01908d3ba28c1b54666202d124d1dbc66c64656b4a71c837a602e934bddf4876

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 3.4MB
Sample261110-tktw8aa19n
SHA256 01908d3ba28c1b54666202d124d1dbc66c64656b4a71c837a602e934bddf4876
MD5 72fe214308caceb3c91d5a0f6c8e60b9
SHA1 9035426f72a26f95a39fbf57cce38e126c6c378b
SHA512 7511f029aaf8db860b1c12d4418a381fb5bfce65c86d0fd524b6ba00e418eaeeaea8ddbb23d0e5d3f446f7a1bbb884da307ff42a67b5aeddbe36ad57f39a7e03
SSDEEP 49152:oFpBteRdPW6ulVz0WpbhBIl175ZxbrGZPAYJw0Dhh6GeLpcR0dCfM45rmf/B4K8Y:AkfWrWtZJaBDD6LwD527BWG
TLSH
T105F59E0693FE01E8D1B7D1BE8A074616EAB2781D073356DB05B09A5B2F7BBD04E79B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
576	elevation_service.exe
3668	elevation_service.exe
5540	maintenanceservice.exe
6064	OSE.EXE
6008	PerceptionSimulationService.exe
2924	perfhost.exe
6076	ReFsDedupSvc.exe
4848	SensorDataService.exe
6092	ssh-agent.exe
3728	AgentService.exe
2492	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\214a85787465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaws.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce0411a12d71dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016513fa42d71dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000045b122a22d71dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a0b7aa22d71dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac3a2ea12d71dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
576	elevation_service.exe
576	elevation_service.exe
576	elevation_service.exe
576	elevation_service.exe
576	elevation_service.exe
576	elevation_service.exe
576	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe
3668	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5560	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	6076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6076	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3728	AgentService.exe
Token: 33	2492	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeDebugPrivilege	576	elevation_service.exe
Token: SeDebugPrivilege	3668	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5560	2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 1208	2492	SearchIndexer.exe	99
PID 2492 wrote to memory of 2988	2492	SearchIndexer.exe	100
PID 2492 wrote to memory of 3824	2492	SearchIndexer.exe	101
PID 2492 wrote to memory of 1372	2492	SearchIndexer.exe	102
PID 2492 wrote to memory of 3004	2492	SearchIndexer.exe	107
PID 2492 wrote to memory of 4368	2492	SearchIndexer.exe	108
PID 2492 wrote to memory of 4724	2492	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_72fe214308caceb3c91d5a0f6c8e60b9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5540

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6064

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6008

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2924

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6076

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4848

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6092

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3728

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1208
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2864 2860 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2892 2900 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3004
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2892 2900 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4368
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2864 2860 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7c72e244c1ccd4ff472590a20e5642151d65dfd9e4bfdc8ea2eb0aa7c025a001
MD5 b85e9e7e0d1140492c0379a65f41a950
SHA1 bf9dd927415cefc7fada109c47d3c384a72fdef5
SHA512 2c455ecc70406df824f43df1ea1ef858dddbfd503d723e15491c5c4e44654ee8f7906a8ef64d12a9c7d9c091056709e9899c30fe8594af382ce5c013c8798c56
SSDEEP 49152:Rb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnmDmg27RnWGj:X3q6sjBpD527BWG
TLSH
T19ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e359aa9f0e1d9a5351c9534a69d3a11ed57be7c0c31edca9f01a65f3f2f21dfd
MD5 e237a649e966a6c27841f3534be66247
SHA1 a68728cff9624bf5d3db983b04c3ae9833ff3b4f
SHA512 6b6f44e3de3f83eb0e0b3bf5dc3366a5fea3de1368ff0b792be55b3f69fd0e65648ab39d37f77bb551a47c79f37055885921ce9be645d688cfbeee35e33461c8
SSDEEP 24576:hXYfDtczAZsqjnhMgeiCl7G0nehbGZpbD:ktcoDmg27RnWGj
TLSH
T17165F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 105b833adfc94e5b89f72a68a9cf69e395eb6067b889d8dfc4cad2878c34dc95
MD5 c8ed8241c1e67b3e303eabbf0f74cf61
SHA1 15415c0fbaccc1f71c85678d321efe7f947ec4e7
SHA512 a0a21a2efa8fe2a3c234fa6846d9de7de0a7476606c9d72fe07d9320f7642fa939812312520ada6061e2f847f0b9eab92843f99eeb269b9e7d2656b0615c5e66
SSDEEP 24576:O0Le5ji0hmxxrMqsqjnhMgeiCl7G0nehbGZpbD:OPji0AjrDmg27RnWGj
TLSH
T1EC859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 069258292d0c9d86dc57ada94b5b192443781f27bbe8ffa2171a2a5844ac00d9
MD5 10297c6f7b7b8a6626c1ea2b7ac5ef70
SHA1 4cd9daddc19a6ea86ff03feb5da4f90f737b2b3a
SHA512 410aed764b2ca5a72c385f7171d2e4b97f8e5cb2eae80431c8ef53153a313466dc318a9bbbdfc2fcd3b456f0b90112695660ae0fd06a7cf60421d0e1648e7d64
SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWn6q8wyuMsqjnhMgeiCl7G0nehbGZpbD:2/ezSC6vUzPveHjyfDmg27RnWGj
TLSH
T18B755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f981b8c092d6653ad48612e35c82fe60be25bfad98f53dcd3bcb21f3d88bda01
MD5 0a3df104685ed786ccfb0373b61b67ea
SHA1 9a5b4706025aeac453f7fa85211a7cb8a4f5b25e
SHA512 c00ca964e2e2575476fbdbe78b2e8c3f02e0cf89fa8632f5ea4687c4a5deadcba7dd050ef88700ced01ec81320d93f73e14ee584996ad486e8bd7ad2af245430
SSDEEP 24576:oVbqPb88hv/l+YFsqjnhMgeiCl7G0nehbGZpbD:oVO88hXl+ADmg27RnWGj
TLSH
T172559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 dbd65d041fbc16da22641b205fc397ab6daddabd34fc96116d6f004183d814c2
MD5 48defaaf9eba7648ea82b8cd6e0f36c4
SHA1 8adbc0da950975532d306236cd9fe6dbd545df28
SHA512 5cc62c3a2ea2cf52b912e8c2747d7ececc3b6767807428c418560f682cf09f2058847cf0a9ce71a25be007582b974957fa5e172f8c1e53d43419b4d60d40369f
SSDEEP 12288:VLGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VLGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1914523BF864C50DAEB7609B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 fdaa9bfc9805d451ca1fdc77a67e2ba10552dc11ba70e0b3a1c56d104757489e
MD5 121e1571aa085b27074c0feb42230ad3
SHA1 6ba698a2e56d46fc8e403836699723504979a4e3
SHA512 765005e6a8f4897af0256c02f962372bec21886b8f8b3555dbc35d9d300ee318c042c2cc82030e30815c681886f2e1f209d17a13751a54b46ceb4c96bba47922
SSDEEP 12288:ieBNUbTVO86UtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:iJIUtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EC65CF7BEE28FCD2C27A8DB85791C600E76278314B61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b905f66e844335e3ef3255a67a62a34e16d1ed5784c4ce78eba1272218605111
MD5 aea10891ce801dfa8436c07891ba5b07
SHA1 1e8c5f7dfa1c3bd1445dec23a2575a0ddda120e1
SHA512 566aadfc56310bfcec968d307550fb3dd7a368b008a00a650c944bee5bd71593c9eb00cb7509ccb0127433c66799360e08a598f7cfb0071866e6a901e62f1b3a
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THE:2QvGAdlCEL8c/DRNw5CID527BWG
TLSH
T166266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 5fed0c55a3ff07fc67debe4c28455d5df67a5cd49d7e6b62bd61fdcdd45a878f
MD5 56b049ca7382d25cb9b5353ede844b7e
SHA1 2e5b632dbd58993f9ffe7a9ac52013de87bfb225
SHA512 79d1af9584713ecd3223a87d39f5662b3350cea73f6f757813bf6f83f0498e86dc43b9996f98a0be75821f722fc85c756e42d2d87f5b405a4b7cbfb79b6e26fb
SSDEEP 12288:2AwSfxL/2Dc3RDLLmt0LDQewsAjnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:L0ewsAjnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3dec3a5b208c869dce78ae831945faa76aef5472f8a15463eb18eee9850ecd6f
MD5 b6695d584420e652f01e90d5135d30c7
SHA1 6ab4e0cf9eee8157beacf45a7e71a05549b1b353
SHA512 6e3bc9bb8b9b819e0b1ed570b4afbe5f70f5f8bacd75ef3a40dacd0ab73d17505f6b7434f48c23a510966b40a5f3248fccd4653986f801062275aaa51bd94a9b
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHjVQBWG:AUEtQevvqc2W1cpV2tI32aB
TLSH
T1AB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 71a390db84f2f400033d326526e806873b44c957396d978e4cf8422cce101f4d
MD5 6adc2cf92765b667cda43a03e79ede94
SHA1 830f0a9e99e2ead0def4b2119152e909db460e62
SHA512 a0a995ad0ddf688659c62780dc97ee754bcaa672499a774743c14edf76c3bb61bd2065fe6c610ef3fdb95aae1343b14e8f6e6af15dbceb4836c8ee705c2f6953
SSDEEP 49152:DCbRquA/m2yL5zTfFiV+XenmE3/zbDmg27RnWGj:8oquVjnmsD527BWG
TLSH
T124D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3c8b1ab44b041930b52b9748519917330efda86b93d43937b30c25eea72afc26
MD5 19a962e9634f7a947a460ba8251e8191
SHA1 2ad85c82460e0d4bb96a0dcf48d747d86d83d3d9
SHA512 07339fd322b41ea8fe76355b466a4ef17e5a6da9f4d5ef360b535b7f0322092ef0fe72fc43d612e7f395d596c81d2c725bc8750bb50eb04a19d6b050fb0f90bf
SSDEEP 24576:7AhGL3IFoiwtA5l7S53QsqjnhMgeiCl7G0nehbGZpbD:7AMUFoiq58Dmg27RnWGj
TLSH
T189359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 1cae7403d84d72b8ec6fb02f08cf2a8145fc047c9864e5d20d99b508d212b9da
MD5 7ab2d8d74d69d1eb5b1166f42b32bd81
SHA1 27eddab78b147368333db107a272d5cff720a1e3
SHA512 960aeb81d8e37c6e2b5171636085e1245c6f6398b1746488683867314e3dbc619f66a6582819b5db495100869071e1abf2848f251e4e935c7145776bcfe80a68
SSDEEP 12288:bmw5HEjsChNVBFgl0WDm+CsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:6wu4OWLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DC65F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ea2e4b3737b90b22f9af7a902cfc4ae0887b7df3e9b517e7ba8fe7e71f3c9336
MD5 2d734524e168afe03e68f26dd13f50ea
SHA1 92bfda8a0edd95874fd0f1d1b42ae7a2f38e719d
SHA512 14a5c8f3191f5bc5a9306e92f03b0c7ee5834e78964ff8d4c7e4f8068c2e1f6cb9ad94bd0cc9c6389eff2c16a12632c21ef7c00d9b67dbf4e5114284b016c3d7
SSDEEP 12288:feZ1Iy3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GZuysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D85512AA239820FAE163417CC5E5D609E7333C62673043CF166656AA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 281fb8f7234a065aa7e5900ceda9eeb3353e1559d693790ce6f431f325f903ff
MD5 937cb572f6c5321c071921e2c9155ff1
SHA1 e63a2c422eaace1478b37272a60d84c788e7721e
SHA512 10e60d2e0ca70060fca83be9f43dc49e83d83e5797d1ecefc7315d94959de4c7a940683382698986377227f3d1690ba5ab288bc4477d690f2fe916b35e9ae873
SSDEEP 98304:GQRQyi36YOcPbLvw2gAf+PN3VD527BWG:tQyiKa/X+PNFVQBWG
TLSH
T172667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 787918b06db6d0ea316022d28df57d97aaf90525838d3efbae77e844ab2e797e
MD5 abae48bb5f8235ef0fe738270af05ad8
SHA1 7a50fc59ed3f73c5a5bd7c96a55f8b0833c90f9a
SHA512 fbad02a3abb08e9db73a5aad2cae2482b289495d541cc0d99a5f79760d510f8f834b7a7780c9155dbdfc5daa82abb417f62e68af3ec9d55f96a6c069cccbfba4
SSDEEP 98304:7QRQyi36YOcPbLvw2gAf+PN3VD527BWG:KQyiKa/X+PNFVQBWG
TLSH
T173667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1a4c241026f706f234ad1201cbcab54d51cdf509d131d9b9435a369e6f0009b8
MD5 1de3e2fabb7b2a189ddbd45a7d34c7ac
SHA1 99b28ff44fd26f5f7cc19891c883252bfd6e1ce9
SHA512 dc963e13d9cd6164eb39059da9508aacd121364cd951801cd8249d71c7ab5f78c6db461c28f3d057ab76cc97d2be37ffbdf48aba4370f2c1e7116d65a714b0eb
SSDEEP 24576:UwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0isqjnhMgeiCl7Ge:a68Qg55nhceWu7PNU3/rDmg27RnWGj
TLSH
T1F4B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 464c7789f0aed8cef7ca0e83a41cc8013b55e13942e54a54078b13937d21ca0d
MD5 4569621d77a317cde2f188b480043af8
SHA1 ad2ae2b5e1dc70a787230caab8cb82482c05c8dd
SHA512 19eed06e7cacc21ae34d7cf7a31630d929b1e1c389427da86ad6c83d23a8e44bcd85c26c53edd26371f836d4bcd9f22d32ccac0a96a7fff227283573484b5503
SSDEEP 98304:yy5112gYy5azzVvt69nLKnhZKD527BWG:7LIHEWh0VQBWG
TLSH
T11A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f1313959f555f33087fac80eb9036e1f83a7c5034094389927a1d54b593f0a75
MD5 1a7ad2846d0fc328493fd4334a8582cd
SHA1 1d91c1c38a2b209bb924267e6d6909b40fa85f76
SHA512 2282728036bfeed5da516b82f3daa60f89891e6d890f0351215f7dbcc87cf13f83b3ebc0ff685ad12d89e3ed77f7c0525da9a0fbd1e35094a62b1340beae2944
SSDEEP 49152:hB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glNDmg27RnWGj:3u6Jmdxd2dND527BWG
TLSH
T178D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fb76d8f93c68a1cc291530a590077bbfd5e70d615df495d0ace967f6913f757b
MD5 5bdaf1f19e92d8748a53f4631ce3c4bb
SHA1 3a581f0d65c14273bd141ca5312765f2cb6fc160
SHA512 90bd936d40eee78a58308c09e8053d1e6764bf121eef65ec7629d9273f87252173ef0811155a3c3935d71c66810dc5944c166f757aab31e7293a1c2bed265d84
SSDEEP 49152:k1hpsNoJpF1A63U44CwH7R4xxDmg27RnWGj:kmifPWRsD527BWG
TLSH
T18AB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b1de69d604112b63a84b0f29ff0366f7dee137bb69f5525ceee7bfcd6b773c53
MD5 e479b5b945fa4a4728844dcc48ed9823
SHA1 43b78ae69ef4d84da7054ed24a756f8b95189043
SHA512 fbfde850324b8d72305d84c3945b413fdea23f8059ad5e2b9c302ed4339fe7118b5b13d972b7b5158c0b78286d44fa0dc85a229fae669d297cf54a12404f7909
SSDEEP 49152:4SuZQIY0Be2KcRVtOnks6NMHq2Dmg27RnWGj:i5dKii612D527BWG
TLSH
T1D5C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3b4b8cc846e9c46884a98b2aaad12d6e312da907b708b0777c5c5b340c2235d7
MD5 892eff9936267e8ea37c0a9192d222fc
SHA1 0cbe4e6b1aa67f30c70481f93670f3f4a8e1bdd2
SHA512 d2e2d52f71e4f36e46ae6ca7080286e8854e5ace337858a8f2c3e3d2cd7125007b4d7b88cf3250ed8518e521ea59cd9eaf2e418e057b3d31f138e68dad055d79
SSDEEP 49152:uhtSn8EApI0fig3giDn0AP5wdDmg27RnWGj:vX2imphQD527BWG
TLSH
T1ED95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 83fdf166e922ef418e234db5d701efc3e32a2f50cf522728b2c4f847f02b06ee
MD5 dd505127f0b0718414c2b0fc8b7f863c
SHA1 5c7de1ff79ba2bd7914e55b427e1f01df207fd6d
SHA512 0ea1dfe3584adfd86b9b2830e0540fd621d5534c9739255d1e95cac900c2c1ea3d287fdb7eb8987ce7cd07d1aee9a88242b8932ddeff10d7dd02b8d973878896
SSDEEP 12288:juXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jusqjnhMgeiCl7G0nehbGZpbD
TLSH
T15B4523BE965C41CAE52649B5C3E5F10DAC073E5BE92004837A977CBEFBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fc1169be9c929a7c499a926986718618d2180c9955a048dc8e69332e7cd0e8c5
MD5 554288765284ffb9dfbfe27c10436e53
SHA1 93263f002727080907f023f170b881d6b8c99ef5
SHA512 e43e224591c8150f07ade65f16a275b62d5a53bc4ca3840342cf4d0a3d6719cd7f2a76aaf2ff27de9ac7e6d5372d30c48436435010f2013e07b5b6adeeafc22a
SSDEEP 12288:mjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A4523BE965C41CAE52648B5C3E5F10DAC073E5BE92004837A977CBAFBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 037645f27129232a5a0c24ebc8037871d806db18585ebdb0e7ff951c41bed898
MD5 05fda1119499af7a0085b545cf87145d
SHA1 48d039be29f40b15e008a18f7c4d0f3a2e28c70f
SHA512 3b770fcd48acd147ab66c7754066052065d89db3a08065be9ff31a844de7d6ca2fd77a25d27901ecac1d468a1c4096143b8ba3ff35ce501cf7209dfc45081f9c
SSDEEP 12288:L1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:L1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1174523BE965C41CBE52648B5C3E5F10DAC073E5BE9200483BA977CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 90eba72bf3165dc9b8870b14a0e35f9b3ad36e641151aec815978035ed167352
MD5 bb60aea2a1a1797c926b14b08cced805
SHA1 c5c73dbb506100c886773d13ab671bea71888a38
SHA512 ecd76cbe7d3dc5a0545d29529d06a2949001c85f700c0de5c8c4e9c331dadc3a7e74cfd4ac54865fac6e43b298bd0c1a99a31e9e302a32cc8c35bb888b6cd93b
SSDEEP 12288:xVwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10245236F675C01CAD83285B4C2F5E11DE8237D96EB3005DB6B532CAD9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 16a7c67e8a2e384f62a6c4c0d775143a3a2e08b0b9e031d4fa906d74f789d2f4
MD5 5bdc5fbe9d83cca08610cd50ef98eadf
SHA1 991893a8264ffb6fdaece98787e21d83bd91fd88
SHA512 415b3a8218c8a1b44095560629582b7934e3619139c7b97ea31023d93c6b3a093d1694ee9e9f5f95569c2dddfe797e8a257cabc8631c30c56bd9574f1e149d87
SSDEEP 12288:WoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WosqjnhMgeiCl7G0nehbGZpbD
TLSH
T14C4523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4c88810b353afb6575e0e28c7f015086452e490cf76d9ab5227aa178a52d5cc1
MD5 319892a0f9ba88ba87dedd8d657882d6
SHA1 4f28f421439ef726ecafde6d0f069a7fff24f4e0
SHA512 1422ad4d082859892bfe543789414ef055bb74f109abae68f6627f54392baa373fdba322c4937b9702e3f5e4e69a67278851ff8cba742dbd055a58de8bc2ae9a
SSDEEP 12288:NPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1624523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4552777cde82636d76ce96b5c4875f8cf53612532e0085b51768a8d0a2b87215
MD5 5a1dda85c672ae3111604ef5ce750446
SHA1 041a4214b43eca78c7e601aec7f446e0fe65d34b
SHA512 83f8d52c3feaa65b8ea1365e13593b13f5b9861df7d233b1cb8a030435721b8ddadc789f9bedf04909fe013f31812ab96b81d2848ef403cb05000be3b8cf339c
SSDEEP 12288:Y7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Y7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1044523BE965C41CBE62644B5C3E5F11DAC073E5BE92004837A9B7CB9FBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 efc06cf09075fa8b87efc96ec50ad2d13d426f06033472bb044ea50a2327c54c
MD5 ee8eb54411374589e9702bccb88bd237
SHA1 0244d63f704c0142430e0cf191ce1496b62dc4bf
SHA512 482da6b2e15f13d5367da17babc5c43e7e4a0b7070e527da2aeb3bd8ef84233ca2757bcc66e8659b8ec03382bec745e3d2ad690d49787138205ccf62e464d756
SSDEEP 24576:LZMRzFVSODsqjnhMgeiCl7G0nehbGZpbD:LZMRzfDDmg27RnWGj
TLSH
T1C16501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4d5a6c4a459c7e1d31a217d4fe84acfd964faf6c5d6b1c3613be0f6add5df6b1
MD5 225cf951aab5a07a0f93abd3e862b2c1
SHA1 bccde41379da3dc44ba87de13931b893170104a4
SHA512 7fbd28cd2489d4cb8a24cc5d6b6ce91f2d15d46ef7887de6acafc64e34dcbc23c4bded1bb7550aab04661e8bbd662807916817f03e16ef6fc7f69355e3235d88
SSDEEP 12288:lCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ED4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 54d67c00a07f9a80b0bdca2e0da51ceca63445703e40a8468eca534196743bb6
MD5 8b8bbeef17e0b579a7703f8765c0e130
SHA1 c0e359be1ea2794e48eb6a0a86c1995b93fba4a5
SHA512 ecae15d448004db3061c8506dc3e783c43640725a3bd47e0309efc074646b73fe5f506336083da68c3fa9eccfdde9790b25f7db0adc78d43abaded6fce06c9e3
SSDEEP 12288:qWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD4523BF965C41CAE52644B5C3E5F14DAC073E5BE92004837A9B7CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 370df78a6a373937732f8322234a42694b7666d5875e92a645931393b79487e1
MD5 e2d3a2b94ad6594cb099a8c2cb3a1736
SHA1 ead5b8777a2d609ce7eab84915a6b78b1106b1fb
SHA512 24b60e5d77bf8fdaa18e403d22a35b1c76c1bed7a5b5e79c15c162b4cdb2bddd14f315f35243da17fd26c1e7a618d70fea9fed094284cfdc29359dbd33e87750
SSDEEP 12288:dyPz5L83Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Uzy3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AA55125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2ea2b46a4abe90731485448da7c96896dc1aabb209f3a7416e971f60b734f84f
MD5 92e87143af995383b7ffc621557d2c5d
SHA1 acce22be43b13befb5e736f3f6d598af1ac3cc91
SHA512 c4006ff6254c1fb97f16276986981d8ea0382e0d58af1fe88615f21790b7e3db4076ad2542185689e2200203e15ad2e11cbf9de42d8549288ef32d9fdcf60e30
SSDEEP 12288:HCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1614523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e51df289c6006f5212354b2b9a8e106fc525c6db6048c73f24a611cb6bbf8104
MD5 f6b83c089526249f06f5ff154e22cfa4
SHA1 db452210f9245d50afcf0115244b0d04e4027cdc
SHA512 adbba1f1bb45ebfe358889c100188816877c484fcb888a23e4c7d16f18c5c53bf2682838e4adb32466db8e009df5cdcdc18e5c89a9a2c4c278f61d9335b5921c
SSDEEP 12288:6CXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6CsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A24523BF955C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 63a369f6221339f08a6ad762d5142253bf578e1af9b8099e711c0fba77268ce4
MD5 b727ba84284e0f86acbd768dbc3d281e
SHA1 4e80dbd179200e1f04e38ec5a08482c30fa93644
SHA512 f80d405b35ee0784f0c88ca7de6b609bd496440498d55ac0de7586a6adb9dca2fc9f4e02df479f984f5cf6a01cdb5ede2531f9a4617876706453a4afcb393c64
SSDEEP 12288:lyPz5L83Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:szy3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14255125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 8421d1490d1ec340491171a3b52f681f4b378e835329fed023872dfdfcb100eb
MD5 ae3390eafa25ac803ee82bcbb18c66fa
SHA1 105f0cfce93ab3e82c4a6ec46b250eed7140b3e4
SHA512 38d4a0cdc959fe0273281ab99661576d9e69509a434eb7ca18fe7adf9cbc721fbc5f499bc980751d2c4f1b873c6543060c281f4616a12575feffac3f38c6bfac
SSDEEP 24576:ITDaLl3z0zDlsqjnhMgeiCl7G0nehbGZpbD:ITuLlj4Dmg27RnWGj
TLSH
T1116501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 2af7eeb8e10a8af600f4e669d779735567993f8b6fcbc7f3844b25da89e6166c
MD5 4bcdfaf1575d54df4e5698dd0327945d
SHA1 f0488894e2a626e6cf5ca39e82e6766bbb51b2ee
SHA512 7ec1418553e536d76281ee38f66eab3afeb720ffd02d6918a59c82863fbc46d6cf39f18e7008485adf4adab8b8c741f0cbcb30efa6f91fe4576ac25591cf3506
SSDEEP 24576:r3vd9CHKy7GZhsqjnhMgeiCl7G0nehbGZpbD:Lvd9CHKyaDDmg27RnWGj
TLSH
T14175CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 223c8c784465b283efc5b4e5142c9b505c75b1269e2c68f3e2ed238e0a7e3449
MD5 993907ed21016155e298eb708f3e4d18
SHA1 94642796fdcbcf2ef2d502f5be172618b1507fe9
SHA512 17407429822dce221402fc652fa3c142951c95b26f15a161606d3a19db6c6e357afbcdbbfb40a639b8b70ed3aa39313c510b84ace22e2de23c035e11a8d65b6e
SSDEEP 12288:OVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1564523BE965C41CAE52648B5C3E5F14DAC073E6BE92004837A9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 079479c75c28a4be869f40d34e7cbb3af2cc504b8e9d6158f086b246196999e0
MD5 871b751f6f3135822f41fb07fd0ee1a0
SHA1 f0f174bd987cdacfd9d25ddfdbc6957dfdba9654
SHA512 fe68e0af9d01b0376194b2154834ed8b8aa7546cacbea749523f5667e91889af55b4c43e3303f7f7705669195dec8e6f3f14675b87a0b49be3cad0176b0e1e7d
SSDEEP 12288:HXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A64523BE965C41DBE52644F5C3E9E10DAC073E5BE92004837A977CBEEBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 faa2404f480b6f93efc3e45fc19a26c956c225c814f0f23ceacc7844f57f277b
MD5 2e61d4ee6324c3d8baab39190b7e66b0
SHA1 a44fe6c2cc799f41eea73dae93f024070453e934
SHA512 c06e4e134bb541c19f778c0ad9894fe22598ff217817e7491653032e9ad05c9b749b11caa40401333bf8cd9ff234c90e4321ed285320d3196daded393382bc9c
SSDEEP 12288:BEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E74523BF965C41CAE52648B5C3E5E11DAC073E5BE9200483BA977CBDFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ae3e47a1ad944a211e515d08d26f9f5bf9555e1d7144545270ae9d19d1bde151
MD5 1817530a1d46fe304f06fd35049da25f
SHA1 fbeb3fcb172c55ae71d0e59be818e5dbf7a50f71
SHA512 d7a2386c2fd3cfeb97889f60e17d007499c3c145d7400fe582a7a23af101cd908c82ad9fb10bc99c608c58dc15e71392f06980eee1c4159ea1c30f346f550e38
SSDEEP 12288:XCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E84523BF965C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 0799985031026d3ed0c5ce1189c724e5db2e875eaafcc759aad24f211ddd0023
MD5 bff3e113f1ce5b7a7f2131774a79a1fa
SHA1 f3249d360b58248790215871453d81377b8d4399
SHA512 2214ed5a30594bf02e7d6cb70b25b44d7ffa02ad0221541bcfe5dc8865ff4f8e836d2a2476ef78bc61bc2dbf60172fac9a7661acb40f4c68af6205fbca350d68
SSDEEP 12288:XVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19E4523BE965C41CBE52648B5C3E5F10DAC073E5BE92004837A9B7CBDFBB14684B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 ee2dfce025b82fbb57c8051a1a7510337f5ee49da4c13fd6f76dffe3e0fb24eb
MD5 c06ffc20353f85b01a9a63a75c9c05f0
SHA1 29c3fe828781d40b4c93a9bd9e1c7fa0c8f4db42
SHA512 4f76eca50b24e8255ba1342316a268a21a3dc435a3d2715d232e7432341123e9f41ce47e3b32c87fb5c8f2390e808348d89bfc7cea142d395e34deda5e4ce9d5
SSDEEP 12288:zaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA4523BE965C41CAE52648F5C3E5E11DAC073E5BE92004837A977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 793aa55ee3c8caecb728b93c2f8a64ecb4f3e8fe8b6c21baa002b5838f950a13
MD5 0f56e8e1a71fd6fa05d9df24450a7a0b
SHA1 3c320c6515ea966fd7f10755af7cf786c869c09f
SHA512 f9b9b51bbac0245f983db4aba2c131691b3fa576a0f1846a5908e53ab89cae01a0850cb443be47754b2cf66f2079dc4ca1926381992164aeacc48a466a06f2fb
SSDEEP 12288:3oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3osqjnhMgeiCl7G0nehbGZpbD
TLSH
T1994523BF955C41CAE52648B5C3E5F14DAC073E6BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 ef510aafb919b182ed5fac0e71e704d97f3b6ed1fb63d296e1ac5797196ae66d
MD5 479596a66a5e721f12058817a03225fc
SHA1 a980ca4ddd59e9c1532c94fc3e305ee325c1d408
SHA512 e085c26bbd97f5c57bd84ee07ac3e76ef857e8e967110a611edb1cdcce3b2ce8cce2f1ad14269e3d8fdbd606250d732a6e302f20eb7ed87df235a4e4d327a48a
SSDEEP 12288:c9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:c9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1374523BE965C41CAE52648F5C3E5E11DAC073E5BE9200483BA977CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 acb68b550966c55ce266d8d29a9c9a12111f953b36596f8a8b7c867ab07d1c6a
MD5 561123431547fd1b94012fea8eeffaae
SHA1 e58980b6bcd8206313bd83ba94768052dc5e17c8
SHA512 07e0adcab55371a21367fc9929ea2f5675e3f614b3e7ceb43297d2ba34475146a4e9e634723f55e94f436fd9b0748519e348b0d38434bd39fb012490024d2f49
SSDEEP 12288:YoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B34523BF955C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 520ddaa347667f5505354bd11a173c6b55202ca2ce753301f38066aca48e7ee6
MD5 a8d36e9b0e7cbc8fc4cf69490e552950
SHA1 d86584715104e46cba3af02eccd4d4af8494fa38
SHA512 b58bc9676faf635519c6fa2cb772c8caa669b7a7c8ce41617b54e47e341877c30d847e26e23dd3963ba7526f3629b18aa1d06ce4b4dda2a093515ff08d6adde0
SSDEEP 24576:EfwvUk9RX6wkyAImsqjnhMgeiCl7G0nehbGZpbD:AMnYIqDmg27RnWGj
TLSH
T15C85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 523bf2bd42b882caea1410d075ee1706169d120431142aa35da8b1c8361d2303
MD5 3b40432079afd6707114e48d59d9c9ac
SHA1 6cc7ad7827428b2ddebd123fae6482a800687ac9
SHA512 f0be425ad9286ff899f2b6c4b24767da978621dc4f317f17f21de24ec6d1aba665a1029d23734a70979b294295637360ee639dcd4ef32a38cee44d794c9c7032
SSDEEP 49152:OYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK09Dmg27RnWGj:9ySzP1D527BWG
TLSH
T1C5066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 583afd9b9797d8cacc3b501a8f1015d8179755e1c481baaa1f827d25a7da4579
MD5 4ea3c96734df3b5350b15450332fd68d
SHA1 8c1b005bb5b8dea0dd96116f59b00ace7871f209
SHA512 311cdf0c74faf2edffd64c6f49b687697c7161fe5ebd26b48a7f3825d5f05abd9aa664a504e8771239fabed9790bef75a8614e12c5896a79dd9a05cbece64a0e
SSDEEP 24576:i47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYTsqjnhMgeiCl7G0nehbGZpbD:i47JUQjTirIhCnDHUPfF/NDmg27RnWGj
TLSH
T1FC65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 58a1070fc5f4b8fb90924e2ea9013d70045d8f8bb6d0eedb68c5ffd46a6a2169
MD5 a36f8fc907981c66cfc2c613fac983be
SHA1 9fd8b8a9227a156dec4b98567b159614f5c43160
SHA512 90889dc48ace2b5a6626785f15b5970e8183f8b6fbecbe6068e4c7ed8fed945b291cff2f177d2d4dc2f2c4fc0a730b7d9e7841cd7a16ebb14948a264565bbc9a
SSDEEP 12288:EbsfyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7ysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A355015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 1c226a4a5dc24db5143e5ae8d4c33cab04e21696d9e0c8721f999b1569a06287
MD5 7ce90f8592df0fe49fd2239791ad5a4b
SHA1 584e403417c473338edb25ec5007d93c0d26bf70
SHA512 63995fac04113365102b7bfed50450c69603f0f2b73ea6ef7d3775f27a40a0d19b2d3e8bc2dc7b930fc8bd4fae3a9057b6eb74dd0923065a82d8ec58219b8c79
SSDEEP 12288:3kipuX1U3fDPeZg+Py6y+3yeBQr0YPXFFrQjTROnwN:3kiklUPDx+Py6LfBQr0AXFFrQ3ROnwN
TLSH
T1B33506017666DB4FCA6940322E32C5CCAB707D01EE05AF0773C9873FD576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 3efcb1af694c44bb07c28c20f6d5089ecd58222061c6f6f12ee5025aa5c524d7
MD5 5ea2250e27c99a0caa35e9f915cfa9ff
SHA1 f5e1b07dcb304c836cbcd89e3c9af08724089044
SHA512 74d8fa82f05c2a6684bef714addaff7dc220c5b3013c4680a6bff27ba67e9f3f2a165c4117bc836d2f3bab519e651bf33c7e63be25650247e45ea4ac5ec8e241
SSDEEP 6144:kZeXD7g3OAPx1KQe1laf/6M+QytMxtQytMxNkLedu48YFIm8yYsOPByBiFEM0JCZ:kZez7EDs7OfaOPpP08ApAh5
TLSH
T16565F9419137E38FC1BB6032072A5B8C7BB4EC06B7496F27B7C9453AD82A75160B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c6270b4d67c7d875332cca4f1293150c5ecf3f2f04097fe862ced8eb7f49a5cd
MD5 44abcfcac3ee3c5d02514a41901f353a
SHA1 ad88f49c97b91a5d21d0fd7edbb13233c40320c3
SHA512 d7d8e590e77945f07958283c1f1a24544760f9e39f308e21b6c89785384d3bc4c0f7a2c0b6a0ab2f936515f4c69c0e527adb5f888f43db81a6f5483e78f765f2
SSDEEP 12288:307KXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19E45237B934C518AF93609B482EAE12D681B7E669F1044C3B94778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ec39f191ae35083f17467e3d32c2e0d3fe523faf0e73be02c794156756625909
MD5 a738ebd3aa08a968c5c196590214e817
SHA1 7589e1f4a226998794b28e4bdff90cc10d0e6568
SHA512 94f39755264a51ca9429b5c1f24840b3a9b6e4bc017c8b08c534358274ba094beca7a13503c4722d0a90dcb7818a624e8633af9ed96bc41c7d118cb354e9fcb9
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYMsqjnhMgeiCl7G0nehbGZpbD:Bgb4mBIBhGFXDmg27RnWGj
TLSH
T115659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 0169f4d4d861b7fbacf235daa610733e82addf31f596749255ea2099ac889f94
MD5 0030ccd10d17bca9d4f19d5a3c140ba7
SHA1 f1fc622ace994e168ff34f15e1f9fe8a53c921d7
SHA512 25d6b9e16d4917141fff314b62ccbfa70d58a49e85392c3e37155a938d464537cf1961b6ec42238cef75422be6812d9083ed8dc08c06c407e28c5a0a206c4f89
SSDEEP 24576:vG88u8FpJqH1bzria7/mDsqjnhMgeiCl7G0nehbGZpbD:e7ZFPqVea7/ADmg27RnWGj
TLSH
T10D85016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 40945f4c6c07e42b984f53cb71843c892d4012b544779f4dd836f65c4cd87b69
MD5 8dc03e1bccceb76712d865e85ece655f
SHA1 9934f2953bc4a46f215f83862d4b42d6842c2299
SHA512 f95e7dcd7673181024abe30fefb4fe0fa57e3a1ac99c0655278171bafbdc7d8a229151d286917c7fde4a89b3def0ff8e27c295f44106431cb5fef791ea7ec4a7
SSDEEP 12288:ZHvUrBFrEjwaQfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:ZPUr+NQfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13665F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7e7c9765ccf7cd2a549b75b88a4701aed908a660f9f4bac65aaff76711360f4c
MD5 80049a85811375a525bc47176208628d
SHA1 96a46124470d0ea493b7b6c1a1747389b6c6eee2
SHA512 821e388fff1c3fcc7dd66f888ffca337449903797d08527cbcefc4b818781acf5b8f84842f385ca81d17bd6eb918367f02de9bb550b22e2e1ab01cdb7c70719e
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzDmg27RnWGj:pG05lO43bSD527BWG
TLSH
T1BFD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f08a2a65087ed8dc188df0439dbe8cca100aa81b90bffdd709035dcc6dcbaeff
MD5 07511ddecacb75efc3aa20ed38b5998e
SHA1 446e47370e7e976573097c36d26eaa1c9ba8d132
SHA512 458b63bd2ffe5a625f761461334476793a70eb5eff3db5db34dacb43bbd95671a76685323189680d9d03ca53952a4eb77e6a12f8fa063db1d60caaaac3a951ac
SSDEEP 24576:mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn5sqjnhMgeiCl7G0nehbGZpbD:+a5POZ3BJt2pasx2+mrDmg27RnWGj
TLSH
T12865BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 92591fe2ebe9c6687a8e8a6a96b924f543d0540529adbb43c7db0ead0eb49c40
MD5 18810adfdcf3a2823f781116fc077a90
SHA1 8a3c5a8528fcde8daa51a6d47f6580e5fe1852de
SHA512 f0413b4eb300f01b146eeaaa1c154728ff0c675fe6cb6c1573762b75c11cbf2a51237cb7480c2a80c9dbf516bf0b5661cf2faa2f7bfe535bc9a6ddea473194f9
SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7FkrsqjnhMgeiCl7G0nehbGZpbD:nNc/zEOVHFgDmg27RnWGj
TLSH
T1A7857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 af7c2315c8a770bf917b10f4094f2d06c4429b248337c5f6a08046da0273070f
MD5 36e18e872af5cb3501d8b53153f08d04
SHA1 80cbddf9f2b080b5d0b343513306e7243f819b7e
SHA512 58616eab509b98c377f4bdedcedfe04256428acc810712bdfebaa0d64abe17f8503f76875f35daf567ab65a08d06e2ea0c136ddf05260c07f82b0a4098ce91ca
SSDEEP 24576:ITkNvNnaFeYhJNtmZBm9sqjnhMgeiCl7G0nehbGZpbD:ITMwBtOmhDmg27RnWGj
TLSH
T16F55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ccb1d93ba31c751a0a23faeda05f99aacabed5a4e5c18ded6e65ac2e89f035e5
MD5 e7a4a1339b5883add12613e9e0eddac7
SHA1 f4de564cc39cdb7cded9536cbb873c964d1886f4
SHA512 c4944ce4281e7d92fb07fa3f820a7a57b5be31030b04dda7c701254c8a6bfad4d4c2a77c00c33cf1469556803c585f76ffec69a8f9e76a1f06f870268ffb05b1
SSDEEP 24576:ND3FHshBIYQgAOsqjnhMgeiCl7G0nehbGZpbD:NDVHeBIAAiDmg27RnWGj
TLSH
T17975E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/576-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/576-15-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/576-22-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/576-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/576-21-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2492-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2492-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2492-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2492-362-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2924-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2924-301-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3668-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3668-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3668-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3728-126-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3728-131-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3728-120-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3728-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3728-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4848-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4848-357-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4848-358-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4848-93-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4848-99-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4848-360-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5540-49-0x00000000015F0000-0x0000000001650000-memory.dmp

Download

memory/5540-44-0x00000000015F0000-0x0000000001650000-memory.dmp

Download

memory/5540-38-0x00000000015F0000-0x0000000001650000-memory.dmp

Download

memory/5540-46-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5540-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5560-303-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5560-1-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5560-7-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5560-309-0x0000000140000000-0x000000014036B000-memory.dmp

Download

memory/5560-0-0x0000000140000000-0x000000014036B000-memory.dmp

Download

memory/5560-9-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5560-79-0x0000000140000000-0x000000014036B000-memory.dmp

Download

memory/6008-66-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6008-72-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6008-300-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6008-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6064-285-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6064-54-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6064-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6064-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6076-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6076-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6076-81-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6076-374-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6076-375-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6076-87-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6092-361-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6092-114-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6092-105-0x0000000140000000-0x000000014027D000-memory.dmp

Download