f1a356a48eba26e7f64649d6b2d56e6924deb5ed
SSDEEP 12288:NbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:N4NyBo4kx929bL3Hnx
TLSH
T1724523125A0C627AF76D3FB0644A8558CC34BC8F1EA597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 4f90082d19ab49f1d462ede98d23bf5c0bb36f5be5ff0241be5ecc770a2b0b7d
MD5 f2f8c41dae7f78e2447fa6709c1b5bfb
SHA1 392472a507e7a313cc95b101b3589e1dac4cc7fa
SHA512 266512a2e2f070872862cc68db17da063c98a1701a32d20c994d8605599723d6d41fc93be60441dce8194f9da4c31c181de429816d1952b795dba912bdcff59d
SSDEEP 12288:SqLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ShNyBo4kx929bL3Hnx
TLSH
T1994523125A0C223AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 075583f6684d2fde5ddde42c22c20c409de61ec8988b1290647c3bf56dfa3b67
MD5 0d3e61388ce4e2acc6460f0a6b2bca10
SHA1 3ac6180ef907f99a2c612028694aa58e88e0adc4
SHA512 6a496befd59c939f2c017f242082affa794dba146f63d55675acfea0e611e919776428b52be5e050d8cf23f5ad8629754020e248e2d8ae8d5b85bfa29f4ad9cd
SSDEEP 12288:WoLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:W3NyBo4kx929bL3Hnx
TLSH
T1204523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 547c9453f2f0850463420fe4abd3cc8fc2d8837c69bd8d8ec1a384a54b71009f
MD5 d66e0b99f9c7a43c1b74a862e5063c9d
SHA1 4eb2a308e35edd3fda0d624cf35f258fc781133f
SHA512 953b655d4d37ab9f08612ecbbd3a04c840545391a5a77dc7703561343820441cefc9363077171b737db37d82f965beada40f98fdb559c54b1396937e010e886c
SSDEEP 12288:HZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:HGNyBo4kx929bL3Hnx
TLSH
T1FA4523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 e31830348abe17f04d2610e09a9b880a2264f0c291bf13270fe7454517bed58e
MD5 934ab383e3e333888b36cc3e34cf0ce3
SHA1 747e66dd214fb6aad70308451ac74d46f891714c
SHA512 ce8892d329e1133361dd5048631610f2eb0b191a50e6024685917067b1988a9c000b1dc584a9b7cefe4f76bfe11dd4d0f6fc0084e1a9b9f4a353246f41db3fed
SSDEEP 12288:fwLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:fPNyBo4kx929bL3Hnx
TLSH
T1B64523129A0C127AF76D3FB0654A8554CC38BC8F1E9697D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 02bde34ae6cf9de236e93f235cf00839ce0c9e60298005f2de8ec91b1e3ed7da
MD5 94ac50a85b7edab34d7f17462d90bfc0
SHA1 88cee60416beda9e69dd3d784c13565643b7cecc
SHA512 93c3590224a47c491cf949e699880d91adc3c3b68a18a5f2b3f1d6eeff8957472daae1d2796acd4aeeb2649d7904ac2891d0d04d78aca7bc9ca1c99b7766676a
SSDEEP 12288:3uLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:3dNyBo4kx929bL3Hnx
TLSH
T19A4523125A0C623AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 2e9f0924c7d9c6c56f5486ae819d1a166e813ba7316d8788914b2315161f4004
MD5 0b34662b7d342cd42a0b055f6bd33739
SHA1 425c867b251b96c0704453757c092987023168e6
SHA512 2f0990b7d7a419b3fe3a51febb80df79cff84763c5846c66fb1a2e8326be288b418c74da8c90ab563897cffc374420a4e7c124e0121e70c2daf34d32f43d96a0
SSDEEP 12288:DxLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:DONyBo4kx929bL3Hnx
TLSH
T1224523125A0C227AF76D3FB0654A8554CC38BC8F1E9697D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 a0fcb6ecf9e4e3ada037da62116fa01ec7be9f9026e16216dc3b6ff9bbc5c95b
MD5 da25bbda138ba60f2ba2587b65214bde
SHA1 a6484cb8bdb7a8b2512137238c86daec810017e0
SHA512 2be4b014cf2b9bcaf049a5bf48bf608b743ec6c6aecb621a9ce98dba17d7652b12c93ffed0160874295995a47879b7c4e3c753b324aa45eb7580561a3ae97c45
SSDEEP 12288:MuLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:MdNyBo4kx929bL3Hnx
TLSH
T1D84523125A0C627AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 0abd46c9589ad07ecefba9f13cf944b60d29d49f0d15c7d3bc6c6bf45abbafcf
MD5 108a8c98a983a83eb1755a9942f28e0f
SHA1 5a30982c3afafe5198375341d4102ffec1987128
SHA512 1014af379c8be77935c4ae76e6e098493bb71693fc242f56fb2a6205d366c6a90a631f47e0db4c3c747b0744aae43dd8d41f31d0ef863b0f542afb9a1a4aaf48
SSDEEP 24576:yfwvTk9RX6wkyAITNyBo4kx929bL3Hnx:VMnYI8B+kn3Hnx
TLSH
T17785DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e6939527d4ecfc948c60ea756b1499e0ef0271a1de389b9cbc2c589ac9c22738
MD5 cfa154c157f003deb5cfee73baa09ea4
SHA1 83138f6c59deb60d8692484d6b4bc8c151cc5b61
SHA512 ff593bbaad9abef6b51cd52d0a9fc2b41345734bf10141cd84d10b56a1ad3975dba0564618cc5d44ad61ea794f540326436c53ee3cb9eae5104b4e204250512a
SSDEEP 49152:sYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0xB+kn3Hnx:LySzP/+k
TLSH
T1BF066C56A1A801D9C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a626f6808a78517b8363d23f29c2a9c82eb4344140da0f44507379cb2289cd68
MD5 a1a126a9f16d94c18257bd88e8e4ab64
SHA1 5dece1321bfff31f2c20bdcda1aa618a39304d14
SHA512 9a82bbfc447a931f9d7ecbbf708aef2c68214447d3c252079a48b8b490fef9e59334e04f8edfd89e6c48453a968b9097081394bb0f17de4826dab7360404ab9c
SSDEEP 24576:q47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYcNyBo4kx929bL3Hnx:q47JUQjTirIhCnDHUPfF/BB+kn3Hnx
TLSH
T18F65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 76327ca9fda5a92a55c7fa72cccd2b788d4620ea1538d3f806c6ba35e3f07880
MD5 797bb5d8e754cd88b60e323e14d780a3
SHA1 ac847ca9431061b7419a6ea5116e58f2eb979bbd
SHA512 c73c091a0921a8960ccff3d8527c1bd9fe6d96ce3d097d6c46cffae42d0f9661d40b027159e2df62752aff4f6003157859bd55f1601cc339e5461f94d7c86467
SSDEEP 12288:q5sfYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:jHNyBo4kx929bL3Hnx
TLSH
T14D55F01AD25812E8D16E2274C7468A40F7337C5A47E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 4bed0ea05c87305e09948ed6c58730fa6fff241cbd76bae78afd75863ecf8aa0
MD5 d191648104323a49daa7ca83a33990dd
SHA1 ccaa9734c90f74dcbf649a31be4c289c2235ba7f
SHA512 f6db3a2394ad9972b3bd521145cb6622ac8efb627e839aeba0a131e1217d0dbc882fb953686e3762df1b9c2a6b2c699b023bf72d2b849cf8bd4dfb56dc19e051
SSDEEP 12288:6cEPcBq0o3MKWy7COcYg2xviFzU/9ONr20AaRM/rcZwE72TLb:69cj5MCjQ6lCONZAaRM/rs7g
TLSH
T1EF5538117626CB4FC6A940325E32C5CCAB707D45FE056F0373C98B3F8576A59BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 fa89f9b7ce2699e57f8ac46a5ae8a81db2b7d23440ab71cc564331d605650a1d
MD5 9b4d395bc51ffe2d6cbe66f870ba25fa
SHA1 e02f581b99fbe6aaa15c2df2302f0c1c00997fdc
SHA512 ac425b2287f4fa84878e88026cd7be52a0c1a71e90df959bf7f9b40a66fe1c9807e7feba41427a96ad43f071b873411ccb576c275fa134b88158b58a99f5b505
SSDEEP 3:OlH/leQ9YbBllc/VJw3btl/A3mCllltq3mCllltGlslslslslslsl6xD:KM2YbTG9+LtlamCtSmCtEEEEEEE
TLSH
T1C68192AA8B080A21CDC331B308205F880334C15E6484E7EF110D20578C902D40C06A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 11e578d23e4482a55af01c19329c9368f267e554ba219b4885ee61079fd81db9
MD5 0db68a509a9ce02031e316675edee87e
SHA1 eebef52869e2b195c9ccc5f26992b6004be0ad17
SHA512 0a4a6b907a03aea19fc1f07388d417582ba338d8f1d27e6648d265decd874256553bffe0258a997815542282cba83aae00f119758e7f7b24d7d0cc56155277de
SSDEEP 12288:DGhDz8Fr9M4M0wakED1jeb/3+Vm88R5YGxMxbSDrBRvvToxe:q1zkSdajTv8bYGxOmDtFx
TLSH
T196751A406136E78FC1BA503203365B8DABB4EC06BB096F16B38D4579D86BB45B0F97D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8086b15dd4bd373de8b8566be4c284094bfc6592eb1ecb15fe37288010bd3826
MD5 47e180a5df0c36208030fe7276cf2143
SHA1 7301bec1828aae70a94873b9d4bd191741aa00a1
SHA512 a86ab00584f80ab2f27e2f0bf28d5792195c6d14dd030abe940027f81dfb595fd65a983ada4ce5ec3d191b5f19ff2c40c175d194f492ba8d823cb962dcf518db
SSDEEP 12288:WC7gLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:FfNyBo4kx929bL3Hnx
TLSH
T16B452312974C623AFA7D3AB0645E8124C839BC8D0F54D6DBEE1658BB55BCED24E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 51fade5363ff2031204b9e2c92a6abcf0c3a764b6175c6f53bf6b165d91d6486
MD5 4ca8fe243fffce94c7a525b6e11f3eab
SHA1 bdcbbe9a251230486d434a0705d61ccc87ff56f6
SHA512 bc809aa60ece25775027576d935719119fc09d6aa9b11b8f22c22ee496ded0f2c278be1afe9dc2c2b369da35acaf9ec71cdc2694b474af052096e79b568e04c1
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYpNyBo4kx929bL3Hnx:Ygb4mBIBhGFHB+kn3Hnx
TLSH
T12765AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 efd7925ed8d9531d0cc4f0a2c2d618d6758c39b37a89eb37f038d00a887bd91c
MD5 5da133d53280a834abf12da2b4e2be93
SHA1 d9ecfdaa1d3aac953d39b23af744e1cb8858534d
SHA512 02b16b9021653188681cbc5c9af80acce65d429baba464e13c0dab005745d10cf84b8ae5c3c5f0f90e037eea8469200a1490528f5dd726b725c20d4b45833dc2
SSDEEP 24576:8G88u8FpJqH1Jzria7/msNyBo4kx929bL3Hnx:/7ZFPqVAa7/WB+kn3Hnx
TLSH
T1BC85F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F33AE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e7e45f9101f55ba2f90b2c2f15c6a4b8084ffe7bf837e4f13c125b1e3eca7a0d
MD5 3c4f87fb4b879d08e7389615c65ae360
SHA1 01fb2df20afc124c89d9b25dca192dfbdc44c17d
SHA512 c5fc6617248a4dc53d74979361d8bdfdcc5dc7720860383cd20d4819146edf2f9e7b6d91bab3ba175661614f6636a7d6506d12c135da5c4c966ce63c742c22e8
SSDEEP 12288:1HvUrBFrEjwaQTLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:1PUr+NQANyBo4kx929bL3Hnx
TLSH
T17965F22F22AC18E5F67AB17C85868609E771B8560711D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 42ba74aedc1ab7fa43f94d41c9a91576a65721154b654ef6f82ea3771c56359a
MD5 333b72f4e6cf079c1519e225f9c2c719
SHA1 2962e12f23c0e404edf8ee438987c5918b4cfc11
SHA512 5de764bafb4a8c7f7e982e64bd2afc3ef92251eac24b14f766433ccdcdecb260b9ed5a12bcdf818d0ff86a359888cd0dcfbddd0fc36eb188839432c963ec93e1
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjB+kn3Hnx:WG05lO43b4+k
TLSH
T16CD5CF6A62EC11F9D1BBD17CD9C6460BEBB23815033456CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c14ba30671f343f4575f5f07ecfd6fac78c6bfa503f7652eee746180218e894a
MD5 b12f48de4fe7df813ad599acb3277d2e
SHA1 42adc20d1f038c5b08062aad0e65d93992021a81
SHA512 00982559a96a0a53cf085a449cf54233b55c81a5a0deba13291c3fb374437ae003a0d3a7f72133f63ba342a9e6a8710c9f1c1c267e290d7e8a0cc8821870453c
SSDEEP 24576:kfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnSNyBo4kx929bL3Hnx:8a5POZ3BJt2pasx2+m7B+kn3Hnx
TLSH
T15B65AF5EA6FC01D5E579D17CC583861AE5B1342653329BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d49cb7945b43ccd8a6bad0f3dd16b70bbc5fb3e86e5ad0be9de1c385d73137a5
MD5 7fa1b66575fc18d98c2e4ce11abfd1af
SHA1 3088e141d8e7bcff9c5e31609c58eb914e3e5329
SHA512 ff9cdd96c4316e4bc9ef8650d93362cb9334eeacd966a77996e0dbe7fa1aca904ea1b1e53f496b947c416809dec30ffcace7a8f819382275d809359b9bb1f541
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7FkUNyBo4kx929bL3Hnx:oNc/zEOVHF2B+kn3Hnx
TLSH
T1FB858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 285c071c5f1c4722b14f132c5fd8c63c13937eb7d16eddbaf78bca81540a18c1
MD5 6a768e2f2cb1590470b6b546e729f0de
SHA1 2010ab60985ea3591ed06d8cddd4c8286836da8c
SHA512 da35de0293452c04f61562c44d44a5f5bf354ec160eb7c3449065606e12ed2fede33984cd900f3ec44438ffa4db6377eedccefe1758dae0a307e24173ffb3151
SSDEEP 24576:ATkNvNnaFeYhJNtmZBmONyBo4kx929bL3Hnx:ATMwBtOmlB+kn3Hnx
TLSH
T1F255AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 08476b6f381a15d78cc1ecf51b0ee06e30efeb0e51b72f1d808a2c2c3670005b
MD5 b99bd3ae48f72a3d8107329be3dc4c39
SHA1 cd4846df6d200901f0fe6113af9d505c93c16737
SHA512 6a299b6cc671cc837472a1248b803a611f25c83595d220c8ff638fbdd6d3f20326f1df3ec20d0c18e904ab12bb61b970ad3f4135fbbb729e52ea094a19d4fa21
SSDEEP 12288:YQcMxWDXN1Dp/fshBItT1IQgAkLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:6D3FHshBIYQgA7NyBo4kx929bL3Hnx
TLSH
T18C75E13EE75C00E4E57BD1BCDA538906E67138AD072266DB0694C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1072-362-0x0000000140000000-0x00000001401E1000-memory.dmp

Download

memory/1072-107-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1072-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1072-113-0x0000000140000000-0x00000001401E1000-memory.dmp

Download

memory/1480-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1480-363-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1480-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1480-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2240-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2240-52-0x0000000140000000-0x0000000140178000-memory.dmp

Download

memory/2240-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2240-39-0x0000000140000000-0x0000000140178000-memory.dmp

Download

memory/2240-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2296-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2296-128-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2296-126-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2296-120-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2296-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2404-65-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/2404-303-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/2404-73-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2404-67-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3852-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3852-97-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3852-91-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3852-357-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3852-358-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3852-360-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4416-392-0x000002AEEC340000-0x000002AEEC9C0000-memory.dmp

Download

memory/4416-372-0x000002AEEC340000-0x000002AEEC9C0000-memory.dmp

Download

memory/4644-61-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4644-300-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4644-55-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4644-54-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4664-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4664-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4664-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4664-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4664-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4700-104-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4700-377-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4700-375-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4700-86-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4700-361-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4700-80-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4868-14-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4868-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4868-21-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4868-22-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4868-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5304-310-0x0000000140000000-0x0000000140907000-memory.dmp

Download

memory/5304-77-0x0000000140000000-0x0000000140907000-memory.dmp

Download

memory/5304-0-0x0000000140000000-0x0000000140907000-memory.dmp

Download

memory/5304-9-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5304-1-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5620-101-0x0000000000400000-0x000000000053A000-memory.dmp

Download