7d7948d563519cbd9f94d972a87136c7541207f7c7eb8890dd2968e6ee3fa095

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 4.0MB
Sample260630-dplteadv2y
SHA256 7d7948d563519cbd9f94d972a87136c7541207f7c7eb8890dd2968e6ee3fa095
MD5 d2216e29493c71e29d9eac521ee05703
SHA1 44c8d6f091ec34aaad634a17ececfce8bf373cab
SHA512 a0cf64cca268c61ec81cdffe8ca1df4940547370238f5b9b45b0281702351c766b32f1e2a3e4582331a5264dfd4b7db2af1d447e7d8eb3bca08ee2a9a56c2f72
SSDEEP 98304:JZnuomZBBBBBBBBBBBBBBBBBBBBBBBBBBBBU2lKjLm:JZnuomZBBBBBBBBBBBBBBBBBBBBBBBB+
TLSH
T1DA169C97B2B500D8C166C1399742E577E7727C150BA49BCF12E16E2B3F279E20DBA720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5440	elevation_service.exe
5616	elevation_service.exe
6980	maintenanceservice.exe
2776	OSE.EXE
5572	PerceptionSimulationService.exe
6536	perfhost.exe
1568	ReFsDedupSvc.exe
2920	SensorDataService.exe
6412	ssh-agent.exe
2944	AgentService.exe
1124	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ebfed035649edfd2.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106562\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062403a1d3e08dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000955c761d3e08dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000eb15781d3e08dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2143c1d3e08dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027b3451d3e08dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
5440	elevation_service.exe
5440	elevation_service.exe
5440	elevation_service.exe
5440	elevation_service.exe
5440	elevation_service.exe
5440	elevation_service.exe
5440	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	1568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1568	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2944	AgentService.exe
Token: 33	1124	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1124	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1124	SearchIndexer.exe
Token: SeDebugPrivilege	4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5440	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
4372	2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 6532	1124	SearchIndexer.exe	99
PID 1124 wrote to memory of 7052	1124	SearchIndexer.exe	100
PID 1124 wrote to memory of 6756	1124	SearchIndexer.exe	101
PID 1124 wrote to memory of 1868	1124	SearchIndexer.exe	102
PID 1124 wrote to memory of 5516	1124	SearchIndexer.exe	103
PID 1124 wrote to memory of 6524	1124	SearchIndexer.exe	104
PID 1124 wrote to memory of 5200	1124	SearchIndexer.exe	105
PID 1124 wrote to memory of 3752	1124	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_d2216e29493c71e29d9eac521ee05703_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4372

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5616

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6980

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2776

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5572

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6536

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2920

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6412

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2944

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-759331733-200834466-1207319849-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-759331733-200834466-1207319849-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6532
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:7052
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-759331733-200834466-1207319849-10003_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-759331733-200834466-1207319849-10003 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2940 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1868
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 1476 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5516
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6524
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 1476 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5200
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2940 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 99d15fc79a22f504103a6bdeeeb589caf049c8418dde6840b189c6b1a51152ae
MD5 92084ddd059575c0066194550124d767
SHA1 cb3fa7b5778ad19adadc0935e42c48f2e6cbdd12
SHA512 cfba5ee53811f06735be2908624100f2bd5b29ba365942721b2343027be5702891a94060e275116f9467c1dbbda503eb2c32826324bfe445c5e0b56b0899717e
SSDEEP 49152:Hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnHQ/lFTjN4:13q6HjBvLm
TLSH
T1BFD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 f2e9580543402b071a6ffb75da915a90da7cb83affb99c5593ca68e6f1c0446f
MD5 59dc47c7ac1df4ae81fdcb7a1456b369
SHA1 0c9fcf6db3f143bef2b96015a0b8ce151049ad2b
SHA512 2f9224c645263ca03c46f9adeebd9c1ecd1ad457ea97362aec4f1bd9f39a7957c40f3476f10b8efe01b2adc25174307b6938e5b2b2cf6058ca8b1174dbbfe0ab
SSDEEP 12288:q1XLsswWkxy2lRq2czAwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:gXYfDtczAQnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T19765F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 454ad91a16eb275c893b7ce724df582f504d7d4d26dc9d1acf2b9016e20b8a7c
MD5 906540e261859c4556e09c030b72791f
SHA1 a14120360f989a8e64e428326a47155c1f4b42ee
SHA512 c0b7c8df5b790df223c3302458d7d126fd8233e5cb0741f59397cab6ed52b13c2f9873fbe741c847d70e5a97562a416e89b8b65fd7ac1e604bb2e1c5fbe38519
SSDEEP 24576:r0Le5ji0hmxLrMPnQ/tbw/2Mkjy6Fr7g0oR:rPji0AlyQ/lFTjN4
TLSH
T1C1859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9d996a7d57bf40d50043b45f2413f601d640fa97441f21a80f53c3d9158f3076
MD5 3a50d4541473217cd411bddb1446f2f3
SHA1 62c0b40c18ecf24b7f77933b583c637f580b7c71
SHA512 230c1d6550be5228af4f46e76518ba2d3cddba930e643d8d020a54f10c63d52a0a9c6cf38ebc9a1decfb2a4a6550dd9e9128c6a8cd59db270819c3c7576e548d
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWE6q8wyuFnQ/tbw/2Mkjy6Fr7g0og:K/ezSC6vUzPvxHjy2Q/lFTjN4
TLSH
T13E755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d1de4575a120fddddee68157d90d664ddd4c305f0f7777916670a357eec12c77
MD5 280bfb8f1c8aced2334614b61ea76ab1
SHA1 88f75b2519d3b8dd93ac136bb2fb1fd4eade7e40
SHA512 cae25810166d834688feed4cf5a7f0d6c1292f9dd4aeef1fd0570ad697e0764cb7d73d22c86a665a03d50126887b7480531cf1f2ca068262cb0e59b5fedf5faf
SSDEEP 24576:2VbqPb88hv/l+68nQ/tbw/2Mkjy6Fr7g0ov:2VO88hXl+TQ/lFTjN4
TLSH
T1C2559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 86f36a36b4a4add7c091ef45a956faca1b5d2eee97b605cc2fe0f7d39372f47f
MD5 dd743d0e17f0dc244a245c5619af798b
SHA1 b1773817cb6e588e85d31f6a9cb80736eac96e4c
SHA512 d18fdff0b26357fbc03b4c71da34699c37978825ec9334a7e04a33f16a6ac69a3c2942b17bb62bcaf3464ed17a21e011fec890abf5a407373424f8eddc98707a
SSDEEP 12288:3zbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:3zLnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1D95523696A24F897FF2B06B15CC284826B7B0EC1BFD5A74E7B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 beebf64fc22d86903357937893f69d0cd628a5791644f05caa75d114cc0f8379
MD5 c5428f9353d37a7372dea091988abf53
SHA1 3f70686584c49eb5e3f40abb639697dc7f2689eb
SHA512 650e7c4594b5beab49f40f1bcd5590f6f9c186608132e45a65aa6f8c71c92f8912cec939ad0e183a79c292bd5416b20d26da0a745563a7d1c6af352709581cff
SSDEEP 12288:leBNUbTVO86UkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:lJIUEnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T16775CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d8326a874f4510797868c81dae3fd0fb4b97fad213903e5b56b58eed771865dc
MD5 9e6f1f79cd08dc458fa31287b0dcc051
SHA1 7c647a9fe50957b5a79fd23a4ec427cb1ab66ddc
SHA512 1a59ed433874ce677dd44663ddf5f692890e4166d1347d6f1258874d737dd5135b9792c8c8a76992901ae8014d0d1d2624f000eb696ff00fbe7cf9ecb45a5943
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THi:zQvGAdlCEL8c/yRNw5CaLm
TLSH
T1BD267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 1031ac79c3b666b9e401ce960256b6989bfbd5444d336af4a05c519199087aef
MD5 7f491550fde6a18d2f1d863b23ac0ad3
SHA1 59dbda6e2f4bff17f501d835664a6f1a922e95eb
SHA512 b832ab6f8147c9bb4f76dc864f7627ef6c6c6bf012c0b263341873af7802e970007184a9c68907413027d4fda517e82d8899463d125664c548d00bca6729dbe5
SSDEEP 12288:kAwSfxL/2Dc39DLLmt0LDQewsAjiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgw:5QewsAjinQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1A975E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 db9de8525e88cf2ac4e6de67fdb85de8a293e73388f6b1c4b1d71e51c1644864
MD5 8173161a0b0f18c1dcaa94513529c97f
SHA1 b9d06876d8bf02546aa5f49bd5eda40d4e69c469
SHA512 4dc11e0b509c813c158d2529fecf6962aeb38db01ae2c2f286dfb7044db3cc4a9012da3b2141cff6951a44db5a6fb69814154930830d43d0b95b163c44a42d3c
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHVL:uUEtQevvqc2W1cpV2EI32
TLSH
T161474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9abe96aa5d7c998845303c3bc61f6474a05f275af3dbe19be65602e27fbd46b1
MD5 231285c8ce7f9674a0f8d33c795428e6
SHA1 69aac0d81367b2480dc39bec9ed819de9de8928c
SHA512 7b8d80084dde49fb1bc7bfcb0fd07c79bd3cad45431ad005d9a408bc6636e993ab5a3d5b3f066ea9bb604d1a38d53a84f02aa5dc1dbf82ca7f63d3c35ae89233
SSDEEP 49152:GCbRquA/m2yL5zQfFiV+XenmE3/zCQ/lFTjN4:roqtVjnmuLm
TLSH
T16BD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 709e0766de618beac9eca94d69ea1504b5f57f689d8d4cf9b47430058c8288b5
MD5 2705efb7786c9013e6d471a4abbcdf8a
SHA1 8e38d90c7e8e99845cb00eb09d923e6b3f2cd174
SHA512 4cece1b0357ec9a8874a5f51667837aa3ce13729f1ffd2dcc07201ffc30923a00fe24e2056023fc25ac6763c709fc413dc5fb5683e1cf1ed1aa1884756155258
SSDEEP 24576:VAhGLJIFoiwtA5l7S53ZnQ/tbw/2Mkjy6Fr7g0oE:VAMyFoiq5pQ/lFTjN4
TLSH
T10E35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 0862d3864193f1fa157214408cc5df9b62db95e8610a4c61e503ab58d207e160
MD5 86e9f222165dae28a68c5a90a8b9a6d1
SHA1 78c7def3c4269756670c7b209a7293aa32d7211c
SHA512 72bf0940c600b254c3a5d430457d8c1ef314c4f567e00caf1a83608d4fde0cd9ec8b149181344a96f5c589ed4f6ecb73f35a26b5c95f101b9360a3dbdd7362c8
SSDEEP 12288:bmw5HEjsChN2BFgl0WDm+CFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMc:6wuHOWWnQ/tbw/2Mkjy6Fr7g0od
TLSH
T15B65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f8efc2b34c0a4aaf97c0dd71d59daaa27faeac31b89b43fbecb59188e1c7814c
MD5 90d14e545e34f7bb5e60364bdb571621
SHA1 aeff31e0899ec2014ee8be7b5aaf844fb0cff1c5
SHA512 37f1221e9ad090c2de2e3780e3cbaaabf8ae20911c6e132d74f7c385982b7c079833efba72ec679e60aa8f93a350bf649a4c79ac9f01c401dc919c277bd5e80a
SSDEEP 12288:rXZ1IySGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:jZu3nQ/tbw/2Mkjy6Fr7g0oA
TLSH
T16455126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 353e2170d6c954379861006b48b51ead67ca0bdc76f52fca4479c48fa518a792
MD5 368fb62e5cda53dc723335514f97342c
SHA1 368cba35bba38104e9db74e68d86f4124f1f93f4
SHA512 438f3da3624c6d9c73958c33ae2ed48e77740f9ff96ef789a04ee9c6b2dcd7e13eb80049ed99cfbd44849e53a5e52d4ff8088f9101e347774111104236c8aced
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:0QRQyi36YOcPQLvw2gAf+PN3bLm
TLSH
T136667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b4e6ad8339d70a88e1fa44837cd532d6a21074eeb44a2cc67f5331d9d2d0c364
MD5 d554eff1e066c5fe23536e8227615deb
SHA1 f978ae98f30e48e237be0081ed99ac24648dc36f
SHA512 4b41760e64ec7bd3dd8d1ac245e5dd43a1965e795ff93b3a3fb465d2c4fd592c2ec9abee94e1a4e2fee2f157517699a4587bd3dd4dd5f7fb813f642a87a9dcf4
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:FQRQyi36YOcPQLvw2gAf+PN3bLm
TLSH
T1EA666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 65e5ecc47d22662bd9a8b39fef6be99a96dec98b279c7b6dde420de5574c1e0b
MD5 004b273a5be6dd118d30a3192f08b9e9
SHA1 10155b678fceba48bc0e3146a9593cc386d7c4ad
SHA512 937c7a0125a83bf073e2a9befa9caafb2719596e1e3e4d462e8777230331fda78524324f1a090188ea9e06f59815ca5bcb0173df36c1598d337a2b446bdfab1c
SSDEEP 24576:BwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0HnQ/tbw/2Mkjy6m:N68Qg55nhheWu7PNU3/yQ/lFTjN4
TLSH
T189B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6a5c85be473c4636b78ead785e18e3addd4b188df41bf4b0e0ad29c53496659b
MD5 011dfaad45244757dab63f0313db04d4
SHA1 0e0eba9ec63c819bb9e0d02989883c41153f56ce
SHA512 454f44bfaa4307449b86fee8ade9f0116163b4a3d0f36fa4c4adbae1abe972e0018f81a725668f43857d8286a73231e23fa4678f28fd9589719d05a5c2a6a7a8
SSDEEP 49152:/3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99w:yy5112gYy5azzVvL69nLKnhZALm
TLSH
T18C167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e9202825ac25ff21725da11d16e219d851cbe1064e21fe8a56eff239ffac577c
MD5 a3ea00d19aac36ca81a4fcb0ada61e0e
SHA1 66ea9b23a7594d6664e9c23904e8d8fc3d4d7197
SHA512 ad09d38659c4ec3efa4c93506d632dfa051c690d88ba197ac7e8e9d45f5c2f1c018ec22460b07fd1b14deed7df627df2b102dd81d057ae6b27c5fc330346da84
SSDEEP 49152:pB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgQ/lFTjN4:/u6JmVxd2dzLm
TLSH
T1BCD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c2790a62a8cb666f0eec8a2d7af954f93e151784e962bbdaec19f5aafd0b130b
MD5 04d0b18824e8eee028b7011793ef8cb6
SHA1 eed2a84ad9beb84d3cd911c49b6a38d3e82fd08d
SHA512 30447cc02f2b3c562b69c3f7284145580c5898146ca1022aaf193d7d29ca5748c14904855420caba9f5e77e8ca1af9153b68f3f8a1dc10577ea2aacfa9db4527
SSDEEP 49152:51hpsNoJpF1A6UU44CwH7R4xkQ/lFTjN4:5mifPbRuLm
TLSH
T192B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 29ee7f041d5a3e4830c4957e2db4487a24ebd7f382dd47e7eb00d534015e47f6
MD5 5f487d0e79701b8263e4636844706c94
SHA1 acd154578f67a335839eb12e3e1c7c98a21ea4dc
SHA512 c0593ca10757663a4d6f2b98bd1eb382044e98b89691ec51b3ab4a0fa2b18ee243b457bdaf1292bcc1dd6b1a6fe380802acb097018b9418fbab8a183a424961b
SSDEEP 49152:ySuZQIY0Be2KRRVtOnks6NMHq3Q/lFTjN4:s5dKTi61cLm
TLSH
T1C1C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cf27e4c4e8571e18b3386e2754078bd856e5f8ef685f5d906390e2be6d4d6c8a
MD5 8a15a281afe4a46cbb8ec0ed8a34642e
SHA1 a03c7195619e96a535da2a2bd13a3b3fd0c9ff70
SHA512 5632f54824fe05697c0cac3d9fc0663738862b130e40b3c91642e402c59aa5cff6a3d49d6c46df8506c1c9b0d351102d2d6960246f1a67b8aa584c0fe12eb11a
SSDEEP 49152:ShtSn8EApI0figngiDn0AP5wQQ/lFTjN4:TX2iyphCLm
TLSH
T1A395BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9ec52e9f1b89f0debb0a09e55b9c3e336c2b1983b73875f208b3a443bcc71976
MD5 278369c02ca939097ab7d224e6d9d74a
SHA1 efed20a322413e8e2f4b1b954a69b605220bf269
SHA512 feb4c2b398925d20d001a2da67a2cf4aaab0196cc69ce8a833c7704c237546039d34c64b3dde67911777b5b5cd927e5d6d6fd193c1c96d26468d20baa8f69273
SSDEEP 12288:NjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:NTnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1445523697964F98BFA1706F18C828182A73F0EC6BFD1938F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 dcc2edf1af4acdd34122ee4114c98c148dc76802145ae175e1c569a9fdc5d54f
MD5 cacc4fd9f01c8d0897808453548992f0
SHA1 41d3db87d65b99da68e215dcacc4e46708c47750
SHA512 ba872a4579444b06504dfa640bd301c81070d69f5380522805f3f87a089984128a55705a13cb4e63011fa80c9826530f86bcebea364be804494bb9fd8748fdcf
SSDEEP 12288:3uGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:3unQ/tbw/2Mkjy6Fr7g0om
TLSH
T13B5523697964F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 271fcc2359c37e722703d5b19cb2782841885a13428eecbe1474cde96b6803e1
MD5 9da8c2fcaee71a6300c4f110a555f653
SHA1 b891339af226177d3eabae6652113623d0c94677
SHA512 69306925a9f50497ff9446f30c602f975e9c35a703012eb10838d0016fa096aa35cdd2ccc2e0b592262a2c61c0ed3bae6fddf604ba01e508f7f09fcf9f58168b
SSDEEP 12288:cMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:cMnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1EF5523697965F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 631b58c0ec276461171c7385f6fb3c389e661bfd51e4bf5337cef7c4b5126a95
MD5 4a23e771ad87c96c4e76098425ac3b32
SHA1 0eb44013d89d095629252bf69f39f55aec0156a2
SHA512 2cf4bebe464fd0c7bf1bc0e125da37eae23b2726d97ccd6507ce0abea3490f0af19a5a88e81e63ef5184cb929ec3e4e63b62288525f86ec915add17db99c292a
SSDEEP 12288:rVpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:nnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1C25523693B69F4C7F92742B4CC928142E77B3DC5BBA1A38F7B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f0b8e4b647f6d4354608ff6c96a28334117cc7bdb74d346e041b4d676817ff66
MD5 ece6d0c4eac04fdcb6a420b400d077e3
SHA1 819832d2c38ad429dd535db668bd58b1f2d55dd1
SHA512 a737861a9a077a6895cc1fb6c70114ea028eb6da6eb1a21f39f30093bdca1c0a2b9c38d925fb1486b8078e0c0841209ae1d82c7b301f72621686d504b55e218a
SSDEEP 12288:rhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:rxnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1EB5523697965F98BFA1706F14C834182AB3B0EC6BFD1A38F77481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 71f0658d060e8b75187ad1fcad4b0a058cb5d5223944be3537883649c736b844
MD5 11bd3495141929775bfc0f34d8c24bc8
SHA1 32555f96a7824a61289acc63d622f38f181d2032
SHA512 84bf363a920a64917210fadb044383f5cca15c3b157567e5f129aa4cef386afcd81afcb51f4db87fdaec4d31f554ec718851cfe751c0b7714d589b6ed65b85dc
SSDEEP 12288:5KGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:5KnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1185523697964F98BFB1706F14C828186A73F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 30a0b7132c4cdf42830980b9b388eb87ddbf083468ae7ca08a512794ec2ddc8b
MD5 e9f3ffc72c0936c8c64072621e7cfeae
SHA1 37d707f0fb8cc08fab1893fc92f559564ad19192
SHA512 d54991745b4418d1b8db6253957ededf48860d9056b4108e86170e3ac658735d05ad468203cd1c91ce7394f3adc5c7a4bd73e4f893062ec6892f9a621cabcc70
SSDEEP 12288:bGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:bmnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1A45523697924F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 13816cfca5d9110c39e8f38d5772d3c156d651abc4b9cf2424441bd118b3bbaa
MD5 15c24db4962130e124457ec49be59501
SHA1 50540c04153172a1bd08a5e1361c70672203fc80
SHA512 91ff522f3282ff3a962dac615d2e6c9925efec555dc0b369578e7bd9ce3a76412dec1d3fe4eb77c0fcdbf47171afb5a1690f420ced494373833cee80942cda96
SSDEEP 12288:ziZwbDzzFEoS2cPvyOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:eZM3zFVSOOnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1987501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c698b5cf676a6c4ba0216950be65d11294a5824ffa7bd53c53ca6e75a4141d30
MD5 8f758b793a3129973460d98b08daa9b2
SHA1 7c4e22f7feb6c92267577346caf4bd31411ac41e
SHA512 88fd64034335dab56ed00ad2725305646b12d15827554a77d1e3416d52ec8ac2f9b3fb392a13b545023d3bf890261ffe161a443e46e93307ecfe0cf348dc8c63
SSDEEP 12288:xHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:xnnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T17C5523697925F98BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 53afd92a1b55ce7f0317e618eeb81152dcb97928f20a293d6960b02fc057ccad
MD5 22f8aeb3eee32b1d9862c9a84c94c6c4
SHA1 eea7de2cbfd63922201d0900d4573107246b520a
SHA512 751400c1eea210794a6ed5b288d38d14de759549de6ac16cd9ccd6b1fb4ce221983abbe9dc83ea4ebf4ef3336bbcef3d1d2502103c39da77f95772e0510e854c
SSDEEP 12288:5LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:57nQ/tbw/2Mkjy6Fr7g0o+
TLSH
T14C5523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 91600b4d042d0f5e459ff721c45ca810ec03fa869d309784e5c05bcfc89c8156
MD5 520c8df89b0e82e2a3977e2c4bff98c0
SHA1 8d73743caf718e32987f0d8e6d2fa2ba139764c6
SHA512 7270362a21f1fa9dca418b0c8f53908bb2c3e5cfcb023e8bc4d6da69a7c383164d10e50d71ce0c06bdaed78e5ecbaea103059f2d5f876838956ee8e8f293cf49
SSDEEP 12288:+yPz5L8SGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:jzySnQ/tbw/2Mkjy6Fr7g0og
TLSH
T16E65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 35654c5cb893d16fb0562936ea18296040b946ac80a2d2785cf72b4c03fb6120
MD5 71e1a18d89d612d1cb4961578e5484c7
SHA1 4dad77f9bfa61fffc723841d89a9f4d207cfab54
SHA512 80ef77074b69cb2244e3274eb756a4c4bceab1a7b4817aa472aea6cb35a57eb18fa13c0c6f0520366d530bd95ce8b115a540b143913c12f71798fe418ffc336e
SSDEEP 12288:mHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:mnnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1A65523697964F98BFA1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6d4a6e2aed68036eb78ed7c8ebd0a6e8beefeb670d8876146f48bbafb9564b75
MD5 df8740cc6ed3b63d38902f686c3a4908
SHA1 5f56bbe4ca21d48656242c76f34fdda987f239ba
SHA512 02f2f55640d60f2b8e464ffe2e481cf0ff6cc6bf592cda37dbc15520869a227111e5134f9571949ab7031678bd9057d190196d5aa917ccb37113a88a961f08bb
SSDEEP 12288:sHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:snnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1C55523697964F98BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 0b6f8d217f91ef606c0efcd9d2148e88e6e6793615b82df578ee6612466069f5
MD5 b2314a348e264958788e47605d1dcb43
SHA1 4d292a7c7502754ff1b7cf93a0fa8d84a2085475
SHA512 c31e6526a5268438ae538723aca907de125ca0956a1a851b7fad6062f41f6ac5063c42560c5edf865b5062f42358ff14f3c9ce5fc93055db49d5edc9d92f4e56
SSDEEP 12288:VyPz5L8SGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:8zySnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1E365021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 a01c1c9da8a52593cfb98f30b995bbbc6a5edc1b120fa67c46e63c623b761c66
MD5 ee31a1407dcb742c8e3500fbc4ca29c2
SHA1 f4a61d1d5733b00c0553798b9f63761b252e24f5
SHA512 2467e212ac49134ff3656a61838e9c27a5df1896b6a4d9b65498fbe537e64054a75e8b910c8508665c98902328fc168bee3c37f4eb60f915a71a1487315d75a0
SSDEEP 24576:cT0aLl3z0zDcnQ/tbw/2Mkjy6Fr7g0oW:cTDLljFQ/lFTjN4
TLSH
T1A47501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 d2694d8c45e53570a8694ab7d0ac83ae963346440aa06d3db5635aa4bbb8c67f
MD5 7edc9bca53dbfc4ef95cd412f83ca6f1
SHA1 d4aa6cf6ffa5c83f1fe74e9d14c8b907192a7e5d
SHA512 340e205d0b1499bdf54b3507eb6d0bd545444886933ce162b4e3217df11ecf60198be9610dfa3dc6cd2fd16885487137f5988acd5dbff5d05fbe69d0a5691a92
SSDEEP 24576:B31d9CHKy7GZYnQ/tbw/2Mkjy6Fr7g0ou:x1d9CHKya6Q/lFTjN4
TLSH
T17485CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5ad832b1c039caabb846aea3bdd159aebec65cbe93d9f2e50e86a1ec20beeae2
MD5 b67483d5f8eb5e905b8ebbcba189a62e
SHA1 77064e11d65fce32d8624180952a91b212648f98
SHA512 7fc87b46690d9cd72dca0dc32cee4815de04fd56a5f7f448bd6d1856e11b6e23f8ac1c1cd53afe35241b134ba3d8e562614220cc7b7c4860e733a3d5aa501b04
SSDEEP 12288:gsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:gsnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1B85523697925F98BFA1706F14C8281829B7B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5cf49e9390efe1cacdce7d6c61ba2e8cd7a9070d6dc0d3a55b9573d35d6698d4
MD5 9d84b77acd746eb5fb9f60ce9f224b08
SHA1 3b078abb4980741ff0f09e90d442aff3401b50e8
SHA512 399a3f39725793e1873d71f0bbd96836fe18b8da7a2eb8c3bfbac978fda9d24e7177d86f990edc6e80369c7afb11e049598c41859fe0b6da2318aedca306319f
SSDEEP 12288:TyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:TynQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1C55523697964F99BFA1B06F14C8381829B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 22bbebcb9744658451c248178dd6a353c3e683601b051d1d3a9d352cf581c86c
MD5 20213642fb8c46d170a6524266aee790
SHA1 1a571ec881592ab49f0b11d02ad4f1e4d7fc6d9a
SHA512 d5772aee2a739a299dd9971bda79734a63d8733208fc5b7c0027fcef9d688bd139dec8efe2edfe839cb7fff22b7020b129b6a8407b1abf6f1c163592b3a944f4
SSDEEP 12288:AdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:A9nQ/tbw/2Mkjy6Fr7g0od
TLSH
T18E5523697924F98BFB1706F14C8281869B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c34aca2abaee3e16bdd927f3bd351041d71cd3f8e3e02f9ab01af9cfa8325fbc
MD5 09bf411a638d542bf5a97288dc98d2f3
SHA1 2fdb698cbc010dd0038ddd7ee111d744669b27dc
SHA512 e1cb596ef1b5165c2b1eb543ed1a74b87560e93402e36126f25747e94f7f09171aabd701a5d70f9dc6b8114877d1199eabf179d18f97b2a3affad0179e70d1fd
SSDEEP 12288:kHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:knnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1C15523697925F98BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1986e552d0fa9d3df02aff677bdc2b634f3afb5df390fb3f81529c95ef40fec7
MD5 338a991108e6583494677c702b8263f6
SHA1 0ec832512ed5dd453dc2c65b0f2b223131bf3e26
SHA512 88418798c2a75965c571da5cbe34ec0e8e06ac5995a4fa00801a2a1cab719898e9b33c6002151dece214ef781970216e24854d918ae724779cdfc82c29a03f0a
SSDEEP 12288:jsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:jsnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1B25523697925F98BFA1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 00d352869f4294775592a9f2e77032f3bf4f065d7ec34fccb9d015f184617661
MD5 2bb3dcb41ba0084d663e85ad9eb1d60e
SHA1 30732541d0109c070677b6b634856d42e32e96c5
SHA512 e67aeb323797dd7c6493411408e5c82e07b38e517d842ab318a46569b265661499023369dc4f9e7734e1ff284675c76b83272d69e7c12923c1b45f061d546533
SSDEEP 12288:+/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:+fnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1A55523697964F98BFB1706F14C8281829B7F0EC6BFD2938F7B481129967D39405CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a70316667e2473d7f738428aa081c4f59661ba50d2f7ad0d6c97cf2da55e80e9
MD5 c3974c95b20d1e2ded46f7a36a1b295d
SHA1 d17ebfbb4cac97b26310094446a95c626e9590f2
SHA512 c2d9b127fe73c3043bd28b6be36ad564ed6bd0d2db7d14114fb888513b8c545a2aca0505c19e585a8f56c1f1bbead7aee9e8b351fcc01de08464a4aef8eec567
SSDEEP 12288:vhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:vxnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1455523697925F98BFA1706F14C8281829B7F0EC6BFD1A38F77481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 6ac4280c8668e2bc1f8797783c5585ed234d65648a62484b3a33e3d5072cfcbf
MD5 e3d5d4374b0b3d92a658f15c37fb7cfe
SHA1 4006f52e4a25af54f6efb6ead49eeca1b9e51b3e
SHA512 af94529799f635bb5d308bb32673ed9000bcdbbb1c2ebe4eae69a731e795e8f1a57d871f00cafd6a074678c654b648fcd3b8181b86683d4bf6d4bedb42a3fe06
SSDEEP 24576:Bfwv/k9RX6wkyAIrnQ/tbw/2Mkjy6Fr7g0o8:wMnYIrQ/lFTjN4
TLSH
T19285DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 917ede5bdc136f36d12bc76e3fdce1d745c3f9cc17622b5a51681f008a62ddf7
MD5 f9cff0b93bdd41dbd9fac00362575774
SHA1 dceb839713511e609bf0061b3b6128ad50e49bf1
SHA512 aaa87fd5d6ed1e6e77e4904eb7a17e6d10c50eec2cb2105136f05fe241c8758aa56006891d7ff450028ad8501d711af831aba739b1ad3c7b78a099ad8676f6d1
SSDEEP 49152:iYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wQ/lFTjN4:cySzP7Lm
TLSH
T195066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5b7fbb1ccecc8859dbecc42e481b9ccd06ace9026c9196b7cca2056418226b48
MD5 e6b2dd9fe5ab3c84e1530e89b4db4f3d
SHA1 735c5c6a311084b2dd2e9318abf62c6aedee9603
SHA512 c6c0c737882afead2316b3427e29c34279095c4488c6a565cb9cd5651022462c43879c4afb8dfb09e4f31f8801a142970c3c1a01aaf18a152b3f7ed9cda7d694
SSDEEP 24576:M47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY+nQ/tbw/2Mkjy6Fr7g0oW:M47JUQj1irIhCnDHUPfF/gQ/lFTjN4
TLSH
T1F965AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 c5bb070e04acd98c36e9cfca491e70705043714f50bd2cd59d9b4f7618ae497c
MD5 2e265aaded12c66d849e5dcbe4bc5608
SHA1 a02b3d407293aa2de5135fa72a7327f0bd9d624b
SHA512 ee55a0b9aab5081d29521089c5eb8e5972620196b59e31367338c3a8cfcd9902409bc27cd727082502a490d1cab8a7ca225cbf17b62d620226fd394b9a8b81ac
SSDEEP 12288:tssfXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:93nQ/tbw/2Mkjy6Fr7g0oX
TLSH
T17565F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 916KB
SHA256 6d10315e249805cbb5d270e8a611be2df6b41b6b24c38d78bed8038933f9cb34
MD5 7cc97671d4e9eba049ada68c48e5e943
SHA1 51fe17096a68bff36434af104b83e3b70c9b569b
SHA512 c71356f7ea7a7ca8681d1bc1e10a892c5fd1aa37274b2ba3ae8fd8fe8fa2bd97091f9d76a36dd6ab5bd50f480008ff38007a1d0bec2f1218350b075c80250813
SSDEEP 12288:ker3U3fOet+Daw1qpBhib3HsPJ/kuFa/GI:kebUP4mw1qlI3sPJMuFhI
TLSH
T140151710B666D74FC6AD40321E32D5CCAB707C51EE05AB0372C98B3FD576658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 354KB
SHA256 5dc30b4c81c728af0f332f5b3f08fd10da4e88e3fc52d7b6472aa75a99fdf8a5
MD5 61ab3dbf2bb7e77afed88bd49b12b3f3
SHA1 c94fc54a9c3c8b4594c84e71a60264a86bf7251d
SHA512 96a157198f9d05728637b71421170c3d92172dca7f4d7629d68f909753bfd702b44262b292b89d54064a0e2ebf485735795df431519ccbf8c0f26a9397e89ff5
SSDEEP 1536:RXTm/5iT/GnQFTbk7qvovb9P0xzT/ggRUmuMgxTnMTMT1T64TbW5:Ja/ILmSXXvovboUg2muPxA4Z3S
TLSH
T18874A701B754E319C0B580B29870D6DFAB38B422CF125B023FD51BBDDCB22567676BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 aa7b1d16dcd560f671fa6bf59205ac6aa8f2a2554a31bff2152103d41fbe81f3
MD5 c3b82e01597f74d5ab7c706e2cca5189
SHA1 69aa98e66dbf70ceefeb27155acb1b61ffe2c093
SHA512 898d00d97402105932408c580077a8edc044e82d52f0bef210854fae43b420b0f44055b86f0d1b76fb247d33893f76c8d01766059ad6b0668a805b4645bec5ee
SSDEEP 12288:v67PGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:mvnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T10A5523656768F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9a39ddb40fdf41a4b47d00ad43dd8ccc83ba08e919634e09c759f3b69fab6ae8
MD5 60d2db47d0992933d0a5d5b54a8962f8
SHA1 1fca8a563c6a195f0e084620c1376c3c33fc69b5
SHA512 788c3e608a4a744cf42dae239affafbf7f01a3b4db876459cc8c8cc54fe807638411b5f5ae38b6d3e376ae1844a23c3dc5a74a46e0d6bedfb2f051f068adef4a
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYFnQ/tbw/2Mkjy6Fr7g0ol:0gb4mBIBhGF+Q/lFTjN4
TLSH
T14465AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 f4c33a7ab97dcfe1028f1a53f0a7ff33409f5b9f2b7feb1033a90410d4c297bb
MD5 bacc6ed9e391c4e7a687689f7f8ff94d
SHA1 2f9f6c814a7213c6879e70239670a268892525b1
SHA512 7dd90825c7f3e72aa73e36cfa4dce47b7163e472b214da5fd3d90d897fe36cbc1caaad3108cc3ec0c86dd513bb7bdd7d17a5b322fefdd487d04190ee1b2b97ed
SSDEEP 24576:1G88u8FpJqH1Qzria7/mOnQ/tbw/2Mkjy6Fr7g0oV:47ZFPqVva7/dQ/lFTjN4
TLSH
T1C085F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 93162c6a7be83392d4ad95b2b0a25cad36d1dfe6b3b862f8ca3a8429e95de76c
MD5 81d1b1c78984928eaf6539229ea73a4e
SHA1 5d95e241a46fe59385aadbd12185febb58ef7194
SHA512 f91cb95a63ac712f1de16226a1857b40ad4e4ec60f8437352fee5e97b16e66dbf3667a8954c5013674b602e59b5f62a0bc7d3dcc75a83411608162d09f7d3150
SSDEEP 12288:wHvUrBFrEjwaQ6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:wPUr+NQ6nQ/tbw/2Mkjy6Fr7g0on
TLSH
T10F65E12F26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c12a4dd617f116a0ee134fb145b7fc34d812fc37e07ffae018ab4e3e30874ff1
MD5 92d9acf54b5f59a07addf24d0c8d68d9
SHA1 518bb13fbbefca5dd55226c7353ad0fe3a2d28d9
SHA512 e5e97907717d849b748d27cc9fdffc3f2ad7c60e1cbe6b1ef5b13b91660ca2f6cc387d6fa1659a7eb4c69d8286fbe35b01a6b313791a18dc8d56165583f01729
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKQ/lFTjN4:kG05lO43boLm
TLSH
T164D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c9660e81830cd7f431a4cc68daa94d8924fd7d4b5e4ffabaa83af93a9c4bc7f1
MD5 329ef2bd4ab5a356aced4195b2ad5938
SHA1 56ed446b4783a62e6b23c3c58dd3159a589298b8
SHA512 d20fc63a4861f841c4c83a651d8ceb024ad26a7a0674e5489eeadf4d2729c19f1253190553e16db28dd58955e3c1302ea3f0ace939c95825a88d3db29e8c954b
SSDEEP 24576:Lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnwnQ/tbw/2Mkjy6Fr7g0oM:Ta5POZ3+Jt2pasx2+myQ/lFTjN4
TLSH
T11465AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e3756c82921be606ea8a170ad9993bb38254299356e60e0f9225898325d1212a
MD5 210a333549e9a9019a46c7b94a505b50
SHA1 3e35ed8f3ad065c653dee696320635dc28d2c03b
SHA512 812a435bcb07588df76aee8728c5e0d9d781d74893a875f9c0d854b3e664dfd3e9be1c0bb997fbe34d7df977fd16676d36800d785d1f23a0966c38b26326e68c
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7Fk2nQ/tbw/2Mkjy6Fr7g0ou:iNc/zEOVHF9Q/lFTjN4
TLSH
T140858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8d965f7f1edeeff3e5c51be3f9549b577d90b22cb9cbad58b1f7bdcbf2f8e8eb
MD5 182154fe4af98398dda3fd32c82f7228
SHA1 aa877620b6697744349be4862852a4d5c162ae31
SHA512 0ca5e957a037aa074e433f3c42a02141a15d5b0e5eda825084d2ecf5b730ce4d8d8b36553cf904ca706361843c0beefa4c7a7f7164ed979ced904ac4c21baaa9
SSDEEP 24576:T8kNvNnaFeYhJNtmZBm0nQ/tbw/2Mkjy6Fr7g0oj:T8MwBtOm0Q/lFTjN4
TLSH
T1AB55AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2e0189ada0caacd9d55280472895b28a12e096caa3c304dd0f9efa8c5ae2675f
MD5 175676f1ebef8091a3c4fae597a20140
SHA1 66cc42781d197f43e2af83933653c03e9aa19311
SHA512 fd3ab943a6f2c4ae0fa427ca81710d824b2036b1878ad036fb388fecb2b781645049dca1926b58ff7518dbc0c905b24e685aa4e23b522f0b0acfeb10e6b0caa0
SSDEEP 24576:OD3FHshBIYQgAznQ/tbw/2Mkjy6Fr7g0oQ:ODVHeBIAAzQ/lFTjN4
TLSH
T1EB75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1124-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1124-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1124-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1124-329-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1568-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1568-93-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1568-340-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1568-342-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1568-99-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1568-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2776-57-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2776-65-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2776-312-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2776-59-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2920-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2920-105-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2920-328-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2920-326-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2920-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2920-111-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2944-131-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2944-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2944-140-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2944-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2944-138-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4372-0-0x00000000021C0000-0x0000000002220000-memory.dmp

Download

memory/4372-7-0x00000000021C0000-0x0000000002220000-memory.dmp

Download

memory/4372-8-0x00000000021C0000-0x0000000002220000-memory.dmp

Download

memory/4372-6-0x0000000140000000-0x0000000140457000-memory.dmp

Download

memory/4372-81-0x0000000140000000-0x0000000140457000-memory.dmp

Download

memory/5440-123-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5440-19-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5440-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5440-27-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5440-25-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5572-77-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5572-313-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5572-69-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5616-40-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5616-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5616-31-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5616-37-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6412-125-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/6412-325-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/6412-124-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/6412-117-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/6536-88-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/6536-82-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/6536-83-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/6536-314-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/6980-43-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/6980-58-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/6980-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6980-55-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6980-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download