a4124abed0e3a83620041bc5ec28daa802adb4c2752e23843131167e378cab55

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 4.0MB
Sample260701-seysjsaw5w
SHA256 a4124abed0e3a83620041bc5ec28daa802adb4c2752e23843131167e378cab55
MD5 a681186b4fd8feb54504e898dcead17d
SHA1 11ef6f2cdf0493de872495c383ccad6b194267c0
SHA512 c0c0b048c7048c5a4f09c0ef1318427b5000eff48c790f8e7d8de0338eeb97400336dbe57c9c79542994713e0ea3d31c3a252e7e5189a8388f3125e09e8f7c76
SSDEEP 98304:9ZnuomZBBBBBBBBBBBBBBBBBBBBBBBBBBBBU2lKf5SSDntdDpbRZy:9ZnuomZBBBBBBBBBBBBBBBBBBBBBBBB/
TLSH
T1F9169C97B2B500D8C166C1399742E577E7727C150BA48BCF12E16E6B3F279E20DBA720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5932	elevation_service.exe
5680	elevation_service.exe
672	maintenanceservice.exe
5708	OSE.EXE
5856	PerceptionSimulationService.exe
4624	perfhost.exe
4860	ReFsDedupSvc.exe
4360	SensorDataService.exe
4940	ssh-agent.exe
256	AgentService.exe
4964	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9ea61f5b80095f6d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e988cc16a09dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000959ee1036b09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047959ec46a09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e2688c16a09dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d29d41c26a09dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006dbca7c16a09dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005803e4c16a09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5932	elevation_service.exe
5932	elevation_service.exe
5932	elevation_service.exe
5932	elevation_service.exe
5932	elevation_service.exe
5932	elevation_service.exe
5932	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	4860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4860	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4860	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4860	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4860	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4860	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	256	AgentService.exe
Token: 33	4964	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4964	SearchIndexer.exe
Token: SeDebugPrivilege	5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5932	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
5752	2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 2736	4964	SearchIndexer.exe	101
PID 4964 wrote to memory of 5108	4964	SearchIndexer.exe	102
PID 4964 wrote to memory of 3672	4964	SearchIndexer.exe	103
PID 4964 wrote to memory of 3864	4964	SearchIndexer.exe	104
PID 4964 wrote to memory of 1916	4964	SearchIndexer.exe	106
PID 4964 wrote to memory of 3276	4964	SearchIndexer.exe	107
PID 4964 wrote to memory of 5460	4964	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_a681186b4fd8feb54504e898dcead17d_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5680

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:672

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5708

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5856

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4624

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4360

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4940

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:256

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2736
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1916
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3276
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b0928ba551c7cf24f5e81770d06819d823993a8697641bb446a8ba556e647765
MD5 fa736ef2871932a90ecbb29ecdd13a98
SHA1 649b17d166dc9158e81e491d5533d30e838c70ff
SHA512 9412bc53f9204af6d7c860f588ab42f938f9924877ee7faee3d74fca83524a111c3c29b4a6fb5deb74d592d323aa8e79fac318f2128e3a89a87ac61d1326a5e5
SSDEEP 49152:kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnw5SW6H8DS52tdDpbRZy:e3q6HjBN5SSDntdDpbRZy
TLSH
T162D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 739d4fe712678a48fd48b430f79f7bcf781db9ff3f9cd3d42383bf240f2c7bb2
MD5 25406863eed003f7e7b919edf80ddca2
SHA1 11e79fa8354756ed34e001966b0c1e75fdbf91d5
SHA512 a165edcd1c2d8f8402b2b832b4236a33c350c47e54b62370442fb29b97b40ffcd2dc05c1b48a42bf15099047d7a32198d979caab8a2529dc3fa73c3201b58c4e
SSDEEP 24576:EXYfDtczAZ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:jtcC5SW6H8DS52tdDpbRZy
TLSH
T18B05022873E008FAED6B8279C8B28511EA33B8554760E79B03F495664F337C95E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 05812d37bf460ef7bf3b4a2bb96ff7f3ef2a9d151197c2cc0c35b446ec75b6af
MD5 21a1dfe058f5125df7b087a099718d1f
SHA1 cedd4c0c92c8918e929a717c7007b212c9d840b9
SHA512 20fe2b33f0de0f1f4a37945d0f2d2c5794b5ac256a6044cde0188ba1e02936443e2ff0291b3637d4b280632e5c3eb871d1ce4fce8558b199c0529ca1b3ba59bd
SSDEEP 24576:j0Le5ji0hmxirMY5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:jPji0AcP5SW6H8DS52tdDpbRZy
TLSH
T16A359E55F6748332D073C0BAC5D2A69EE971308657308ACB4286D77C7F27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bceae35fa381f763bab32956e53095e88f78a7acf2d72f3a802416cbbf0cfcd6
MD5 43711453f6b14586130906f48dba8e65
SHA1 13ffbd724e9320b0904c1a2d372aa09e64f3d1e5
SHA512 c5ff6ebda4d3adbdcfe1c3478406749fd698a89a4a7f384fbb228c778d77609f9645ffc50e1c1579137691578df91cbc97a69e2661eccfc7a684467bbd0b1507
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWE6q8wyuy5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:c/ezSC6vUzPvxHjy75SW6H8DS52tdDpO
TLSH
T1F1755C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fefaab32c7b4fcafc3dc07962faae9a93cbf12b5f1ba6d212dbc672790f26c79
MD5 230a26104d788d02706403c16c36a129
SHA1 ba85891ab4add7fcb7c5bc16c7145c573e9d6316
SHA512 6354446bb47f2de0ebe4cdbe5dd674d62f754a5c092c7fd63dae7fdea74b2ce028c1ea75f6e6abbb3ddbb6bc46977810506577f2dc51b6d01285df5728ba5162
SSDEEP 24576:eVbqPb88hv/l+695SSiVw6uAX8DS52tpz9ZRzbPmSZyo:eVO88hXl+05SW6H8DS52tdDpbRZy
TLSH
T1DF559E65F6748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 e82515b9f2f7d2162bf839b6660ad1d9f180065179f0e80dbf902b06f87b113f
MD5 05a26f77711b571a39bbd33f0d9fb725
SHA1 a09324e380369321acdca2cd6688720a82b53f68
SHA512 bb7d5d23e1fa92fef2323893b8d4bef403d256a680178d9c1ad08da4138511b84c8a78ec451e949607d07951aacc15a3e02445b1e31a10b233654f84813dd344
SSDEEP 12288:yRs5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6r:yRs5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1A0C423C4479020A7E31F0AF3F1FA96D4DA18EDED8408663B4E717687CA3998FC576426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 7b0820fdbdde88ef471af2f64620732dd1cad76db9523a2cc880ff68d8af519c
MD5 48c8e906fbdd79817b003a80e36842f6
SHA1 453aaa81e7fbef99454e3e77764ea8524d7d74a6
SHA512 90b663527b83dc06642b9cd52433a171cdd71bbdde76c428b2f7cef7764a8e14d0bada23e5e4acd3e0a6fae87c5a8780aa5337b3deee64fe047e6ff313aa9b79
SSDEEP 24576:vJIUF5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:vJIUF5SW6H8DS52tdDpbRZy
TLSH
T12305DF7BEE28FCE2C27E4DB956918640D77278704B21A3CBD175820ECE235E54E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3ed06a29ecdd4f3426b4ac29fa252373850ced780efd0814c344c5b4d8155960
MD5 c4f3bfd66dafffde4c83b3cb139764ee
SHA1 c2cf87165624eea979f67d68645177401eb0138a
SHA512 684d12ecf371c1885763e19b6a8b56512a585ec9bbe4d22ba336f22c95fab8face8b1e757e72fa91378679880e4c4ea1105f06fa2ed356f06a035baf6627ae6f
SSDEEP 98304:8QvGAdlCEL8c/yRNw5Ci5SSDntdDpbRZy:hvyEYc/y3w8oSintdDFRo
TLSH
T10D267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 f18477866f0fbfed718c63447c799117580fa94e4bf15836a8dee3d0d40fa567
MD5 48b068e4da087eb1513475fdaa972bb9
SHA1 67809b5db01ecd2625dfb77b801a014a806183fa
SHA512 1d03c57a76a2fbf77a8cd4c160d0b7f84984822fcc71d2382b60fe2dae45051ef1a47e8e073fd1a2c0dffad5d8c7752554172510c2626cc2998cb1ccc038dc83
SSDEEP 24576:ydewsAj/5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:ylj/5SW6H8DS52tdDpbRZy
TLSH
T13415E030FB74E037C37F0DB21B76C716582CB9604B511AC3E3A89A9E99342D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1cedb561a79da2702a2ad81c1afc22ac54612d770bef0bc47a8ea8d3a25a34a3
MD5 c0d0239bcd5e35b3b50b49ed34995f2c
SHA1 7834f537a5143e617b4be9563a60920f7f7b2383
SHA512 979fb93df93ac6c5744b08478dcca2337154b000bbc960bb417718f018dc7cd4f771aa5550bf228169162226722ddf454e333ccf68fff4328b2ff85e9d0c3b1b
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHpSintdDFRo:jUEtQevvqc2W1cpV2EI32YedDFRo
TLSH
T1D0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 51215844025eea8dbcf488a5b17d72668ba05a417757a189182ec702fe2a65bf
MD5 ba12f3aaae7ca04f19a604f2fa67de3a
SHA1 e7c89090f882de48df7e97a6f87621de381310ff
SHA512 04da531a1ce30ad735fe545718322f5e0acacad4ccbe0781922fbdc3e177cae51003cf95e4a66ba16fe77e603794fa3394ffaa2412c003cd3a1a745756fa5ad6
SSDEEP 49152:6CbRquA/m2yL5zLfFiV+XenmE3/zf5SW6H8DS52tdDpbRZy:Poq2Vjnm+5SSDntdDpbRZy
TLSH
T13ED58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 51faef64832eebaf604b0d5f64fcc41e2cbcfef657a3b5496cb37937395bb6a6
MD5 f5dc92b1b1808d19d20291607b3fee2d
SHA1 f8f5e85735fa1f4b5243a59026a9ea86148c60a5
SHA512 cf133fe5653a160da5517f079fddcf8020557f2b9d79813ecb100311cba0324692f657e98b640c62e3887b43c7014ab48208eabaed79e80f06aec53a5b41b7c2
SSDEEP 24576:bAhGLJIFoiwtA5l7S53e5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:bAMyFoiq5u5SW6H8DS52tdDpbRZy
TLSH
T18035AE80E7F955D4F5B7AAB899B68570EA76BCAA5E30C21F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c904f3749a3011e5f3f1f7ff4a85b08321d3371f61161dcd305d3eabba4e0d7d
MD5 abd4e28c8fe2ab6b0047e7e98a8f5014
SHA1 d4a2fca1fd5e103ec63a31e94f3a6699c7ee5d88
SHA512 41f3b22dfe4f7ae181b6c0cfbef13683d4f0d8ecb26b61a942d1a8999816389ef044ea57f7081678b033992de41512faaea38740d094fdb017ad1e87a43474c4
SSDEEP 24576:SwuoOWb5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:SwDO65SW6H8DS52tdDpbRZy
TLSH
T10305F14533A41CFAE96B4239C597C136F7B2B8162A24D72F0760C65B5F37252AD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 e4ad290e2729a8fe6cd5236682f51e72b2b8e28f685838f1d6728bf7019f84fe
MD5 d6f8c6327701902d1ab85b509b41057f
SHA1 d7a002a2c42dcbe92da75f1f5d5efda89b733b62
SHA512 729b9d54ecf204d9c6dbb838c8ab6f1217cc9d207d1b6d54dda8d45263d752e1916cc35ba30246f5ea928f191c2c2655e0c603ea8ad40f97126aa242bf730a7d
SSDEEP 12288:IBZ1Iyv5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6F:2Zug5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T112E4128923E430FBE25B42BAD9F54685D771B4A6533443DF0A60429B5F33AC74E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e114cf293fcc533af4bd3906e6b52b885dba6047b8e8e3a30d4f5c154f0bf49f
MD5 1aec56de2bfcb877330c839d1f28f1df
SHA1 e36f113ef7fac995cb010083331fe4d07dc4f0c7
SHA512 d989bc389b1e04c2ab530cb6e32ddaaa6e8afc96246ca72fcd2d73b67301c5c1834a6e8d3b5a6b0492e82289457297c7130696fbb01457a576f723788842dbe9
SSDEEP 98304:OQRQyi36YOcPQLvw2gAf+PN3B5SSDntdDpbRZy:VQyiKayX+PNTSintdDFRo
TLSH
T19A667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fb1d5c36e474edb98a884330f15ba7ec9a1b4467388da6196d56731eca7589f1
MD5 84136c91988f50df7ae2158eb3e84674
SHA1 a21f6e04d4c327c526cd5b80a7670a852b9ea1c6
SHA512 d9629badace9eb35c44425736aea781d0afded01cb64343da872db3938a87b6a0a8ba563af9285bda88c4695ae57e0c57261666d32814884e9e3e2bbf3735c6e
SSDEEP 98304:+QRQyi36YOcPQLvw2gAf+PN3B5SSDntdDpbRZy:lQyiKayX+PNTSintdDFRo
TLSH
T1AF667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5532b37bba347f08a6830aa4bbaef8efbe1cfdd89745308b3496b91bafaa9d2e
MD5 de16e462dd309c3cc5d3fbfd1b69cdd3
SHA1 77e211df452d54b2bfe348540e63b89491b141b8
SHA512 6c97e421769c51766ebba92a07e6a6c7583f26cb478bd0f173843079e0febe553b0002e58054e464604fbc1441bf9527d8dbb1d845dd4ea9dd897961fe53b094
SSDEEP 49152:f68Qg55nhheWu7PNU3/P5SW6H8DS52tdDpbRZy:ZthWRc/P5SSDntdDpbRZy
TLSH
T1BEB54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 42e4db4fff947166ca03eea1ff9e7929c0647a97e02f6b9168e33eca961dfe48
MD5 af47968321eac43c18becc6bb086eb10
SHA1 18e201834541734b8a2c5e4fb15d2f9e8093fc50
SHA512 7d79338888ef5d823becfda1fa9898e4870766136265e1d8e9a63835502873644c083bf5a24234d22230c090f3f22749b1112bf6507573be5c026bc6f9372dbd
SSDEEP 98304:wy5112gYy5azzVvL69nLKnhZs5SSDntdDpbRZy:JLIHmWhsSintdDFRo
TLSH
T14A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6c71bb6f2fd27bb7838c9d3b132bf4dc21af8d72205a1179d7dbcf78301e4c40
MD5 6e8134dc2b0feadb8da967ff974536c3
SHA1 868b9cc8c33d3d8038915137a7b0451eb9133bde
SHA512 df6c122a303a865d3ce67a1d8d52abd5c6febf4dc4de986142f5c650bc51197a0705314b8e3838cfe7483e6bc2e28137e114ae50618cf9ea44a0c1d4c610eea7
SSDEEP 49152:kB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glp5SW6H8DS52tdDpbRZy:+u6JmVxd2dp5SSDntdDpbRZy
TLSH
T1BAD59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 dbadbd3d9c040cd2e6cb9cd3c065724303753c4409ba5a35bcf627f5d5422d3d
MD5 713397b923d59d6306ea232f7064c013
SHA1 8cb3a2dfc55ab3826c7ecd3f295e6f1b0ba1d33a
SHA512 087392caee3a8521f3a46b9dc8ed253ec180f4720fdc8c109cf298a2ea00e33c9ea86d9496d07b01abc56db4a55067cb738d17f7263f5d624d43e6c31e1bf0d5
SSDEEP 49152:c1hpsNoJpF1A6UU44CwH7R4xl5SW6H8DS52tdDpbRZy:cmifPbR+5SSDntdDpbRZy
TLSH
T1D0B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d56762e39a72b699aeb1f1c9ee9061b1aa3d0f402eb5e0cdd2c208c1c87f277e
MD5 a584fe9e3375cbb99fed0394d3d66265
SHA1 d928767b61c58ad78894e473bf657c4d22093334
SHA512 51402aebc200db452a7b34883b8e264f0b91468bd89d3bc59d3e1c8722a418633f85d5c8fe67bcc31e928f09a9298fff326ef7d3acf58b75cb86991b78fcee99
SSDEEP 49152:OSuZQIY0Be2KRRVtOnks6NMHqg5SW6H8DS52tdDpbRZy:A5dKTi61g5SSDntdDpbRZy
TLSH
T147C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e34c6adce30aa48cec2b97c8a1450d6f5bd872f0d5fc6798f793fee2414b735a
MD5 7cee5f2fcf7a37a26f99a79207d13fbe
SHA1 8d1981333dd570aa3b027fbf50939b333295d061
SHA512 2d7868ad8ab8516c5f1631c5470223dd7efc69d6dd196744da9dfb22187d40f0686b14218e91d4eebea96bd1c5891e7ad08618fa7d4f594610bc3c4bed9ad736
SSDEEP 49152:IhtSn8EApI0figngiDn0AP5wZ5SW6H8DS52tdDpbRZy:ZX2iypha5SSDntdDpbRZy
TLSH
T1C795BE13F2D900E8D05ED175C7568632EA62BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 8edee5d2efa7ca187d3b55ad8cdb3b49c3efc6a61581d9d681c15d18a793918f
MD5 25d6fa9c15cfe34deefde8fbdca69a2e
SHA1 d6fb3a9de187fca3bd61d8348958eb93f16feec9
SHA512 b12222387e28e5cc9355b8b55ee060dec81bfcec9434fc5e88fc0df05fec723ee84a0605da94a9737858444b0c1b94cb8530130da61f60d30cb7b7b2d016f5eb
SSDEEP 12288:H05OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6v:H05SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T199C423C457A121EBE30E0AF3E2F686D4DA0CA5EFD408623B5E716147CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 4d223a59f335a5683bb73df37f6410770ccbd5395797fd41f5676cd4856191c4
MD5 d94bbf8646625c42845c1dc951453080
SHA1 0672493cfec38e62c4094cdadb4412c737f1deac
SHA512 47c89c579f6660ef5616ffee5378a637959d02c0c3da001b866bb3b6c9457138468f722eab651bf86f7ee1c928e93891258230e71d3a38756e3bda81fef064e4
SSDEEP 12288:+z5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6v:+z5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1A1C423C457A121EBE30E0AF3E2F686D4D90CE6EF9408623B5E71A147CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 291d28864cd53865186f1d6640694611f80eba23d2f90f613e8ad5c1acde2ac6
MD5 b4ce9f46d1efac03f7856a32430d8fd9
SHA1 d69810e714230426826de19c6aaedaddf148a31a
SHA512 1455d69b61a25c3dfd8a0d5f5923b136c3b4abf952c97621c64b275a79a80c008912e14e73863df8cb272fdd106985f5e5ecfbf6d31049a4e5e6f02fb049e460
SSDEEP 12288:rN5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6v:rN5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T19EC423C457A121EBE30E0AF3E2F686D4D90CE5EF9408623B5E716147CB35D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 61f1b97bffbc230489c4375e742672e0e19f6cb3e9da93e16e72bb5d6df0463d
MD5 a3425c429498f9e861162c8fd88679cd
SHA1 04ba9bac1f83840b32748f30990c6ccac3f27ff7
SHA512 30b3b061dcdbf6727b70fd903ec8747d197ac442670ca62bea7a49bb9d29648e02cded3c1d633d45bee6de0b7522f1eb7fa6f083f45bdaba379e1c812eb557c0
SSDEEP 12288:vV+5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6N:c5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T178D4238417A121E7E61E86F3D1F686D4E628F8EED524637F4F20054B8F31B8B8935A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 10be9b89a56389a957600d13729c8b2a5fff21a1316ead7b3d3d87d08e573015
MD5 9da3442071245986327a11191ddfdf8e
SHA1 e1ac6ec8a5f909a00b2fcb31c228ad315566f343
SHA512 26aaa92a3a3fbaa97e2e71962c6e5f074af0667abb1c0b0fb4dd80405a11e19b57926351abef7702ace6d37a12b3b9711e4666d92b292d19a9a13f0dd093819b
SSDEEP 12288:FW5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6Y:FW5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T14AC423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B5E716147CB35D8F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ce386105101f27357d493567d213ce424976f3e07421613a1b3b7ec50ef657ac
MD5 21b5f79ddffa2c0150f7ce0b5afb0ee9
SHA1 92f45969f94ef46bbdfdced4aff91c959dfc9ef9
SHA512 97059d8fac0981ebf3cbec97617fc712216a3589369eb30d9b19630fcaf3d8577ae655ced9ec06f20214fe47a8c3d8009be89cd3f125ab435fa1719337ef411b
SSDEEP 12288:gH5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6N:gH5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1B3C423C457A121EBE30E0AF3E2F686D4D90CE6EFD408623B5E71A147CB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 e9efc573bcc42d847b150984f1e0dc707cd5f3df6a5950a08a157a3fec813337
MD5 cf38d4043e975f3db5fea298770ebd07
SHA1 1a43c2ff0ab8a1925267da336feea42772da24be
SHA512 5fdcf042f19f6f5db407600579dd326075f2c316e35d910a4812ce913692cc56727e53212ec458874029dd1e90c45dbc82d0ba20009e1c6ff859082afc127d80
SSDEEP 12288:4r5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6V:4r5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T121C423C457A121EBE30E0AF3E2F686E4CA0CE6EFD408623B5E719147DB3598F4576429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 38cac7f9d7c1c9b75787e3e4afc793636f01750085cc42c63e07291c4a3d7fd6
MD5 d85148b0669034257bfe52f162067c33
SHA1 e8b415e29024df7de0b9cce37287678eedf16749
SHA512 0751c87af4c989b07254adf2de0f9ba25ecddb65e3de2d1653d6c1c09f80af79cebfdca9945e1d8de1b2511a567c9a6dc82ec88cfc4d586d1d4b007e9efe3673
SSDEEP 24576:VZMSzFVSOT5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:VZMSzf35SW6H8DS52tdDpbRZy
TLSH
T11E050294B39018FAEC67827EC9658945D6B2BC5A0760C62F07B436675F333920C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 4be91ec3e0d564e0160ad2c34c855d9d450752b87921542fa3bcfdd1ac82c93d
MD5 1a158c6084b1033591616c066fea9c9d
SHA1 93018cbc46b3df5c69101ca529bb10904caa82d4
SHA512 1ecb212257ea1b651cbf7d9d1734a329182e11e2f2a97ae93ba73617cc8e448511537c27dc71058dfee55b1a5b2b0939a947dbd4f46c46d97dc55f0479e2878b
SSDEEP 12288:KQ5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6b:KQ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T160C423C457A121EBE30E0AF3E2F686D4D90CE6EF9408623B5E715147CB35D8F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 5f9526ce93c56fc99fc67a3fa9b4d450207445ffd989d5e251b65feb4c9b3bf3
MD5 e2b071695ef589ddee1c36b375a33e51
SHA1 433362e029447c3e0232be32cb19809295966027
SHA512 f448f080fe31d0a3a201a9728f94d937c32dab6ba138bab351d5d0d0efbb8da5dbf8ee5312865b000e01d083846e7717847b94cad00db103c4d5fb651af81c6e
SSDEEP 12288:Vc5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6b:Vc5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1C0C423C457A121EBE30E0AF3E2F686D4DA0CE6EFD408623B5E719147CB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 228a10e86abd7f7000d8ed5bfe1401f20b6ce3e522eb8716e1468c1e1a6cf15b
MD5 0370be947f92a2de83bd4529e93e5581
SHA1 1aa606421c9685e1083b2e1b4b38e60171927b75
SHA512 d213311f0a8d7dac7c0d580690b752f43ca418de050e1375ce60ba1bbd5d9a5c04bffa2da14f5f5f79387c485505dbe5baac1b2a5b82f95918d11ac7c8951b03
SSDEEP 12288:vyPz5L8v5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6Z:Czyv5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T148F4024773A130FAD12B4276C8A21A41F775B87647248ABF1BA043775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 cfe33639f6033eb7fca60066cd5973452e73687a87e995c679da72ba3643590d
MD5 af718abb9b06451c629147fe33d34273
SHA1 9168f2a374319d5711b5b819976ccdefafec7031
SHA512 bd1c25905b8ce1cceadff3c7031b76d81dfa322da738c5b85ffba21cef3afc7a8ea35275ba6e03fdfe6d5adc3f11d214713264954d1cc38a8c05fb3d89ad874a
SSDEEP 12288:QQ5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6f:QQ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1E3C423C457A121EBE30E0AF3E2F686D4D90CE6EF9408623B9E715147CB35D8F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 a7f55d2bb61591a9a1484064c6c7570ec31f19ec2d9d87329f46a8a108e9f5dc
MD5 91dc23cabab2fb51574fcd1a9f48f4a3
SHA1 c3c50145773efe303d3d65f631d1a46c381c1d1e
SHA512 d6e7fb55de6f575c5f9c520f18432da27c6383d7cbc648bef1786b3ed78391512df0880ea076e865736ec693fa2236149c63c9ae8125270688ec6c8ee5ebb3bf
SSDEEP 12288:aQ5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6x:aQ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T19CC423C457A121EBE30E0AF3E2F686D4D90CE6EF9408623B5E715147CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 6a9911b66f60b05a125e44f6e82cffb3a7f10978590ecc0c53b4d15e1ff1c913
MD5 4c9a708173f3103b492c276a7bfb5748
SHA1 bd7a50a16744dd1e42b07c56d79e04e20e91ccf6
SHA512 e0d6c2f585f1caca0162c63b68afdb4483b53cde4074957b8bcd42fecd740cd753d1d29339067d89265bdd852b8cea2bfbe443f06b38cee292269ff6e67579ab
SSDEEP 12288:WyPz5L8v5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6T:rzyv5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T15BF4124773A130FAD12B4276C8A20A41F775B87647249ABF1BA043775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 720095ebff1ef65d11404d818e911b63e3eaad646872c3d14fc00083bf174695
MD5 2e24d4e72f93a6a60dcc63abce93ee2d
SHA1 18fb2a9dfd07085015dd372dd233bbc6fc8b4be1
SHA512 28580fd388ab5f4c75afc5471794198ba116295eddc7d8496e23341d14e640d1df5a3947d993f2ca27f6fb3e2eff8785719e68e6eec81710e4af8cfe0cb4672b
SSDEEP 24576:tTHaLl3z0zDd5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:tT6Lljy5SW6H8DS52tdDpbRZy
TLSH
T11C050294B39018F9EC6B827FC9658946D6B2BC5A0760C62F07B436675F333910C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 18087f492e6aaf2ff1250b1cf4653815b9643632f91a87e3ce2cb7e6d8ae4fa6
MD5 f74f1f44f38a3455976bf52e380223a0
SHA1 ed94f5460c98e5d6b1d161b563a370876f42a559
SHA512 755d4d52688438adb3cd9fc420e4c0efda960c1ab5578763779f5b654566c72f33a2fda487002b33c29a8baf96d118d202332669265080b050e53ddf61ae1c1b
SSDEEP 24576:y37d9CHKy7GZh5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:U7d9CHKya35SW6H8DS52tdDpbRZy
TLSH
T12825CF90F3E410E9F1B78A75C9768511DA767C9A1B30DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 a1bc2ccca2a156a7f8ebec8b9895c657f679b43ebd94d473b76e9305ab00f96b
MD5 2c4d0d5c472a77d87133341560bff6a4
SHA1 30d649b390bbdcc320a26ed527109f636dc814e7
SHA512 a923836984dfa798d2bc618bf560d44490e340fce61cb9f306247562f92285678919c0d83e9b7ff5dc863b45192185616329d22c211ca8e8c33227cd4f41e5ef
SSDEEP 12288:It5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6h:It5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T180C423C457A121EBE30E0AF3E2F686D4D90CA5EFD408623B5E71A147CB35D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 0f9b9b966b58a4eff806dc4788c41984912702830bff10cde615c92478ea824a
MD5 563c9f461ddaaeeded0d19997b90b0a1
SHA1 c9c2bd5c1e85156acfaee5c43dee1295289802ac
SHA512 42be58badf417be4e86f6dc7229b65e6f5fbe82fdf32f9dc84cebb977a57237bf3a6f9240fdab3e61575d582c4576af8e8fd31f9793a931657c64879d1906322
SSDEEP 12288:LP5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6p:LP5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T104C423C457A121EBE30E0AF3E1F686D4DA0CA6EFD408623B5F715147CB3998F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 6a638a448628bdc7b6e4a6fe986a1e24f086c35b2ee950d36a3896bdf9d15b5d
MD5 d8e550f5dafa696536f5c7828449f280
SHA1 823151df603509135cf6223d4b05e952177f2f66
SHA512 99f852307b5bf9fb2eb3c5c7ccfade32b354d469f61dd9327e7ad40fc037da7cdafc58658741d30cfcc50456e1368044a4cebc1d56b2fe6201740cd8976baa9e
SSDEEP 12288:FK5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6V:FK5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T16EC423C457A121EBE30E0AF3E2F686D4D90CE6EF9408623B5E715147CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 0fef82f6c76b75e8a4daab316fec7ce6fcd1068ded5e2f11c497b7412a118275
MD5 df419d17c993eaf87b412293ad632286
SHA1 4f80d7c96d8bf9f14d44b8e4bc555405c69b9ed8
SHA512 4d285e8cf8feacd7d061878106495b1442b3820f21f3b8a0e77f882515fca71fa153da8b2f3b4b72afff203f058080ffba012cdaecc88e0c152e3c4aae6248c9
SSDEEP 12288:+Q5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6E:+Q5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1E3C423C457A121EBE30E0AF3E2F686D4D90CE6EF9408623B9E715147CB3598F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 627ef8390ca00b6b8f7104c685d99892958e8861d7f0780fc1f579a2d9e26ed0
MD5 3e767608c83c90414c20c5a5eacf761a
SHA1 b2d25b568b27f44959601c409564fe05fe9861e8
SHA512 6b52b34bbbc8dfd502c165cf186fad657a69f53c08075d2c8412fdc925e659ecb9eeabf4084ef9df55c786ceb0aa1fe450c2def96df0e77ef69947af5cf4ab7f
SSDEEP 12288:Mt5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6I:Mt5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1F3C423C457A121EBE30E0AF3E2F686D4D90CA5EFD408623B5E71A147CB3598F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 e0dd164d1b8f90dbb1016766b7832f2a006792dce48a55d17b6a1a57a3aafa62
MD5 345948c586809eef904f7dd45b7ea106
SHA1 24cad664b581c7dede663523217b9ec903dc1a9b
SHA512 5d2db89a994eeeadc2b351022bc7d329d252f823a37fea2b393fec1ce6dd12cbc9864557f716fa20a583bd51fb6834ffd854125c0cf4379b1a1499a3de437aec
SSDEEP 12288:8o5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6U:8o5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T115C423C457A121EBE30E0AF3E2F686E4D90CE6EFD408623B5E719147CB3598F8576429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 0712c49627bcf13b476a3bc17a05f7a28c3a529658904c8e6d37ec1a4dd0b67f
MD5 69321763ee8007ed83cd260101e57962
SHA1 8663ad60861a32e1745a89a390ae6c68c73b6174
SHA512 a902bc94482a003099ed237a6730d380d0d3008faf3a7b35b7b4afcb5618846046b23581e66e558209479b20c9cbe555c26e399f0902c7ddf9460c2c818a5fa4
SSDEEP 12288:cW5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6I:cW5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1AEC423C457A121EBE30E0AF3E2F686E4D90CE5EFD408623B5E716147CB3598F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 6523b467d33e6e5fe853563ace8383e2515474bf1d3749f4285414664dbbe02e
MD5 876de83b3e36fd9d6ad9157f36f2d3bc
SHA1 41e40771f621bb6ff328bbacf7f8f1179aa9e900
SHA512 7bcca4ed704efe3cfe5e172c8f48df1a40949e278fa1d2394aca9f80be63a641c62230c4625645c988cc9f4ea515cb7a0c14e69171a4c19b66da082fbabe0db2
SSDEEP 24576:ufwvok9RX6wkyAIM5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:yMnYIM5SW6H8DS52tdDpbRZy
TLSH
T1F135D029EBD804E6E177923C99F7460AF6B178691B31C2CF025A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d194185d3376c64a154450a81c440c0df0832a8a38f4026d823b7e30d6269d14
MD5 d09fcafb348f27c953452722cd660fd6
SHA1 85b2699b109f06df3ffe6123078fb77a489463b6
SHA512 86fc5f9fa1feb11cfa0ba055ee9e355fbe06e8015c9f1483d58ecd9474cf3b6a70f482b20f6addce602ab6755937b71116b2eb9a3d2cd95be2ba50140110f885
SSDEEP 49152:SYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK055SW6H8DS52tK:MySzPh5SSDntdDpbRZy
TLSH
T18F066C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 91df95b99e1b89557178ba94fb61b5427f9e3ea487966d0c978075620c1fa233
MD5 deb5665e48b5dfaa2c143828b16a51c0
SHA1 725887e38eebf0a9f86f05f48aef155a0b32c7dd
SHA512 0f0a680f6dcdf4d1fd623a7120b27f26d6e334ff3c89016920b5d56b6317b9ffc3fc73b9c89a2b9bbfab8e52a744185bcaf0f37635119dcc752fea191f485f87
SSDEEP 24576:u47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYD5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:u47JUQj1irIhCnDHUPfF/p5SW6H8DS5X
TLSH
T14465AE1DA3EC01E6E1BA927885554A5AEA71742E1F31CACF1270837D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 f3cd9c54cf3701b04e34ebb81828201159df9f582c68379305fc4f405f98a882
MD5 3fb5040200e4bd6515bdb5c09448b3f3
SHA1 579d3c2f567aa1dde2f1aeecdf8e91141dcf5621
SHA512 3bd337158658c7c0c70c9caa2574ed1731134bf7d6171a1ba05cbfb4b875c4694b89bb32210e4ea87e2aad53bdda110c0c785bfdfbadd587ce9b85a33dfe3b9b
SSDEEP 12288:bNsfg5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6p:Yg5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1C7E4F149D39412EAC01E5276C7A64A80F3277C6983E0D3DB5AD0F53E0F366859DFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 491fed7ede345cd89998d24bce7f77cee46bfe7e3b021e8ac2f52f143ede560e
MD5 1e5170f14db2ed19d73738d598f33810
SHA1 13b88446177a287db11ab951eb6f228fcedf60fd
SHA512 0bcb559281a3302433d34e7c806b62e4f706bd680a151cd8477d2d815385767a0e2181d2bbef43bc8b8f2c215387319d739fadb55d3d2c071c7a1726bc76fa11
SSDEEP 24576:h8ntUPGDFp19hfTXfJPuMtcln27pu2BuV:UtUuDbhfLfJPueMnOpu2IV
TLSH
T152451700B626D78FC6A940325E36D6CCA7707D01EE08AF1773C8873FD576659BAE5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 0a3db63feda6f136af69c8403183899478202bfb78782350c7d00bda3a97e110
MD5 a831bf7f267b748c6504a8b9832bdb41
SHA1 ea26c789f69673d011679f4779c8f99d249f8c32
SHA512 02306f436e733fd6c8770d4ef56e138a85c541f0892cb65267aba15aedac713a96096793fafc3f5fb4b7ca85fbd3bff0b1dfb6c60aeaf9447a3f299612e076bc
SSDEEP 24576:qcx4IHFNMSIHab5eHERTTX8vH5W0GgdZaJP35eO:L4IHFNMSPsdZaJP9
TLSH
T113551A01E5B7E34FC9799037563286CDBB746C02BB453F057348893C9866A6EB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 9466cb0c5a0e66976b1a3e1fea1273df27df1c414bead07a933466fad3edc9e0
MD5 d509cf6d4bcf97d6b3be9daf1851cf9c
SHA1 c834b5fea631c920b89f7ab151fed28babbc9905
SHA512 bf311a800b79bb53f07716d638597cb1f9573b841fe62cc82e9ce3058a91f91ea03e5e8509f62b5f2d1a1f69feb837f7f02cf7d224372f1ead353db75f9c9d12
SSDEEP 12288:8F745OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6K:Q45SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T141D4238043942597F22E06F3A1FAC2B4D60CF5BE8B0491FBAD216287D735DCB8D7651A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 283c5f0b57c11138e288fb54cb6faf060098e01307bbc6bf7e49c66133d626aa
MD5 908a0edbb2fb6c33b1077f6af231261f
SHA1 7e0dcdb9e985dfbe5d4ac70f0fafc347a0e2d7c2
SHA512 2b162c6f46c2bffd1c72ca2b0adfdef116340da2157f857f168949d51ec200cd91329d1d769b8932c9c7e23cc6e1041f9c00eb31019d483acad66a257137079d
SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bYy5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Jgb4mBIBhGFD5SW6H8DS52tdDpbRZy
TLSH
T1C665AF1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 5e696d57cb7ab6921ce950794b4ba0d11ec80944eef9f55d784152bde84546ea
MD5 40a1854df50d4e6ae0633afab039055f
SHA1 5c57d73bf141fc1a73e52cb927001d74e1e73096
SHA512 ace9c6032e5f809c6067748a47bf422245cbd09fd78111c19b7c8efeca2faa614af08f0cee68568b4d9d54874f8f5afd031a27578dbec3a971bc867a9e456a68
SSDEEP 24576:oG88u8FpJqH1bzria7/mT5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:L7ZFPqVea7/q5SW6H8DS52tdDpbRZy
TLSH
T16F35016577E101F1D47BD138899246A3F6B1B4250324EBEF0BA88B521F23AD54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 e0535d8a3f20fe28444efc1b2de12327959d6c834eaf8f64295967b62bbd9c41
MD5 69cee15f4fb707988acf62224977d731
SHA1 66ef00bdee1d19b9fcfb06c90d632c838a6d060a
SHA512 6348609f679e868ee7218c590671cc93485b18d8ff1a35ac5e63f85f232f5c9b1cf35de2c2bf5b62be643d7d402f9c60cec6e55aa1c511a56a52a30e7e206388
SSDEEP 24576:kPUr+NQ35SSiVw6uAX8DS52tpz9ZRzbPmSZyo:kJQ35SW6H8DS52tdDpbRZy
TLSH
T14805F15E22E818E6E67AA17DC5828719F771B4660311D2DF06E0817F4F27ED8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bba9cecebcb85732aa6746c9bdf1bba89d297ec961d6dc650099301e76dd38f7
MD5 ca5f51058121cbfed8b582b03608a4ea
SHA1 8d0316c8187196937bc1a98fdfa59d1ce05c6fb7
SHA512 7b0a9bcaec63d2f1fd694ef76fb352901538b0a80b94ae42837869106c438608595f2fcb77ad8acc4bd91c3b0aa2ea413546b0d06717c81f9a4c9d0840abe34b
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjH5SW6H8DS52tdDpbK:DG05lO43bk5SSDntdDpbRZy
TLSH
T16FD5CF6A62EC11F9D1BBD17CDAC64A0BEBB23425033456CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5d8661cfba7d71ace06373b6d5d8346a4411ea0aed07d4e38d85089db7254e09
MD5 edef2a368f7a466e41fd8d9606ccbb67
SHA1 47e8568809beeac1962a210e8ecd995197f9b8e5
SHA512 027c014637a84d5e8d5c98ee27f1b7cbe74d680997a50aade2c160d44658fff58a33e0c404410b5ea7044a5c0b366603c8f21506f9f3d007de5245d01ff18ae9
SSDEEP 24576:Wfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn55SSiVw6uAX8DS52tpz9ZRzbPmS1:Oa5POZ3+Jt2pasx2+mP5SW6H8DS52td
TLSH
T12465AF5EA7F801D5E179D17DC583861AE5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b1d69e12b3c759cf7f8bae0d51112800337ff4cdd1a0b719126ca883e56b7f97
MD5 82ea402c2dbdbeceab8d0fdfa07de609
SHA1 0e231d78ca7e8061dc31c4279f7fdc50edcc7340
SHA512 3d22a38eaa4b754a102b3dcbb9c894b3108c9393b7ecea2a2435b2950643141694983c6276d3c57c61b5161c652cfc8ff2b513781f6051e3f8153ff8912e5cf4
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7Fk75SSiVw6uAX8DS52tpz9ZRzbPmSZyo:PNc/zEOVHFK5SW6H8DS52tdDpbRZy
TLSH
T10B857B5623E901E4F1BBE1BE89779546FA71786953308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e9e9e214ad34ba29993831c47c4a30192c5014fdf0bd40cea7946ded3ecbd892
MD5 1a0de43462e9241ba788a9f55c4532c0
SHA1 275322e6f509fc512f5541bc2c79646d51103c46
SHA512 72d02acb7ffd4911429f466fbdfc8d99172bc9ba4b72125b14010fc138f9e2e54143263c4a9009e1294cb9b8f5e3f07b5c0257a13272efb0c5052c2530305e3b
SSDEEP 24576:s8kNvNnaFeYhJNtmZBm15SSiVw6uAX8DS52tpz9ZRzbPmSZyo:s8MwBtOm15SW6H8DS52tdDpbRZy
TLSH
T11655AF6EB6B806E4D1FEC6B5CD238512EA727461073293CB5290C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 7f191ec7306bbb7f84c44ffdccadc2fa1cedc5bdc72644a0fa30900b863557c3
MD5 9235e44ec5122ae5fe0836274d0d5fa9
SHA1 fd4f81faa758b71364d2ec4fa385481dcbdd7aaf
SHA512 113dc50b379504078b855c5e0344c80db9f0f4803da9af226b4d4ec27d35d1a344aa7de0c12b1b46539e25bea72c0f5308c51d40062dfa46ed8dabbe66b68192
SSDEEP 24576:SD3FHshBIYQgAU5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:SDVHeBIAAU5SW6H8DS52tdDpbRZy
TLSH
T12725E17DE79800E5E57BC1BCD6A38A06E77138AD032166DB06D081B65F2BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-135-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/256-129-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/256-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/256-140-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/256-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/672-43-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/672-42-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/672-49-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/672-53-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/672-55-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3864-333-0x00000268FABE0000-0x00000268FAC8A000-memory.dmp

Download

memory/4360-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4360-319-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4360-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4360-110-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4360-104-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4360-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4624-81-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4624-315-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4624-82-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/4624-87-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/4860-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4860-335-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4860-98-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4860-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4860-316-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4860-92-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4940-124-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4940-118-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4940-117-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4940-318-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4964-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4964-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4964-159-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4964-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5680-145-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5680-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5680-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5680-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5708-299-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5708-64-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5708-58-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5708-57-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5752-8-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5752-0-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5752-80-0x0000000140000000-0x0000000140457000-memory.dmp

Download

memory/5752-7-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5752-6-0x0000000140000000-0x0000000140457000-memory.dmp

Download

memory/5856-76-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/5856-68-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5856-70-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/5856-314-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5932-27-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5932-25-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5932-19-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5932-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5932-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download