e6055b3b3cbf52881a73541802e1581ebb27ad29f3616a339236b4eb18ac0691

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 4.0MB
Sample260629-cppdvsa14t
SHA256 e6055b3b3cbf52881a73541802e1581ebb27ad29f3616a339236b4eb18ac0691
MD5 dbb8ae1e885e0c6cd016c4f674a90508
SHA1 03b41783fb058acc2d3d47074dfedfd845b9eb99
SHA512 90089dffb858455ef1fd860ecea2ca1d7b60d6ee83074f4fc02323699b826d18f992659934541e90194b834b8e4aa4af04988dea32119bacc84da1b7482a4b0b
SSDEEP 98304:QZnuomZBBBBBBBBBBBBBBBBBBBBBBBBBBBBU2lKWLm:QZnuomZBBBBBBBBBBBBBBBBBBBBBBBBJ
TLSH
T1C1169C97B2B500D8C166C1399742E577E7727C150BA49BCF12E16E2B3F279E20DBA720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1420	elevation_service.exe
1644	elevation_service.exe
1132	maintenanceservice.exe
1372	OSE.EXE
6288	PerceptionSimulationService.exe
6840	perfhost.exe
996	ReFsDedupSvc.exe
5328	SensorDataService.exe
1052	ssh-agent.exe
2552	AgentService.exe
3500	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\62608be6fdd07f7.bin	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\BackupPop.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091c4c32d6d07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003dd5ea2c6d07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd5bf22e6d07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040028a2e6d07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae29ff2d6d07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005172a52e6d07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
1420	elevation_service.exe
1420	elevation_service.exe
1420	elevation_service.exe
1420	elevation_service.exe
1420	elevation_service.exe
1420	elevation_service.exe
1420	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	2552	AgentService.exe
Token: SeBackupPrivilege	996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	996	ReFsDedupSvc.exe
Token: 33	3500	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3500	SearchIndexer.exe
Token: SeDebugPrivilege	5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1420	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
5740	2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 2480	3500	SearchIndexer.exe	101
PID 3500 wrote to memory of 1916	3500	SearchIndexer.exe	102
PID 3500 wrote to memory of 3576	3500	SearchIndexer.exe	103
PID 3500 wrote to memory of 3584	3500	SearchIndexer.exe	104
PID 3500 wrote to memory of 6920	3500	SearchIndexer.exe	108
PID 3500 wrote to memory of 2568	3500	SearchIndexer.exe	109
PID 3500 wrote to memory of 2272	3500	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_dbb8ae1e885e0c6cd016c4f674a90508_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5740

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1644

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1132

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1372

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6288

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6840

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:996

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5328

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1052

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4274393721-1801116158-3678143273-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4274393721-1801116158-3678143273-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1916
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3576
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3584
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2568
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 edce668a723b2b8b6eced8574ee0a09d71381c4d932b83dc68ae49230072140b
MD5 36a44e8621c4219271e40538d85e9f72
SHA1 f1fc7355d2a9aa99cc18c5bef9a32abe5f17150f
SHA512 75ff63a7e673f3c4f3beeb06e327e3fed7ffdba597484c810fe6cb08f0a999c424b5c8b8e08e83e5e977080962072eae3985efacc8eef0ce314a5c84f37ae72f
SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxncQ/lFTjN4:K3q6HjBELm
TLSH
T1BAD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 78fc75bf564a0140c5281c8d8033fd9083b2c9a3104ff243d1a958f885734846
MD5 c7db92b570d978359a483f2c3ad7b0ff
SHA1 e4e76aeb3a030c3c1f1761691d010c1801ee3ba7
SHA512 c1bd4432a3f044ad2a7542a31c7695fa6c95c3d2bcfec088b88f427f691bcd3180a418d7ee150d1fd3faa39b60f8767722b81643a8d73b6f5740e208316d19f6
SSDEEP 12288:j1XLsswWkxy2lRq2czALGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:5XYfDtczA7nQ/tbw/2Mkjy6Fr7g0oa
TLSH
T17865F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 65f80c1aa1216cdc77f943311d0b8ecabd5bda9e8d96182c5347b32407a03b77
MD5 d52e957dfa86495f454960160aa30a79
SHA1 a36fc459634db99bd8ef507cfedcad7b970285bb
SHA512 0d997599f81f37af671536319d85e1243627465d3c8eb19c73cbd23616c47a83ddd705ed019f1fbeba0d4ad11250b293fd9284291bb7ad4aa85b862a40409dcf
SSDEEP 24576:W0Le5ji0hmxLrMknQ/tbw/2Mkjy6Fr7g0oy:WPji0AldQ/lFTjN4
TLSH
T166859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d42c61fe94711d0100a0e33f24d5a6ce424e93a622d9022266395ff54afdd615
MD5 d71744c2b939a0218822c9c5dbef7df6
SHA1 85a088827183da274aa8964d8bf3193153c94717
SHA512 3f2b9f6319b486833516693532c11e9ae48067ac318650fb2f5b72c879bb4942d16d93fbdcb54b3e8f87ce814dfb7e7d4aae7e5e9b0587cb40d4fbcf7c1ae928
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWE6q8wyuinQ/tbw/2Mkjy6Fr7g0oA:R/ezSC6vUzPvxHjypQ/lFTjN4
TLSH
T11D755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 377958688b6b6587dedcfc4ae23f6e2389486a79fd9a0087930cbd3e6903cf04
MD5 e0cc0cacb75e47ef307271d9b7d32567
SHA1 ce606d8b603a5746794894457d35b4c9c198f477
SHA512 d60feb715eb3e9cc03d33d88fa783a6e1145a498998741fe904e1580d9f6d518346a2258e3750c2135b95fb5b01e854dff91055ef6033f30e94229cd68daa2c1
SSDEEP 24576:/VbqPb88hv/l+6/nQ/tbw/2Mkjy6Fr7g0oo:/VO88hXl+gQ/lFTjN4
TLSH
T17A559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f3fe8891a368300ff266b7fe69939a12fa436bd7c023919ad8602693284eb46c
MD5 d5a61021c64b00ca5eb087e97c280f26
SHA1 dd434d4a277dd9cc0229d5773828c37402582189
SHA512 c2407ffea8b480b3c85204af26c013630764bd05e377c83fca8b014d10df3c4413259daf71179c54d75750e965d28d375f9a66b36a3a6cc40a1003621cef8b27
SSDEEP 12288:zz4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:zz4nQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1CC5523796A14F89BFF2B06B55CC284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 2dee8208ce808fd79bff43c4d0fd1b18ec3f4c2d56b4f6d844d8fefc7b818f9a
MD5 b6bfa9984eb7a475cf11d8aace10767d
SHA1 c3211973c6a4116b011748b39dda0fb81af9390e
SHA512 7dc86516e013df7822b98333215eb3152bccebcc4b292fb34b1098aafc536c887d1b85a8e108a80ad46031aa285744551d588033bcb81c807261e9c9c0709f0e
SSDEEP 12288:NeBNUbTVO86UnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:NJIUHnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T14C75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7f89bc7ba824eda677ac62fef6b6053d87355f15b55b4c98343334cf2128528d
MD5 6694880ccbe8d83ff248660f738fc834
SHA1 ca28d39b9cbba711260a181e84df35fb7f080300
SHA512 9084d1aca76d9962fd56588827b35b0337477db6eba34e40dd92da9283c48d9bedc4d6b687853600f769ea3153e754f97e5cfcac3456b5ecdc6f4bcd03fda77c
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THH:dQvGAdlCEL8c/yRNw5CdLm
TLSH
T143267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ba581cd308f9e7921ea6bb2a72f8b57678d0e4341f1d53dbef7aa093a5dc9010
MD5 c12545472efbe60fa12e9e402b173610
SHA1 7b31a406527f4d6155990254dd5ac6aca4376312
SHA512 c257dabc99bf18ad8347b091957a0760a7f6cfa36540ce710a27b12daace0315c89694bfa17c1f1d89fe87562326c91a292aebea391113f757fa0102cbc33c1b
SSDEEP 12288:GAwSfxL/2Dc39DLLmt0LDQewsAjtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgg:bQewsAjNnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T11E75E031FE74E436C77F0DB61B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0c9aceafd47526b959bbe140d1974d3cfb886395be8fa298c7855d322a6f7d0b
MD5 30996dea0a6254481ca1c331b89e33bd
SHA1 d6e03634882f2bde8a27547b4d2d19fed4f66282
SHA512 e4de07392f7905342f10d89e5724b217b2c20ff0acadbe245c2cc3c84534be3c6da94cd63cc567fb146d9bd4ab4e89c1c52feb4c72fc777fc3c28e59cd4e09a5
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHqL:SUEtQevvqc2W1cpV2EI32
TLSH
T1BF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5d9b34d2c4cfba4169c2318fffe4050536c8e7d62f4166196b5c13febf10a655
MD5 50df32a2f4f90585b11e85bf070178c3
SHA1 ae9d3f9b7450059ebf2ad34039bde1d166635ba6
SHA512 cfe01b0fa52872f1cdfdf9b4afbbd6f0e32a3763ca2ed0bedf529af0d17e7b7660399dc37912e42143867b4e6cd156686a332bb5603ca9be308e3570724bad90
SSDEEP 49152:sCbRquA/m2yL5zQfFiV+XenmE3/ztQ/lFTjN4:FoqtVjnmJLm
TLSH
T140D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 dda1f14e29c36ad2a15bcd1563f861ffc16a0d8f5d90e0364ad0a2b8d80bc96a
MD5 b5eb3a705d50c7e56aa398b07dbb2dee
SHA1 eb07788d31dfd55d5776b3b80772822dabf62a18
SHA512 a7f02d8665d38a1d97dc7ed259ea6bf9ac7dd80fee34b62882f5ebce1060fa0c3925cba06f872769a64bf362e669939bc4b16575601610f1424bbabdb19f7088
SSDEEP 24576:8AhGLJIFoiwtA5l7S53OnQ/tbw/2Mkjy6Fr7g0oU:8AMyFoiq5eQ/lFTjN4
TLSH
T15D35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 43676b378b09a825f7f2e4372ec12f500ccc99df7d28279ab8758b65eb798c09
MD5 4d2ee5db2e5cdb4b0d3adb259aae65ac
SHA1 3b0a735d482100807bef2bdb9be35c2d77e98c19
SHA512 cfa3d1e88577794b8905ea2f03163cda7d0f8fa9fcc271c3256ecf296c5e78e8912660b81903e6981c8f9e0396af64fa2af693cc4a477f4bd34fec4f577fc707
SSDEEP 12288:Zmw5HEjsChN2BFgl0WDm+CCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMp:0wuHOWJnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T13F65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0e7096e134c3756ae08e36d65e30c190b9783b34f057f11b6e162be43186521c
MD5 6f54e6de0efebb4b0778a89989b5a09f
SHA1 6603e97531f44f035b3cb9a0bd25ac0682aac3bb
SHA512 1991a713505890d4bf09f761378688fb21a1ade5068a3a3744a469e358f37455bb9004d48d54ea76510895d34df6953d681a7cbdc763651150af9914b4e7c182
SSDEEP 12288:ZXZ1IydGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:hZuMnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T14155126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 702a0d405a48adef6a4d5604c9da04235723bac538ad38f8ebd46cdb377d45c4
MD5 e01aa6d1338c1c8389f3e1816e73e2fb
SHA1 7697f55bd858397f2690ebc3c0f12687a67ececb
SHA512 e7360c693fb725167bb9d3ba3f969bb8737c1b785ca278ab7c252861ea71516d30625d15bbf703cfa7bdecf09506fe6d5df8229d3795e12d4705a1fdf60b5053
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uz:dQRQyi36YOcPQLvw2gAf+PN3ILm
TLSH
T129667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 04f8915266cdbb4052bb606abd54168209422e1de063cbd7594dde5e40e11fae
MD5 baa5855400a1bbfd88966f98228243d7
SHA1 cced24717bb606145b3a9d9579324e18237af5f6
SHA512 9a9754adad5db804e795e641fc66ac5cfa682640590a875b789fbe63c21e941a5fdd6907263d486ac63665ec25cf3b72c0ead573b02a438a56c3fdeeb2a44b5a
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uz:qQRQyi36YOcPQLvw2gAf+PN3ILm
TLSH
T180667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 32442529fe7c88321b07fae3fda4b589b1dd1c513cb0d0b46c3fb26256ba2428
MD5 1ebdf74d931a9625d478112ea6f28b58
SHA1 9171166d4ed545c916dc2b51e2c373a18214265a
SHA512 2e7dfe18042cb2090455919dc471cba14c4b94bc4a1accce2abccf97a8fa0b808813cd88899c786d736ce5f6519a283b20d70fc1e9aaa25f64f050694ea97674
SSDEEP 24576:KwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0cnQ/tbw/2Mkjy6V:k68Qg55nhheWu7PNU3/dQ/lFTjN4
TLSH
T1D9B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0086b7ccb2da13cacb6430fac51152347601546655c9a07bb0bfca28788ef515
MD5 4a67e42b10d90a65ca185941fda10940
SHA1 a4ab871e217bff05576778997226d1708f333f57
SHA512 ad7b33396eacdc7a299e0005c0bb8bdb687290cdce2beaefd17d46d74bdace31e732bab465bf6527b5700ba4f1a3dcd3e5e43a5bb18597240bad202de305ecf6
SSDEEP 49152:g3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk999:Ny5112gYy5azzVvL69nLKnhZbLm
TLSH
T1C2167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ea5abb2453deca4db1baaf45a1745d0abb7b41133b7c4fed0275a98df4ae60fc
MD5 d8ee25cf4da625e055c020aa6a8e3262
SHA1 5d1e45cd1a9925e634c5cfc02f89c27cdf469fde
SHA512 63ad5fc774c81bf7ee5d7fd764fbc51098e1c1f7e547eccc4b292d40e591557fbe7aeb51104bef7a03fb5c36f075e56dc31042ffc34a29a642dd010d908a39d5
SSDEEP 49152:8B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glLQ/lFTjN4:Wu6JmVxd2dALm
TLSH
T143D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 afffa806eecc0175cb37dc59d0637dcba56413346200f1fdd625ec3fc2d9efb1
MD5 1d276ddd44b28649118810a01e85c144
SHA1 f144be1b4acb1f881945711d4cd1a6eefe5887ed
SHA512 0a90bbb695238936cdbf9099b3c5e110fd2f601fc9c4fc87242837a256b2e1399f78ff3a975c18fe58d634c9773439b963a488dfb95c4a047838a6913d9930be
SSDEEP 49152:J1hpsNoJpF1A6UU44CwH7R4xnQ/lFTjN4:JmifPbRJLm
TLSH
T1CDB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 af2b81e42436752bbc3d05860594aa9940eafd072b379be1e034de736d91c588
MD5 92be9a9fc5d8622ce496d3627b09c21e
SHA1 9a794d9093e0b70decf7dcadbcaa1eb938a6ae4b
SHA512 737cf42dc1772c1085798e3ea1cf22d72cde46dc3787664a0d9e77c97a50bb27c4ad4dfd35206a86c71e3614e533d2ab43c9cfde59a4bdfe848bea5c0317f0d6
SSDEEP 49152:pSuZQIY0Be2KRRVtOnks6NMHqMQ/lFTjN4:n5dKTi61vLm
TLSH
T112C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a2e9d722d19c459a29e5a7572343328ddc206af9fb9c43754c92cf16c78cd803
MD5 b3f2dd985fe2025c50a7d7d66c3e5eaa
SHA1 64901d6b4b807618f87c28a861325d6e67d9a580
SHA512 628fa90ffc31c7d25851623f76ac96f39e90c34356e297d5c1424bae67547ee41ce55b8c21ebc210a09f10a35f48e90ab0112ebec7d9baf1a87b4022c92656d2
SSDEEP 49152:qhtSn8EApI0figngiDn0AP5w7Q/lFTjN4:LX2iyphFLm
TLSH
T1B495BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b3b06ff067fcc7845fbe99ed346652eea9df9e8afa2dc9723150b55d82ecc2ba
MD5 cf29fa0dbe33bba56527dd34be164025
SHA1 91e35770ec45fefa11fec84ba4731cdaf520729d
SHA512 27bd90234202ef20eff8409560728c042b1116eb6bf5572d1fbfc9b9a1587befab95622c4694f9f75aab2a2e935308eea0bb2eb541c56abeb086a6ad618a29c0
SSDEEP 12288:aAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:agnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1345523697964F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b6de8ea370b848ff6059bb563eaa6d1bcfc64f900b8de30e6d0f03a7611f74d2
MD5 871bf9129d54a349eedb74e5b35e6086
SHA1 f0c26e4ea8258dc6f2fbb9ba02e2560d46a1f1e9
SHA512 7dd56cce6f512795f62cda222350913c18d4473113bad5e0a36136aeb72768b35a0a29d39bad3a44bc929fde67db8acd42bb5e89f2b4f820d6432b62cd42092b
SSDEEP 12288:SxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:SBnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1B95523797965F98BFB1706F14C828182A73B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c6f264933ce9ed4417343291261ee5568e86e3e25287101b28c4d5ec625c74be
MD5 222ced2b7f54e66e7e0d18dce700ab94
SHA1 f82ec81347daac1868c46bb1d9adffd1c129c8a8
SHA512 6ce58b8dfbf002bfa0fecfb8bd3eeb3c0742aa471c79ec0152d36b32b7b9ceb1af949b470674e7ff61b8a00adf64eb4f4113f74a6de43b02880b89c04c547f0c
SSDEEP 12288:tvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:tPnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T17C5523697965F98BFB1706F54C838182973B0EC6BFD1A38F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 b0d9b48e6726e48927d3d2b1d117616a2ad815c5a3037a00433d1027c5e69824
MD5 8bf21229067ae582e0ae58ce9d136c1a
SHA1 cfd9c4b7f434336931824592e86cd191d7cf71dd
SHA512 b54822b72a1139a78cba4ffe48a81d848d5f6634726e6c979a1cafe4afe13a7f9da234783ba978d49dee8c67758828821856568ee574001218f97ad180c72c4b
SSDEEP 12288:bVuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:MnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1D55523693A69F4C7FD2742B4CC928142E77B3DC5BBB1A38F6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1be736b3e9b95795bcc3fbe7b81c50771e5d60ad4813c79005f8dc2fac9f2b71
MD5 9294c2698af2c8ad1bb97839ebc86f31
SHA1 2ed76979e36217aa7ac23db0ddeddc4c211507bf
SHA512 83839ce834f0555ba6b3124b3fcc8a026246e36c86a21d1d094d25967d8cfdab81de13f5ac2e8d6185f903ffd1df4e83e86bbedd7279d37c783e839063ce269e
SSDEEP 12288:gGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:gmnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1A45523697965F98BFA1706F14C838182A73F0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 98f5b7dbb04fc9075790a3c501534ce7abb02b07c3439b328dea2957824ed919
MD5 12c0dd488413d1be32f8aed6d1d30da5
SHA1 a32b3be9d961be56a3368ceb55319655f6d44e5c
SHA512 7fc2faaeb934b239ec8d8a35a0c821bcd4453ef5e4fe16a993afddce0ddba79bc8ebeadbb1b4ad6127bac9213992cb7629425ea2ef9a3516cf27071ab18e7f05
SSDEEP 12288:IVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:I1nQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1115523797964F98BFB1706F14C828182A73B0EC6BFD1938F7B482129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0c2b025ef4efa17137814272003beec30580a28fe65713c5a71013edff5076be
MD5 bf597c73fb86e65a026f9b8419cb789e
SHA1 d10089c1428125fce3531fe81e4836bd54e6c58d
SHA512 09df08fff2c6837d542a625873b6344c3ae2adbff1c28b3b6dafebfe90a741c786f29dceafe27f688e2f66bac035db6717a7f9c1a175af900620d78417be80ed
SSDEEP 12288:gJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:gZnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1C65523797965F98BFB1706F58C828182973B0EC6BFD1938F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b4dbd44a15aa69fee92f3632ba13953247a71beab763d3b054f189a826f561b2
MD5 e5b3cc133b64a7437a71e56639e463d4
SHA1 3030d4162578806444692aa220aba02e7e57e278
SHA512 76e2ab46e08d38f4d7d54dd106f357a667f80b202c9c2c2611591b944f8585b14c7a510ee9c458c50de280c858235ba4a10a2db3bf91e6160fcdde6cc029fdba
SSDEEP 12288:7iZwbDzzFEoS2cPvyRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:mZM3zFVSOhnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1497501A9B35058F9EC67423ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c3a1fbcd1f64cd8e67d5231b0dc973b515305a50505a42412c496674245d691b
MD5 e2dde85b89a4e343b0575270030a116f
SHA1 b732ece6b499a9e060ac1570a53bc3b4b4388aa1
SHA512 dfd74d1e36dc9762962f9f6d62d5dd1a04e527284f8393dd8a302f393b590d717f534c452bdd76fa9288f18b99173e8c250765d94fa7e1c60c1c4d3c623f804e
SSDEEP 12288:68GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:68nQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1975523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a22035b2a42e38ea86ea163a556a54b112c86769de3c1b62d1abb0eea6a1fc12
MD5 7b8d86c27139866843e66e5c2ad0083a
SHA1 d9015ce342270100b4e9d75fba32f853379e6d60
SHA512 2113e65c3c34c84399111d0171e57ca45a7242e73dcc36ae449122f66312b1cb37f92ae11941d500cc408cca779948b37b770f0cf1666fc9fada9f905a6e4aa4
SSDEEP 12288:koGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:konQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1EA5523697964F98BFB1706F54C8281869B3F0EC6BFD1A38F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 3d435492ea56df02d223df8582bf778bd19bd895aef9b2bca4c47adf20cafb30
MD5 6fcf8196592e5adb40cee2d9a4a77c6c
SHA1 c4513a7c7227cc4f61c621147a58fe7d80677ee9
SHA512 5a5b198cdf9477ca1f8ad0026584c59efe2456e8235a3db43511defc443ee9a43a68105fa5eb404ae3bd0ae53283cdfb2c87f03732349435f0d9163382e6c6cf
SSDEEP 12288:LyPz5L8dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:mzy9nQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1F165021B77A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c29efded4c6aacfa9063e7f06416a855112e113fc31e606cc0589e4bb237a514
MD5 fb276e35b5df0b92b8b23997313f7ce2
SHA1 ba1de79c3daf618e09dac2bc38080cdb195e2d47
SHA512 2b2b18be2796245135d360594ab06fa42d22e7d937fa8f4b143637ac2a5bf89a9f5aa8bf30a1d55b684803ce3d4917244e0c38656441d0cd824ceefeaba93e96
SSDEEP 12288:t8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:t8nQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1EB5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f6428babebe6a2359b0f4fc023825b00f99cccc7f6b16ac59c696d6acd2ef46b
MD5 d56f744630378c073276ebbef4292dd0
SHA1 57925b3210f5db3e17d44d5fb270527bd1e2e4b7
SHA512 564591a78f89139a321db1f8e990d63f24fa3a882ccef82832e318aebc6fe35735a3b0210f3b2782d6668b7aa33899d55f590fc23cbef8413efbf6910b9a4a5e
SSDEEP 12288:c8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:c8nQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1B95523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 2391aa3e53e32c9dae589556273621c436a81ce31bc2120aaba1ad53981289ea
MD5 6eb3107724a4b4ce1f02f831d746697b
SHA1 2545d186004f9b05c8e87ac687bebdb1aa6aaba8
SHA512 f641b48389f0b28964aca1dadcf39e2df1423f7fbd1933cc6a5f52e0fade8b9ecec48b7a5fa7c2d8bb40c2132b871bd40f88396b22b113d57bf6b3180837d780
SSDEEP 12288:AyPz5L8dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:xzy9nQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1D165021B77A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 cc314bdbd552c01b6dec8710010ab86beaecd4a8670580c6d90d605a648eb69f
MD5 1fc4c36374d90099e40f515834ef5987
SHA1 5b3aa97b69439eca13ca248ae08cecd2cb63a0fa
SHA512 6c06eb011a3ff15247e842f8695aa839f5a07ac90c437f5faa136dffb5a748ac7e18b11eb1ce6098e7a91ee59ab7b3e601c63925ab4058c2e24a6a6f9a89d9f9
SSDEEP 24576:ZT0aLl3z0zDfnQ/tbw/2Mkjy6Fr7g0ou:ZTDLljiQ/lFTjN4
TLSH
T1C17501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 14fec96e197ee0c319736f88ded9c7aa147518100e9ecb9d0b090593cbb3b71c
MD5 23299a623ef6f5650beaa43e218a081a
SHA1 003124e18a12eb367482da5f28bfd2833c3e8094
SHA512 7973a5484fe51e33ec95cf489e203ca3cd1f74d90e559230cc19926d02ab934e3cd98eb03e6e38fb9e929d6526f35ddaba16acf90ec32ec739de521bfb340f8f
SSDEEP 24576:Q31d9CHKy7GZDnQ/tbw/2Mkjy6Fr7g0ow:a1d9CHKyalQ/lFTjN4
TLSH
T1B885CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ba1c61c6293814b564af5d7f7de49822a5c8e789b462db80e83e76336ee5e70e
MD5 87a8daab2cf3c541a20f461c7d8b55d0
SHA1 380ed2b8b889b1a0b7f37f29093a95bc61f9cfa1
SHA512 7e71318151afa0afd0d8417911d3957ae000cba47e2b8b6cd8381b49b18d1efc648d87e90b425ebf3534606a2c97d9eba004cae168b90d3a06a1cb76392b4dc7
SSDEEP 12288:zPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:zvnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1EA5523797925F98BFB1706F54C8281829B3B0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5376392e3122765843fb3f54bec7574358e08212e8270cfa2b0c522a8d9e5718
MD5 d2f2b2b629d8fe56191e81342559d7c6
SHA1 7964d46cb8dc5ae6ecc67f1ef780f8b49335edc2
SHA512 c93a754ee03dcc9f3b9da7f218a0c2804334aefb7b56430272928cfaf2002613d09ca0cbda2d82053ecb9be018496321c21562ec6f14e7077209d9629087b330
SSDEEP 12288:P9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:PdnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1F45523787964F99BFA1B06F54C838182A73F0EC6BFD1938F7B481129867D39406CA384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 6d840aadce9d4ede68189c39601bf658f35c12f27c7cf4a9d8023a55d6c8ec34
MD5 feb2d478c43e200b88f38de608465afe
SHA1 fec2b2d856fed61c1dfec4c04be9e747700e36d6
SHA512 d461dc9e3ae17ad34743bd4f5f1eb5067a4436f0247ff2f3676f4abee32d07542f5bf37ff0a788ca13970cb85d9252e4a88826509095afc11a65f467b34ce4c8
SSDEEP 12288:06GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:06nQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1905523797965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1071b6320375de6e075c27c45cdb4c2b80d33eaf4fce8864e2b5ba3c42045061
MD5 78e4d9f88db3dd1d1642360f630212e4
SHA1 2d263fe4e4811a4ea2361d24deb36b55a9a2b099
SHA512 93f3ae8c3f6ddec00af029297b8f3de59d9530934b3f0573b9b5c79f191b29e68b93b92206bfc17393cd2ef4b28f79112c5edf3e519af1badd3ccc0f48a06933
SSDEEP 12288:m8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:m8nQ/tbw/2Mkjy6Fr7g0ou
TLSH
T10C5523797924F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 18dd9a8287a2506e16a280f3bee477262ab01ed1151306a5a142a8d11d042cd7
MD5 bfb48feb9818704eb83f1346a275d69c
SHA1 8a1118fb11953692725a5d64f3610469eec9c804
SHA512 47f10d4ed312e25fa799059468ed33baa51fcfe130ac41cea92fc095fabe6d1989ed738a6d65003094aab558c97d3dc9d346d9149806ac443c1bbf4bf3a2ef02
SSDEEP 12288:yPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:yvnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1AA5523697925F98BFB1706F54C838182977B0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8ea78c35ca25e7f958f96519adf707f02b364bd392ff27a5cfa79d21bc65b293
MD5 fea4131117ac3d5aa8404627dcdc4204
SHA1 32401a192280a789c040ceb1650788a354243174
SHA512 51f250ad0b3cee51a5fef042b830177dfdce76abfc478b5acb5f99857d6c10b5e03aef3daf8e8ae3a0dfc462e070dabb849a5b05bc9d5cdb72cd61058ca1e003
SSDEEP 12288:LUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:L0nQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1575523797964F98BFB1706F54C8281829B7F0EC6BFD1938F7B481229967C39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 5af71500b24c4f41bcd6ef418214927e3f8d48737c4b8e6ab8b690646a437443
MD5 3e1cb8becc346d4b91b1cbbfb811d6d3
SHA1 9c55c9f7f857f56216b1fc51364cd8387dfc9617
SHA512 f3074165d2d02d824a2b4454b84599d29c760df9d2c16035680c4ce54dda91d9284fb0009f25a3f4f898baaeaf9fbe19fd460bd5b56b7e289ae9c1fa834b3ad4
SSDEEP 12288:lGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:lmnQ/tbw/2Mkjy6Fr7g0od
TLSH
T17C5523697925F98BFB1706F14C838182A77B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 f3b87a8f44c71d962b573b36b09a12214cfe093a0133469afe5ea6d6c15154b7
MD5 adf314636d50c5d872fd43c343431965
SHA1 f17df1e2827bec004764204524b0c05d37da146c
SHA512 4e64796b026bb4d26ba375fd05219670c628528e368c02a23e5ab294f867bcda2a0ecdd9f6ad3cfd0fb0a6efe15c44ce1f057755b79465642713f74065ae9af7
SSDEEP 24576:ofwv/k9RX6wkyAIYnQ/tbw/2Mkjy6Fr7g0oS:nMnYIYQ/lFTjN4
TLSH
T11A85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ef72c691dc386f237782ed35ca911f0f9aa3641c8f08519121f9c168c888d201
MD5 4639ce87fe8e9a0450b30d7eba98deab
SHA1 362efd96378b18be05ba8e12a107750ed0ae3e8a
SHA512 2488d2ffc2b1b2a2042317f18504ae9c9491e914ac13683146738dc7680c65becfe6da736814f468866dedad26e2b45c8a30b3cd7adaaadfad60609cc50a640d
SSDEEP 49152:ZYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0bQ/lFTjN4:BySzPoLm
TLSH
T1EE066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c6335e1d85cb97663fd2450e616676528330fb7ee4164c31c3fee8ce3387597a
MD5 5f0eadbcd477e11dc90b72290962cbf7
SHA1 bc19cc3aab2eb062958252701f4d79884ac10fdf
SHA512 c9ca0ee6b07eeb5125b3387c4c7b00bd1b71eddaf0ad3264013341be37a67d280f39ebc757852b98231d65176cd15817f827daeb5a95defb5f885106860d0a4d
SSDEEP 24576:G47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYRnQ/tbw/2Mkjy6Fr7g0oh:G47JUQj1irIhCnDHUPfF/LQ/lFTjN4
TLSH
T1A165AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 67a860fad8dc153d84fc9914441fc19d282c6cd3a34d6cf37490d13e99360b8e
MD5 3fa2d1a77e75ae38ee69a870a74ab406
SHA1 0d15db10e8fe3d42b3b6a6d35facaca72d730cf2
SHA512 b1f516b302850d03fed20cc31bb57d876eea8d40f00d1949b9cc5216f60ee0e6587016f33334f27001f04a2bdd568e4a3d63decc328142e2ee14b3b00e7ae2ab
SSDEEP 12288:nssfMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:rMnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1A265F119E29852E9D02E5279CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1024KB
SHA256 4122ef22ad12f3619cd0a06793b4f96d3b532066aaae9344682ccc65a7ff1b41
MD5 e54fa220289c6ae3c8a644e2dd7a1164
SHA1 e3428b0c9b0eb0d928c0df30bade435f87f8ba5a
SHA512 e2d399313d8fea2ece96e26821ee506e83e9d70b8e7f8fec8f3fdc0694bcde11946a352736ec64eca2d34aa6980663d4869d2e59a0af6dd6c5d79dd3008a8210
SSDEEP 12288:fZkHU3fjtmxjkep2HNjBo4VWcwJZP/KCCusClVjN/v:fZ6UPCCjZWnz/KCKClV
TLSH
T145251740B66AC74FC6A944721E32D2CCA7707D51EE046F0373C98B3F957665CBAB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 5d6fd37a3cd91b2e804f961faa223134ce357342a64a1eb6929607fc8bd8afaa
MD5 0b22b5a6cc2193eaa8ea2dabbeeafcfa
SHA1 2c5a2c77689dfc05066aacfce73c90028f45f3e7
SHA512 536a9d29c8afe7b17b0d1715e5f5a055606699c0373fe92828e13b356bf725e8d3bd13494d3e2cb9619fdf313bbc215a74c4215d3c3a12db8d80eaf5ffe5ad9d
SSDEEP 6144:dKZ3ApspkcqkESssWGJOOSi2vzOd0G217YBkhK3iKB7yh0y3m8HZmkQ2hm/R/QR0:ANksO7i33LZpsVnh2+0Smmps+UJHdz
TLSH
T1D765C740A136E38FC1B76172072A5B0CB7A4EC17B6496F27B389453ED866B15B0BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dbee7eee86d1007ba8c38f8461906e068b9a6f5817e168f37b3b725ada96b1c6
MD5 ea48dd72cdc1d280be89c96f9cf04be6
SHA1 e999dc42002187c63815050276fefa835b6d7921
SHA512 0987d200a4f489ad164a72322465676efbd994278609762ddf340265d4f6cc938e6654c62e50c186ef3bef1ccae7f61ebfaaf6a2717eb5b2676c714526d0819d
SSDEEP 12288:n67kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:uEnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1D45523796668F94BFA3B06B448828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8e8fd47ac90966b831f87350b6b4b38122446ec9737c8d57c49729dba3b9f36d
MD5 592a7e32a2540c39c89feccf76d1aa15
SHA1 3f939d79fec8f8cbfba08dfb8534ba40bbf8768b
SHA512 77630f8d4848087bfb41d704f4a5073fa8ac1f67af50d8ebfeae8c8293dbd6c1581023395a1a5aa9e6b5db7634c2065904e8b115d47c7cb2d675d86109d97d53
SSDEEP 24576:lgb6bmBIi49WNNFpg1rSvFv7bYinQ/tbw/2Mkjy6Fr7g0o0:lgb4mBIBhGFRQ/lFTjN4
TLSH
T18665AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 ca480a6f9883c022e50f85245a8459d1fa2f7600e5864ce4fe135a157e279fbd
MD5 e14f756faa41b3bae6af9de5d4ea0679
SHA1 279ada1069546eb50b58ecd2b55b9328e22c4d0c
SHA512 7c4f19b1977a04f512cad309ac300696cd4324ad15f0b2e60298d325d0c524856c1a792a9665b0b4393eb737ff34829935e5af5132b70f5e0a54bfbea186c632
SSDEEP 24576:tG88u8FpJqH1Qzria7/mhnQ/tbw/2Mkjy6Fr7g0og:g7ZFPqVva7/aQ/lFTjN4
TLSH
T12285F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 26bddc1138226df6917289e813fce30cd47566da9bea989b937e43fde9b89220
MD5 bafc7f8f33f2a9f63108185a09d0a469
SHA1 2c9f7e775daf3ec21ce9ac677ab584ce625c0fc3
SHA512 1ce12ce818d94c1db65ce73cfd02e36adf7915307e05eea2c1e7a165a12d100dc912a71938dc27ba2f94d47f351b74ec29acd1cbe30e48067483a3690933a593
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj1Q/lFTjN4:UG05lO43bjLm
TLSH
T15DD5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 18224e41aad2ca78aefcabe58a285f0763128de55733efc7cb3391abc1c72e41
MD5 d75479ed794779ebe6627bfd8ccdeb8c
SHA1 b94edecef5d5a1e8f18fa29ebc11966b382cfad1
SHA512 94a7cdc140cd3b0834c3c97a3df9c46212b654e230a0a2120a49cd2472476b0c936eec2c7f36cb1309d97abe541dc908b818b7fa44921ffc0c850228fe4c79be
SSDEEP 24576:Bfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnbnQ/tbw/2Mkjy6Fr7g0oy:Ba5POZ3+Jt2pasx2+mdQ/lFTjN4
TLSH
T1DF65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5a03f67bf3a9171c8fe8e729e632633860674b49a7e78678ae04fba1a1443151
MD5 040dee1b18053e25f72916db4d17d433
SHA1 369bbfbd0affc24271063e8363c7980804ac8b5f
SHA512 d7731e947552dec104f7a26bca0675edec3a6d21072650a46e6b0ab134d769674458ac53e2e26b08206e342356d2a1b528b59bbc001c29f378bdcd662774f0df
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7FkpnQ/tbw/2Mkjy6Fr7g0oQ:WNc/zEOVHF6Q/lFTjN4
TLSH
T1D4858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cb2cb7d51ce3fc6091c328690082ba2021fb7172167ae92def52d43b55205c44
MD5 0fc39766e9a1295bc0dd7712b059598b
SHA1 546f39dc57eb21499d9934b002e177e1b87bf433
SHA512 6e6dac7cd00a60561c6ac6b355333b8340f82cfe7d27fb9ca1aa1a69679f43042595eded998c615fff0270ffe61d2b157117939e92419037c8849900c072a1a2
SSDEEP 24576:T8kNvNnaFeYhJNtmZBm3nQ/tbw/2Mkjy6Fr7g0oT:T8MwBtOm3Q/lFTjN4
TLSH
T12D55AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 43b58da412748ee036aeee9a73366c8c7014de86c5d461ba92166ec0c2d56772
MD5 cdb23b876af5e0df0cf298cc1c9074cf
SHA1 efdd77e321b27eac7cb5828bc5825c3a02d89f9b
SHA512 a2e699953afbf887fac225371983be0fc7ab36b2e0596e70854d94b016c0f3da825d045de48181ac2061e3ba460acd914af41a90b8beaad8255fa46564b6c4c8
SSDEEP 12288:8HvUrBFrEjwaQFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:8PUr+NQlnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T13465E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f1dfa7e94688da98f761a8c9ec7a7e41649c3472c8e9c846b489170a24f7c52d
MD5 a63a50fadc00f93b265e5f0ed4a93042
SHA1 fb9e77b15a700ece86f9a789467ff38bb9f0ac03
SHA512 6b918cbd4c8618c34f0f6d0d73fb2f7d5432d6b4d5b4bd27eff50ff99139ae21f74167235f8f731090799d1c11bbd6915c0efcf1d43333f25e90aa4cab65a5ac
SSDEEP 24576:ID3FHshBIYQgAAnQ/tbw/2Mkjy6Fr7g0oM:IDVHeBIAAAQ/lFTjN4
TLSH
T1DC75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/996-99-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/996-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/996-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/996-93-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/996-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/996-332-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1052-125-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1052-117-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1052-320-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1052-119-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1132-43-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1132-44-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1132-56-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1132-54-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1132-50-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1372-296-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1372-59-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1372-65-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1372-58-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1420-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1420-19-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1420-26-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1420-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1420-25-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1644-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1644-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1644-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1644-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1644-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2552-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2552-136-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2552-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2552-130-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2552-139-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3500-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3500-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3500-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3500-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5328-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5328-111-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5328-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5328-318-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5328-105-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5328-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5740-1-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/5740-0-0x0000000140000000-0x0000000140457000-memory.dmp

Download

memory/5740-9-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/5740-91-0x0000000140000000-0x0000000140457000-memory.dmp

Download

memory/6288-77-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6288-311-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/6288-69-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/6288-71-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6840-87-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/6840-314-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/6840-81-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/6840-82-0x0000000000850000-0x00000000008B6000-memory.dmp

Download