910fe5acc0769f02c12ef6809bbe18bc770f077058611b925bf45768dff5f3a7

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.5MB
Sample261110-3fbdracd48
SHA256 910fe5acc0769f02c12ef6809bbe18bc770f077058611b925bf45768dff5f3a7
MD5 2fe602a40b2aaac80a23b47fc7d4c45a
SHA1 549e026441f66854be3680e6b396276c03ab41fc
SHA512 0e9e63969f7afb40194706f8827432ca522045706b9c55ca7d1221a31d22afcdb8efee38fccef8448df347872d56401c0a6b37911f001ccb0c179f47b8d421a9
SSDEEP 49152:/hA6yeRc8pSXQWL6uLenMQQJbSOgMw+rUne9LWZdul9mZaij4Dy64X9/0Fx2Wd21:ZtgXJDNhW6+mgRPH7wRGpj3
TLSH
T1AE26390673F90399F1F7967896766606D972BC199B20D7CF02A0915A0E33BE08D7A733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5180	elevation_service.exe
2900	elevation_service.exe
2132	maintenanceservice.exe
3492	OSE.EXE
3924	PerceptionSimulationService.exe
2296	perfhost.exe
2928	ReFsDedupSvc.exe
5828	SensorDataService.exe
2528	ssh-agent.exe
3540	AgentService.exe
1416	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\61e333934b315ee3.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\javaws.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef36c3546b71dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000798c3c106b71dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004493df106b71dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014ddca106b71dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	2928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2928	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3540	AgentService.exe
Token: 33	1416	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1416	SearchIndexer.exe
Token: SeDebugPrivilege	1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	1032	2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5180	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 5744	1416	SearchIndexer.exe	101
PID 1416 wrote to memory of 1572	1416	SearchIndexer.exe	102
PID 1416 wrote to memory of 3840	1416	SearchIndexer.exe	103
PID 1416 wrote to memory of 5960	1416	SearchIndexer.exe	104
PID 1416 wrote to memory of 1000	1416	SearchIndexer.exe	106
PID 1416 wrote to memory of 3196	1416	SearchIndexer.exe	107
PID 1416 wrote to memory of 6072	1416	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_2fe602a40b2aaac80a23b47fc7d4c45a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2900

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2132

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3492

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3924

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2296

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2928

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5828

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2528

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3540

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5744
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2948 2952 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2920 2992 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5960
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2920 2992 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3196
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2948 2952 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f9a3c4b281c01807e63645db51ea62d911b732b739a215d337f8ec8cd427c181
MD5 1f9681d555dd6e0db247299fdfc8c9a4
SHA1 a117d0992b680aa999183440ac8b43d4639fdbbd
SHA512 b3c16b64c85f0283f8ceebd6053539a6792ef08b5f52fecd6b9ae2eb98105b73a913f6b20a814011aea47f9bd31264b34a43ae0dad50ccd1f9df0552b9408275
SSDEEP 49152:Cb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn0LNiXicJFFRGNzj3:k3q6mjB37wRGpj3
TLSH
T11BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 88a2bf733c07b246d36bab40dcfab107a1fd8069d5c7d23981a8384dbf0b96fe
MD5 40483f5c3555d37f146b51a98ab49035
SHA1 ce660e85667a930dc0400d3c5ae927193b1139b9
SHA512 2fb903054dd027a77435736086b336c4105998bd6c1c539d3c6f4ffb3f951bac8c1a8bba4c7bdc8231270c67d1028f660de0583e181a68454564a17272991b41
SSDEEP 24576:lXYfDtczAj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wtc+LNiXicJFFRGNzj3
TLSH
T1DA75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 6fa53917f4a1488895ce901f4e7376a82938dc50d8b1bfc4d7b6b6f727d3c98a
MD5 3b66133cf45b3865d2331ae137d5a506
SHA1 d59c019ba2787765e75d020b7b82749713558e95
SHA512 fd18883deb4c738026f16a92cecc05c87588ad4a8715860313a8d92c1625780ed1447dea8a7ac7ac19e79d498841e378dbdcc3210956b6d66876262a128758a9
SSDEEP 24576:o0Le5ji0hmxhrMs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oPji0AzZLNiXicJFFRGNzj3
TLSH
T120859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d8ee8c9119a469ed76cf74c58cea4c5a8002ec822dc7ff68cc8d36282a3798d5
MD5 bb7ef28aee12a3b2800c16449221b621
SHA1 5e851f414a2007c8cf9b80b8cafc181b2d337ded
SHA512 edf5e695240d38553eadf17f08616c56688c0c6ee4d26f972299cfc547e0097a442ac60245fff35639294b72d7b345fd70b1b41a694735faba10c24bbd98928d
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWj6q8wyuO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:b/ezSC6vUzPv+HjyFLNiXicJFFRGNzj3
TLSH
T19C756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 95a650a83ac31203fb0f0792aaca4bbec1e285992a759613294d50fdd614ad31
MD5 64d06425a3530b7cc9d228054803698e
SHA1 34fa500481b178a670653d26173fff0fe1180da9
SHA512 afab4641d2582e3a2c24f183df1613e6177bbdf5910bc24a95f27b6b9cdebb6ef388ca9ac34d39741f1254edc0ec2e29ebed701a4e889a8b3da1b5aac3c83041
SSDEEP 24576:PVbqPb88hv/l+BH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PVO88hXl+5LNiXicJFFRGNzj3
TLSH
T10B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 58e778354368510c2a7f8db59e2cdbd1711bbf970483f6165cb21f69d8c4d69d
MD5 f207322f8357e037828543af29c62e4c
SHA1 9d233c4f85c0f42936040a87351f272d80e6d3be
SHA512 d1fe3e194c0ffd22ff186880e5d64eb1f0eb5e66124b170e1089e518d565f222ec8219505f4f8889fd99efd12eabd5500c25f116b2ced96308d6a593a07c569c
SSDEEP 24576:JGQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LLNiXicJFFRGNzj3
TLSH
T1895523D3468855B1FBFD0039867A5828B5845E2CCA595CE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a311e64fd6a9fcb1929b4689e4dcd7f45240c7250e30a2843f2c97e218578396
MD5 579c487b2c631d86cbc5adb483287ad8
SHA1 eace094603accebc8791932b502fc72ba1af57b9
SHA512 58bc0438571fafc9cb11147d4469a25c21288eac4cfc50f9292dbf778ea12eb7a5a6bda87730e94102b77b421e01ba21a9273e4bd060c0e99b635db157c3476b
SSDEEP 24576:eJIUf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eJIUfLNiXicJFFRGNzj3
TLSH
T18875CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6bf3733b2673753ab5de2601d01303a7dc1bb318ece85fe5c9a32e9b63761a26
MD5 071618b512b2b4b45cab430bb73e8792
SHA1 6d806d962a7a42bf656c0ada3dc1f6a69793a1dd
SHA512 6bf5115df657778508be5d6e01eca7d281dbde25163d666ef99d38dc4f7408be2964bea6f882690e824cb6e47f685b8f88b608a9612eaf3978d281b3c32b4c02
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH7:AQvGAdlCEL8c/WRNw5Ce7wRGpj3
TLSH
T153266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 fb0e7e8c06cf496005a1127b8c91ec919f150009ae37f82fce27dee397054e0f
MD5 cf85834c16a2dd39c47845e91f1aa8a4
SHA1 948fb1eb98317cf56d7b36da380b9f6afd96782a
SHA512 7ba45ecc402e4802ed5deaaae07a177908c366c2f87043be6876774fb61f450aae5c35e73b85a45d947ca5b0bc6b4b1d5e207d777571bfe78612a2efbce32f85
SSDEEP 24576:tfewsAjp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xljpLNiXicJFFRGNzj3
TLSH
T1E175E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 784d392da375c308bb6a529b6224e36f7377627bf32b76f9dea937dd6d8ba649
MD5 d91d525a51030d3b09ed3f92845cd198
SHA1 a9f3bba498de0bb744bb4384320858269801913a
SHA512 96010107c1da87a41fa38d8e3d8094d7ad5f08d79d394035d54ff9856bf8615e9e00c442304c5218082284068e4fbca28cf25c074f37d6151681d7794e39e1a2
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHVF9:4UEtQevvqc2W1cpV20I32L9
TLSH
T1FB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c0a0b3b69b4c80c5e289936e94b4210d4a52190096c1e567a3f1d940c3dd585e
MD5 37b631f36c45b9c4da14173f1d161d70
SHA1 4c26fbc56ed455e25feaf1b2921f089aa34a91ca
SHA512 1168622bd7ee3d030c1c0e128e69b2c4b1a39704dd1b194a8c626186cfbf1ec519724d5052bcf7bcd7b266bb606546757d59d5ad158f94ab165691c2a8d58e90
SSDEEP 49152:ICbRquA/m2yL5zLfFiV+XenmE3/zJLNiXicJFFRGNzj3:hoq2Vjnma7wRGpj3
TLSH
T1C8D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3fce3c7ae4901427f243fb9695c85021d19b048f120793678e412acacabc8461
MD5 5ac384679b42420eb83af026f6df7728
SHA1 1ad2dafc2e469b90c2ff847005b128df8b5e266f
SHA512 58d74e8c1bf00e3d448f2dc29edc1fd3ac457905d8e92bfbe0f60195d253d6e17fa5e4be2569ba171bbfc33353b286bb166279be09f5040051163f85541bec1c
SSDEEP 24576:hAhGL6IFoiwtA5l7S536/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hAM5Foiq5qLNiXicJFFRGNzj3
TLSH
T110359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 c1c7005ba3f5725b34264116d64f6ccfdc9397e5a2f131e07f207747e581ed35
MD5 8cb22a17e78142a637c7b82710f77430
SHA1 d8aa7c522941c95fb38960abc691d9d2f6cf69dd
SHA512 5d386f6040dc6394b32465295c61fb50374a2b79f2631985403c5d431de311c00057ca133a029d7d1516b990afb33548722f34ce661590b094b9ccda914dcef1
SSDEEP 24576:SwuROWl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SwSOGLNiXicJFFRGNzj3
TLSH
T1FD65F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 350e2dbed5de2f6eb7f6951891d97170044bb1586ac022a5dcf6c51cc69b579c
MD5 a4117d0cf76eef33a0387c799aa090b7
SHA1 08c5b38fb15766fd0e00107f53b8723c5b9c4485
SHA512 dab088b9eaa3a3161b06d5d734973b6a87c1c4f3fc73251840c155f23477715b4211b087c12a298621f064c5f7c539dba2f3eabe873ec2878f9767f1938640b7
SSDEEP 24576:BZuE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fLNiXicJFFRGNzj3
TLSH
T13D55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 52d660875d24b9c7a3e688c750a9b402901cab3ecfbe945ac0919e8b55183152
MD5 6e2d04a5246713dd37f532e5c2c5153e
SHA1 43d9d89ab382c92ae589ef58873877a77c73d5fa
SHA512 f68fb1ba9158e90c32f781dfc25a87c1af4800340b7e3d29692b77105f76969c2c3d9bf5c58c16c2911375f9df462a342c76ab2a36097a3fb8631202fc8aa256
SSDEEP 98304:gQRQyi36YOcPDLvw2gAf+PN377wRGpj3:3QyiKanX+PNPF9
TLSH
T15C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4e59a4174f03612d41034d86e82e85b4ee6ef9685f8ba408946330b69665cb6f
MD5 6f87da886a5a2bd2fbc98e570f2387db
SHA1 f82c6785b542f71de191a77759794e257897afd9
SHA512 b2831bbebe1f60905f55ac89afe5d1cb58e1e79abd2329b19d024417b31fb92cd756d5915797dbed4e24542135e7c1a8e7c66f05002cff1ede90bd01e25a2b38
SSDEEP 98304:0QRQyi36YOcPDLvw2gAf+PN377wRGpj3:bQyiKanX+PNPF9
TLSH
T11A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8340f5bd283b74a9220fa5c0de674185a4a3f0a7b552933d021bec7198ab4c5b
MD5 a894d49a3e4326c891b58f1f796fc71c
SHA1 4b92dd5d58809d53be26b78bf0f5b2c5c181c663
SHA512 a9276d6c4658eb67485c1882640063b304920e7883038db387b66f1656d018e12fe3cf7a607513d98e996cfdd916829a0ee2e937f9c1e0dea7dd795542219d2f
SSDEEP 49152:i68Qg55nhkeWu7PNU3/ZLNiXicJFFRGNzj3:gthTRc/Z7wRGpj3
TLSH
T1AFB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e7705a75f83d09194c23ce549a8b9938945de87491c9fd0582b6fdcc9a2b70f0
MD5 017c94f6b56e6e7522d3aa7b93a75dd5
SHA1 db223ef069ac5a3ff98b09b14920ab2f8b2ac2a2
SHA512 c2caa379b080fcf950624c037438133cf3a937bf0973794f58cc1584d3a49919b0e3c05958b7b6fc9399a6e6d052e052c4868b8d9a69be4c05cc58bb12237778
SSDEEP 98304:yy5112gYy5azzVvU69nLKnhZQ7wRGpj3:7LIHRWhGF9
TLSH
T104167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dad3a41131fc3e0c7b1180f12c1ccb6e2dc7fe5e137864477b3b10faf8191218
MD5 7f59f1d1ce2089048c701075306d82af
SHA1 913efd79bb95d4228148128e0660b49746c6bbb3
SHA512 e58ce9e4760ddadad86119f9ec049501e941cf41b9d66d67705452cb45423447812d26ac76b72f2398795de3d1c19b7b34e95c96a98f9fe7ae5861c29755a6bd
SSDEEP 49152:vB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glTLNiXicJFFRGNzj3:Ru6JmIxd2dT7wRGpj3
TLSH
T1DFD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b40f3d35757b3e81420eaf070606eba6d87174a7a749eebc3b01fee4b82add3e
MD5 e51161811629ed2369dd2e1f7c4ae06e
SHA1 6114f9327321170840f62493d59d597e9add6e83
SHA512 a6a0acf39ae79f14a9926af2490e46e4b12ac85a1cb0d7d1137e3ccae9dccca0e31aba982e0ec3e9b044633d868f310cafa15391f8822fc30c6939af482e0428
SSDEEP 49152:a1hpsNoJpF1A67U44CwH7R4x/LNiXicJFFRGNzj3:amifPqRa7wRGpj3
TLSH
T1A8B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3de03da504ba56cf2d320dea131b311f5622ce1877fff0f8b67b7735f454ff39
MD5 d521b1c1b3fde7d81a5a806587b581f3
SHA1 6bd992bd294e699be5a4a93afbae2bd988edb773
SHA512 09e7508c2bf8d6688b3e175c830a6d8894a7284595c5bc835ee04b6fea9cff193eb319227e16b2b4441028333ff80fe392b6796ef911678d757dfd77c5c259d2
SSDEEP 49152:PSuZQIY0Be2KkRVtOnks6NMHqELNiXicJFFRGNzj3:15dKqi61E7wRGpj3
TLSH
T15AC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 68eaa05dfb74a659b4daafd4289f2201e85bc0ab2adef982ee53413b083bc719
MD5 f4db7d9ae593fbe8397a94a1d1f2a5f8
SHA1 86ade2fa0f5ad518231ae37baae585069b7e1087
SHA512 45b67e8715d90269560d32be28e7e6a9259354acf55997422cd9ce9c33f1eaed8add0dcdae0b7dae37cb944569d65db96ad02b7a968ae1f365342be9422d0bd8
SSDEEP 49152:lhtSn8EApI0figjgiDn0AP5wjLNiXicJFFRGNzj3:UX2iWphm7wRGpj3
TLSH
T17A95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2757df652795572125f30dd0b511d67157b8bb813d6dba2798b1240a55da06cc
MD5 b452af8063765fc484a85303076890d9
SHA1 0cee14c7797a416ee408ab22d835ddb7136102bd
SHA512 ecffb64305f897647b1d75c303bb03d3beb388dea9aa4a03a2f361f6f9f9de7346eead08864b2098628e3e39f7a074df23d1446193cb539040c0432aaa29998c
SSDEEP 12288:KeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ko/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D55523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c8b6d2a5393aeb3bb68782dbabfae3ac5bd6feabd934b43647ae26c3898577cd
MD5 25c160f52ecb18bf402baf85667e084f
SHA1 d185f0c7a4f7582bbf16906a4573434747ac58c9
SHA512 0d63b996d11b70d66ea4fba77fcc2583e9991518c748852cf4144fb840ab90a464cb115376799957662e9602a2535588508553007ab479411ee82eee378f31a5
SSDEEP 12288:hBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ht/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1945523D3548955B1EBBC003986764428F5881E2DEB5618E3E3483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9dc93ad823ec7da3ccab20e4f1ab4f38a845c553aede974c86ffe1305bff9d82
MD5 0e02e2c28f0411ead8f47d18fc2b5200
SHA1 450244b3992c3e02ff8d2713da5169de41a062ab
SHA512 13fc20d5aa5c187871648a52e79f7f6293523febb664c80d27814369fbb07f6af2ccb21616207c709824520c894b21c23f952c70c74c76fd20bc5705402b54db
SSDEEP 12288:4DiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:43/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19A5523D3558955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 7295210cbace9641d51a794a49ea9862526737a1b16e471b60867d40ac1190ef
MD5 087806669100af182034afefa55d8365
SHA1 d96f866c2988cd09d3744e9008e12430f132400b
SHA512 860508426b4b8fcf66788ce294bc6aace49c917d4e93e7a26b69ab3ba9acb47a563c618376527d516afce3ac7b8449f0bc16f4865387d4378be8fe42b717f8fe
SSDEEP 12288:zVoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15A552392168901F1EAFD8039C6764424F2A47D6CD7325AEBD3003D1E5A35FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0caa6306ad9669f91e1d9a5da95a98dbbf386149ce242b3089c43f51cd5e400b
MD5 2e76d2a8d969ecd46c106c2434b5b9d3
SHA1 c53877bdd621c83046520e5cd618940400a1ca66
SHA512 685dffd3a357ce7772b5e63a86733e6c50c665f219a076fe3b7dea0e63743a59e63c58f2f741015ab24e44908250740a87bdaecfdac9660c9fa357c5fa94b85b
SSDEEP 12288:jQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F15523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d9cdd259f318097e54b9bf481433ce0be3f201957b0dc2daba4d9a848d732cdd
MD5 a23bf17f884b33ed4800363a6ce09a64
SHA1 79217248975b46c4769497d682904ce9dc9d8d50
SHA512 6e6f06769b725e82202c1654ae7a27b4fc3a64be104892191f5d0fa5d38c20c51d355b0a7e83f3bb91746bb32c678d11fe1b76d4e48296571ef395b5963d3543
SSDEEP 12288:MdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:MB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A65523D3558955B1E7BC0039C6754428F5882E2DEB5619E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ba2d278ea2135f08cb1680eb68a55133ba0695aecd65aad49b5a1533b9e17fd6
MD5 8ebc487d42560fbe33ac3bb1fb02e4fb
SHA1 8d1db868ff2ba8d18eb1232aa6d0f4b38aae19ff
SHA512 b0bc6620b0beeff28de589c784f4a94ab8400773f87b531551af4247452139f3acf764f7ac79a5b650bf750c23914c1bd3e424e4d281330053683b86b9a27910
SSDEEP 12288:LJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DE5523D3548955B1EBBC003986354428F5882E2DEB5659E3E2083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3ceb9892c07632141bd2e5a85913ccb8158883e2bdc3aeec86f647f1ee78390c
MD5 374785d1c1d0ac2530bd4df9f819c1fc
SHA1 334bf9b5ea83024ba9178636ac30fc1654be229d
SHA512 d046ed65db1fbd020faddf05c877f34a60a3289c5faaa7b3ccc720e0220b053bb3e07fee6a9c5ce6c0f4ea1dd2c90652356ef097fc7ab02f286e2b7ebe1f74d7
SSDEEP 24576:HZM3zFVSON/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HZM3zfRLNiXicJFFRGNzj3
TLSH
T185750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b7685301b3c691e37f58382705ebaf504db350ae17c7ffce54a982ccb09473eb
MD5 92d4aa0aa700d0b7f9f76b87fe8dfdfc
SHA1 000af2bcab4c43f3b86a0ff9ca09632535717497
SHA512 5f0375e51b1ff374f8f120d1849859e27531c6c420932374ac1e0d04184e55f1bfa4fc598ec9ce74b2cb6a8422308fcebe0414907210c2a56c851f516de3ced1
SSDEEP 12288:+yiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1675523D3558955B1EBFC003986764428F5881E2DEB5658E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 bb8c8d3f889ca0d6961c1903d095a3ec9a948e1d67f5581ea0d8ac25703e1662
MD5 b4e291b262a963bfb5026bffbb675099
SHA1 a2c02f4f5b688f0fe870e817930d5d7cbb3427de
SHA512 b335c3e59218aa162d3ce6cdd7bb1563ee7849738b34a99ba4cad8d74ec9118d11f248492ebbaebf8837b10d1491746b08aefabae38f39338469f95305ad1f48
SSDEEP 12288:QWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FA5523D3548955B1EBBC003986764428F5881E2DEB5659E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 7aeb8ab7225c832bad064f49fc70ad53e143cd0e0a3597123751d7c4954f0d0f
MD5 716c5c8a3ad5b5979dfe0812727e6914
SHA1 2591a3e2653c76c8a699b52fc461dc983defd59f
SHA512 a28e8363309bede88ba2be3268479449256153380dee1ce68eb0ea43913f7540b85127d80747f1fab53eb87ea1da1ff5683770803850bbb25af925e91bcf463e
SSDEEP 24576:Nzy5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NmLNiXicJFFRGNzj3
TLSH
T18F650257629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f5549ba8de8b5d77405043e5b31ec9f83f29061f9186b856f2fdea25b1b155d1
MD5 7359e128d971d6f783e77ca1ac32fd8e
SHA1 c4517fc19a6eeac0d7c21db9742d8bdae5bf5e73
SHA512 67c498625dd0d3065773485152b3de560a525a4efbae0fe998cd7c130524b697182a18afe929823a1eccf8f198472b985294d02cca54bb7c3f1cd77c5d1e09d7
SSDEEP 12288:CyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1755523D3558955B1EAFC003986764428F5881E2DEB5658E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d3666f4b3bbdff55ec6ded1819387899a575031886c29028881d9f5c35db05bf
MD5 98dc3894e688038b6130ffb47c8a3e20
SHA1 5720b64f08f220819bfd396896a286fa7f3811b9
SHA512 5b139b9ce54dcd39757953f2e1044fa4597ea319ac3bb87f64a95ee72c2257ab0d6b1a422cab85bdf6888e30ba18cce2d349fa450d22e1262f7fb21952aa9592
SSDEEP 12288:4yiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C15523D3548955B1EAFC003986764428F5881E2DEB5659E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 822591372c0914993c516444eefc341db4ea36b93e801f8fa5f41cac9cc2cdb8
MD5 06d38bbd1202eda20caf4b6784b04c66
SHA1 1bd52a2d278e6290d6f061b4f84e381347eb6f78
SHA512 458563902b3040f3771e52cfb2699484def485c6901a497520e9ff17288cf7ca63e750f19bdc0b58a802badf42edd83d6d8cd98da11842da4ce3031f63465c8d
SSDEEP 24576:hzy5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hmLNiXicJFFRGNzj3
TLSH
T197650257629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 3f39097b3ede76a0092a2b695aab8ab5fab10d1d53a444d4181f25191fb84395
MD5 9e97a39af49ee7d097f35b32e9be8608
SHA1 2dce1c0dc920d74aad007fc6a647abc0dc97d790
SHA512 85e8bb5f91b2fe95f656f7abc7f4c7f955c9a257bf8228f0153a094f1b250a259ccfe94ffd5030d825dca70826d78b9307e5137255172a0287ccc921e0bd14fa
SSDEEP 24576:gT8aLl3z0zDn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gT7LljOLNiXicJFFRGNzj3
TLSH
T1747502A5B39018F8EDB7813EC9258815E2B27C1A4770CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 6048e6b56e5eb6d94fe30083a677a2c278258ead1e3278b510c502ec3e4d0d52
MD5 c918478349de6887333f9a6dbe837053
SHA1 7f267cc84fa45f65eb33e90e556d971513bd5012
SHA512 c027a655db909dabd1d4b772c215ba4537969ee8d9c80aec6baa91348352cd28c8a33c917bdcd94071d4db6aedd1c1b56c500f3caa65207c06d5ddeb2fd2761f
SSDEEP 24576:a3rd9CHKy7GZb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8rd9CHKyaRLNiXicJFFRGNzj3
TLSH
T18485CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0760167bac502b1b9cef434151d8a0aaf58b28516079af19ef8a843958238c74
MD5 e8fb627c5bb44c31628cb75c8c4aec39
SHA1 f9bcd3284b72263ba8b3b17c00ef0e07f1655359
SHA512 4e9ae93cf02932f1d405ca5b42ef1b399ecb38935d6b28fe8516263deab452cfae73500de4357688c72f5a76de4c75bdb2b9b1d7294c4964a94ade5b81e945e7
SSDEEP 12288:JjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1265523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0c2c07c97189b0f241695117fc4d98e906c8a895fcbd96bf0b6eabd272d1918f
MD5 7baba1d5a9a378257afb2928abc1e9c1
SHA1 e75c4842acc2544c79d2f6e5a2d5a136f44febf2
SHA512 32deb34cbe38e1367f27e6e0b8abccdf56801198111d466498509f298aa6e80df6a250803f3cd79df99ed647f4987783013d4e719aff92f4f956bb9cd0e997a0
SSDEEP 12288:D1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B55523D2558955B1F6BC0039867A4428F5881E2DEB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 429488c05f9cd798fa1e1d39578dd673e803f33e1d7bc694418a638856f785ba
MD5 fd9b613101b261e1d0b0fa69db1b562c
SHA1 0ceb249d7ad29091502553831bd34c6e200d0e2c
SHA512 b6a4d13763c07470d528d890b47d939442bcaaa87625f54ba0fde660946b15286a1ad6333f3d7b48b8bc99227ac4516bd99852e4c2c8091da4878b2cd3da0904
SSDEEP 12288:5MiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:52/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AF5523D3548955B1EAFC003986764428F5881E2DEB5659E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f75d7a80a054f829edcac15f9c491d8c5e82c177488413dd01dc4718f18e8533
MD5 50eb8035a694485e4df744518a215129
SHA1 097fccb2a3c410bb5504229fc7085f3ea7a14ec4
SHA512 ec56a901d10a0eaececcebe07b573e20e4998d22bd57cac3900304413449d8cd21c5f4364ebf05f25eef9a3b0b611ee89dbf613392ee205e045cd96468616fec
SSDEEP 12288:EyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:EU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE5523D3548955B1EAFC003986764428F5881E2DEB5659E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 bde608fad91f82c8f3819730617ad18379d7d18f0834cfa94e3a6e866ae5df28
MD5 aec25f0afe13c7211b3e2aff6024beea
SHA1 a8c0f3993dd2874f1b24606e1c2202ba9f37668a
SHA512 935e70a73879b4930d45dbdf9f6e28519afb60728955186619cb949ae6913be98fea0674f308a534ff0f1a422da4e536f74c4f50ee7429449d3d91ac456c12e7
SSDEEP 12288:YjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15D5523D3558955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 6fbab848fac22479b2c826ecec0b07166847db185faf94418141c1988a4ab0e4
MD5 e9a569404c2af4c65f43902412badd02
SHA1 6d421c6b2ca2c9e0fe429633364c6a15237fdf43
SHA512 975e036cebdde09781c7b61657d00ad1696b8f8348c3f4d855becb7bbc763208ca83d286cf305c42ff94c8e5ab2607dd4db3c68f0b005fff3769a0d2a567086c
SSDEEP 12288:G6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Gc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1415523D2548955B1EBBC003AC6764428F5881E2DEB5659E3E2443D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 1b170c5c642accc6f89b7748169f3171dc67b6ec9f71fe88910034f85d93d3c9
MD5 15d9a1424a776265c17207d512cfaecd
SHA1 62a6fa9f583d973ceb19bec72709ce6e07ac9785
SHA512 07e7ac6a00ac2ad70499467738864269103325d8fb231cb4bacf1c8cbf193163c0dcf4a30b92ab16d32d008d6a04acce79ce60d8147ebc1f1a882db5516eff9e
SSDEEP 12288:2QiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2C/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1315523D2548955B1EAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 929905f01c1434e7da2c4701a4870cf65b548079d713171c2ac67c2179347998
MD5 eb69d87762cd8700a10329b927bafedc
SHA1 c789b781ea81e4bf70dd7ed0102959acf6f3ab3f
SHA512 0912dc5153dff93474f9513981e49e28d3f8da2d775f77040ad4a37f7ee25268856cb31161b66370ebe92d675f09f03452f6e8653c792c02fc4f7908097b3d73
SSDEEP 24576:rfwvzk9RX6wkyAIw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+MnYIwLNiXicJFFRGNzj3
TLSH
T17385DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 21b0934ae8d8fa41c81457a7b74d1fb7e80c288904dc65241a47ab3dae4080e1
MD5 fe38a3b69cc40738a3ad1a35749fdc46
SHA1 f644de971381c9cfc5dd985f3af87ef6372ccf80
SHA512 d7a4d95bd65d8493d35f65e6e420b502574b432de66da16241dc31a875bc5f6d6c9d2c9825bc9400d960d68ca7f8f918b60d4bc96a9466ca4395eab5ad59d200
SSDEEP 49152:DYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0DLNiXicJFFRGN:uySzPb7wRGpj3
TLSH
T160066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1450406847d597887c8a8f49fe9eb3b6b922b375bfef6e3eeaa727d4f22d831c
MD5 5cff1d152687b9381d4da5602965061b
SHA1 e3e17634e3a22200ec6bf8d441bab5f8de6f4f19
SHA512 a7ea046ac6d6e992201391177152109cdecaead148252c407771f72f951fed9935f42038208c0ccfd9e6615e6182f024ef280d65d7c54c1d45a6a2695692ee9d
SSDEEP 24576:C47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:C47JUQjqirIhCnDHUPfF/TLNiXicJFFS
TLSH
T12F65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 5996e1c2c628b715bbd4c8136df4889e77bf5ea9a139653251ec1385788600cc
MD5 7fda46cd3df38650e580b49bcffd98dd
SHA1 2a279ddcba7e170f071147df0b9ce7c08460637b
SHA512 00057866016ee9452f065f008c8424f714981afabee8a61debf4b0c36c89d3934cb88b2ebf09bff6151816fd696d315d60928db30bc009a78f07eeac4a9c2ee5
SSDEEP 12288:NpsfCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CD65F15AD28802E8D1AE5139C7664900F3673C2987E1D3CB52D0F93E1F3AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 3bf820f007bacecda6ef824d2e811457355246103fc8f1bfb38c5d16faaffad2
MD5 8511d726c3884d1280b2a3793297dfb8
SHA1 76d65f193b256c80e6e1c762685131f4cfb12e6f
SHA512 4c95d2ed96deb172e41050dbd2fa703e5cafc8d75e78ef5afb2686d8ddae6fdf4a77358394ab163bd9368fb088281772fca84beea91bbaf848af3c050fe153cd
SSDEEP 24576:VlGrzUPkVCt1bUHYajEgEBrHsXI16WWro7/nH:8zU9yYPB7sY16WWro7P
TLSH
T17C4517107626CB4FC5A940365E76D6CCAB707C06FE44AF0373C9873F9476A59B6B2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 16KB
SHA256 2526a9dfcc65832c51e55ed7a934b9b917b42324c4fee12c27019300620101c8
MD5 d679381064f3d8a8e97302312af71810
SHA1 b347f6cfacea2f50c7a366b659f66589a65aaf33
SHA512 109b1b521f36f6f54bf7bab89a127a7cfc7e55ebdf6616ee6e976f2c14e7ff9e49a4e8355323adea93f5f7d783a5a6df27aadfb83a1c2d53f05616b6d2d29e4b
SSDEEP 384:UDLWWSll3llclTXjDLWWSll3llhFjDLWWSll3llJ:UDSll3llclTXjDSll3llhFjDSll3llJ
TLSH
T1BA722055FA10E763E4B30635ADE9D7DC5732FC2A6E440393B28412DEEC0DA425B6A6E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 5cdcb226e6e99016a6a4da522ee4ce9b751b65221bfed9ea55677e58e8c446a8
MD5 f297ca52fe38495ca002fb5f9f62043d
SHA1 15515be87b632820836c2a501098f88d0e1a8fa6
SHA512 12f72203ace134fa181095a1fa8aab7d4a2211febc8268a76a33d8043769385ab971e2b9da7618c2ba1d76ac21cce7bc063638617aedb02f7a9049c2d2fb1a40
SSDEEP 24576:LKLkwVTRC58oTDOaOqfRVK2ViHIB3naHQp6A8Mve/oUifPL1:UFoTDOaOHHGN8MOy
TLSH
T15B751901A5B7E74FC9BA5037423286CDBBB86C07BB453F0173858938986795EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dece897a5754df5b5b15fe44e3b4a0548b5546506fd600485ac13bf56ddc40c6
MD5 78d9620bcfb931a991e97a7603dee902
SHA1 a4cf51af10e08d384eb064eb17ce36065aa6dded
SHA512 748f37aa288560cf3caa82f012bc192f803524b43e96d91de0c612ed6bc4cf90e43c11ab4c20a8f236ef71cf3bb387e806311e6aea66e1267f9b296f8e3a6d11
SSDEEP 12288:JF7KiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:XM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1095523A3528959B1FAFD0039857A8434B54C7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9fe1e97508e952f11fea3f2777adc1b9de97b2d032c16700d9ec6732e2851fef
MD5 f753821b3b21d6b2390ae3830a891fc2
SHA1 5446850ab244e892234679d70d6038408798434a
SHA512 9768ad2b721be30ea9f1e8f356436095f28c97c46cfd1ce13fb63fa78b5c956709a0daa115ffd06508a921fe61c997ab0630c4dcdc68593d8ef0b3db77c92002
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ygb4mBIBhGFdLNiXicJFFRGNzj3
TLSH
T18565AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 17a18fa496bd9c79496ce75589f8a2f2e71093338c255401276baa80710aeae0
MD5 554fd20a338260c99ce05242147312d9
SHA1 f3a930a217bd6d3610a45bc4a8ad8f3ab6658e8b
SHA512 3c35fb600c3bb7c3ebc7b4c51569b751b4c3e44098c0ababc72bbbe61d84dc3d9af1bec0461ad00302291dd85a80dd0dd237fe19f2e3c47e17f5311ad9ee7b98
SSDEEP 24576:DG88u8FpJqH1vzria7/mN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:y7ZFPqVya7/WLNiXicJFFRGNzj3
TLSH
T11485F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ee2e6b401d8af4d42c9b1afbae087dcba317e76a3965e3f4390969c5e4167a8e
MD5 7ddcc005e79973557a5160a484ec1150
SHA1 fa29165a3c930d863b7fb33fd30d3af5b3185ef9
SHA512 49b128cd305d0da2c59a628701a67297c6a6d12ef1d1c2ee875047985094bcf5d8a59e529a5198b2847a3b872e26d0ad56e39eb75aa8d94809b895dc59382027
SSDEEP 49152:7BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBLNiXicJFFRGNzj3:EG05lO43b47wRGpj3
TLSH
T119D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 20ed2b2b414a17213a1f630872fe63e12acf7cea3e2711ada4891031b35e3f58
MD5 1318a30d6a3362b28e4d622780311be6
SHA1 8a6c3a980ba4396810300b4c5a9b5a0d9172f805
SHA512 9bdfb821e198beac5ab320da743efb3a63f5c5ce5cbb1fe02a29c5d954ee5c2bc561c357bbc70353c38cd08187d1955b697bc3db1739eec2e93c6bcbeaaa0ab0
SSDEEP 24576:2fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnD/TwSfVcYG3K/cJHlnFR+IGNe8jg:ua5POZ3lJt2pasx2+mZLNiXicJFFRGNf
TLSH
T12465BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c9d75f62a5c956d447282e01c416e63c6fc62a0521d3da8792b31f0130f4687c
MD5 04251efaa84df12df25cdecc5d685b1a
SHA1 ed553a944ab1a0a83995a86783871aa3878dee39
SHA512 3d5df778ba8462ab09f81587b1c20a0f4046c825ca47e312d360ccbef7218c8d33fa7e34c8876840f9324b0a931551a457201f1c263e193d17f33c16371122d4
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VNc/zEOVHF2LNiXicJFFRGNzj3
TLSH
T194858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 af8bb5ebcdd73948e9d06550306604078ebc6a4044e5f23af0c0686805e5a0de
MD5 e3a2fb3fd1af2c0e415c243fc74bdc34
SHA1 6c60f4b18b70f31be328a1c67e2e67d15ed45b2d
SHA512 d495331163dfa92e51ef68a8a4bb9c7deca1a6a50817fa53caf77256b4ab22dac1a8910ec2dab0c731338ef2f20ba7d77f9b77d29c97c270a2250352f649b625
SSDEEP 24576:KzkNvNnaFeYhJNtmZBmv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KzMwBtOmvLNiXicJFFRGNzj3
TLSH
T19955AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 91d4e3c0a9fd0f5a3f6486ed6f5f70c9ca541ca4009c5b397bf28b0dfd918822
MD5 79e8aabeadf097102b8795acd2014ad2
SHA1 7e2069c3698d68e935d29d43996d1af5f20cb21d
SHA512 281b25224207e79696688cb4841d0cbd0dad5140bf2bf9a12ab645203163d842112d84f2c80fb2c1ce4882b1cd0ad4cda66f3ed4a0b598fe241cd9a1c7e1e26d
SSDEEP 24576:FPUr+NQR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FJQRLNiXicJFFRGNzj3
TLSH
T1A665F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 89777ec302b24f7d7447bb186dc2e4f6b70790c568cf0c9c3d80023b977b3ede
MD5 9861521a6442d12db8a819fc25e3ed8e
SHA1 f83b9ac85925f10b334988e01aa53ad9e47af482
SHA512 d4b266f948bec14ab696c7d9de21da15fe2f53fc0fc508f4fb8a5e5767027cc5f8a84ffff987ef2d5ef2e822bee829bc39383a4752fed42ea9982b23b982fd0f
SSDEEP 24576:3D3FHshBIYQgAI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3DVHeBIAAILNiXicJFFRGNzj3
TLSH
T1A875E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1032-76-0x0000000140000000-0x0000000140483000-memory.dmp

Download

memory/1032-7-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1032-6-0x0000000140000000-0x0000000140483000-memory.dmp

Download

memory/1032-8-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1032-0-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1416-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1416-316-0x0000000002F20000-0x00000000031BE000-memory.dmp

Download

memory/1416-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1416-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1416-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2132-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2132-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2132-39-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/2132-45-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/2132-49-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/2296-77-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/2296-309-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2296-81-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2296-83-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/2528-120-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2528-112-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2528-114-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2528-315-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2900-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2900-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2900-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2900-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2928-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2928-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2928-330-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2928-88-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2928-94-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2928-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3492-60-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3492-54-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3492-292-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3492-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3540-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3540-132-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3540-137-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3540-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3540-126-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3924-72-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3924-64-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3924-66-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3924-308-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5180-14-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5180-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5180-21-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5180-22-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5180-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5828-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5828-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5828-312-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5828-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5828-107-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5828-101-0x0000000000770000-0x00000000007D0000-memory.dmp

Download